Twitter to developers: no new Twitter clients - <AUTHOR> http://groups.google.com/group/twitter-api-announce/browse_thread/thread/c82cd59c7a87216a <comment><USER2> It's the old casino analogy: When you're betting on a platform you don't own, the house always wins.

I don't know much about Twitter politics, but we've got:

\- Developer hostility this week

\- User hostility last week, with the dickbar

So maybe this is just how it goes now that Costolo is in charge. "Fuck the loyalists, we're here to make some money. Getting sick of these third party tools charging coin for our damn API while we get nothing."

If so, the question becomes: who creates more value on Twitter? Is it the old guard, who use it as a communications and community medium? Or is it the mainstream, following celebrities and talking about sandwiches they're eating, eyeballs to be sold to the highest bidder?

(edit: My hunch is that, too late, the Pareto principle will be discovered hard at work: 20% or less of Twitter users actually generate 80% of the value. I just can't see it as a bland, empty consumption tool. There's surely peril in optimizing toward that.)

It sounds to me like Twitter wants to round up its user-cattle and drive them on down to monetization gulch. Anyone who gets in the way of this is going to be flattened.

<comment><USER3> "When you're betting on a platform you don't own, the house always wins."

Except when it doesn't.

It's not a zero-sum game-- the house winning doesn't mean that the bettor loses. Zynga, Rovio, and FourSquare are all pretty fat on platforms they don't own.

<comment><USER4> are they really? Rovio might be the exception, but how fat are Zynga and FourSquare right now, compared to their debt?

<comment><USER3> Uh, what?

Zynga is making $50M per month: [http://www.engagedigital.com/2010/05/14/zynga-revenue- estima...](http://www.engagedigital.com/2010/05/14/zynga-revenue-estimated- at-50m-per-month/) (they've raised $500M).

Foursquare is a bit farther from monetizing... Not sure if I'd bet on them but they would be nowhere without the FB/Twitter platforms under their feet. But they've raised ~$20M on a rumored $100M valuation.

That isn't debt. In both cases, the companies sold a small minority stake of ownership for a huge pile of cash into the company coffers.

<comment><USER4> That post is nearly a year old. I'd be curious to see if anything has changed.

Not debt, but it's still money owed.

<comment><USER5> "Not debt, but it's still money owed."

False, and inanity.

</comment></comment></comment></comment></comment></comment><comment><USER6> When companies started releasing awesome APIs for free, we kinda wondered "what's the catch?". Years later, we're finding out.

The hype surrounding free APIs without formal agreements is the biggest farce in the Valley. We are now in that phase of the cycle where this will become more and more apparent as these companies with awesome APIs get serious about making money(and the free API impeding their revenue plans).

Free APIs--especially the powerful ones--should be seen as "cute things" with little purpose beyond experimental side projects. If you ACTUALLY want to build a company off someone's API, get a formal agreement with that company _especially_ if that company insists you don't need one.

So much has changed since the 90s when access to APIs meant paying huge $. And yet, so little has _really_ changed.

<comment><USER7> > When companies started releasing awesome APIs for free, we kinda wondered > "what's the catch?". Years later, we're finding out.

H.264, anyone?

<comment><USER8> H.264 was never without licensing fees and I don't think it can be considered a bait-and-switch. The catch is right there in the licensing terms.

<comment><USER9> I think they were attempting to pursue a bait-and-switch strategy but ended up backing off. H.264 originally came with a "free for 5 years" license for certain kinds of non-subscription online video, which was renewed for a second 5 years in 2010. It was widely assumed that the intent was to start charging once everyone had been lured into being reliant on it.

But partly in response to competitors like WebM, they made the royalty-free license permanent in August 2010: [http://arstechnica.com/media/news/2010/08/mpeg-la- counters-g...](http://arstechnica.com/media/news/2010/08/mpeg-la-counters- google-webm-with-permanent-royalty-moratorium.ars)

</comment></comment></comment></comment><comment><USER10> Twitter doesn't want you to build a twitter client that automatically filters out ads in the twitstream, or doesn't have ads on the sidebar like the official client, or in some other way is superior to the official client.

That is, Twitter is planning to monetize by making their product worse, and they don't want anyone offering a service on the level of what Twitter used to offer.

<comment><USER11> What is particularly galling is that Twitter has been saying for years that they want to monetize without slapping ads over everything. Now they're monetizing by... slapping ads over everything. And ensuring that no one can threaten the business model they supposedly didn't want to use.

All of this would have been better had Twitter just started off by slapping ads on their service and making it clear how they were going to protect it. Instead, they've grown their userbase (at least among the technorati) by asserting that they weren't going to pursue the exact model they seem so ardently chasing now.

Sure, 3rd party app devs might be "suckers" for having latched on early, but I don't think that excuses Twitter for such a (to use a Gruberism) dick move.

<comment><USER12> I was about to upvote you until you used the word Gruberism to describe a phrase that is probably older than he is.

<comment><USER13> Gruber refined the meaning so that it applies to such a move by anyone other than Steve Jobs.

</comment></comment></comment></comment><comment><USER14> I don't get it. If twitter already provides the top 5 twitter clients, and 90% of users interact with twitter through those clients, where's the fractured landscape and user confusion coming from?

And if the organic trend is towards official twitter client adoption, why are they taking the risk of coming out and bitching at developers to stop making clients? Everyone already noticed the market for these sorts of apps drying up, and has started wondering how serious twitter actually is about keeping a robust 3rd-party platform for the long haul. This just adds fuel to that fire, for no gain whatsoever.

I get what their goal is. They're positioning to make a serious push to get ads/promoted tweets/etc in users' faces, and they want everything in place to be able to shut down or prevent the 3rd party clients that pop up to filter all that out. Okay, fine. But why make the big announcement like this? Why explicitly freak out all of your developers while you're still on a trajectory of solving the problem organically? Why not wait until it's actually a problem, when you're actually seeing increased adoption of 3rd-party clients that ruin your plans?

It's always interesting to watch a company work hard to solve a problem they perceive from their perspective that's completely at odds with the problem the rest of us see from ours. See also: record/movie companies and DRM, Rupert Murdoch and Google, MS and Internet Explorer, etc, etc, etc.

<comment><USER15> A Friday afternoon release of bad news is a typical PR move to blunt the blow.

<comment><USER16> Too bad only nerds will care and nerds will be online over the weekend.

</comment></comment></comment><comment><USER17> "More specifically, developers ask us if they should build client apps that mimic or reproduce the mainstream Twitter consumer client experience. The answer is no.".

How can a company who's user base has grown to such an amount because of third party clients say something like this? Talk about showing a little appreciation. As someone who develops a Twitter client, it is a huge kick in the teeth.

<comment><USER18> The thing is, if you look at the new terms of service, they aren't prohibiting new clients, nor are they shutting down old ones without cause. They just think that this particular niche is already filled, and suggesting that developers pursue other areas. It's perhaps not the friendliest thing to do, but I don't see it as a kick in the teeth.

<comment><USER19> Why not let the market decide this though? If someone wants to make a new client because they either see a profit there or have some new ideas I don't think they should be telling them not to.

<comment><USER20> This highlights an interesting loophole in the libertarian "magic markets" theory: a truly free market includes the right to create closed, authoritarian ecosystems, such as the App Store, or the downloadable game markets on all three major consoles.

Sometimes the model turns out to be inefficient and unsustainable, and such companies are crushed by more open competitors, but not always.

</comment></comment></comment></comment><comment><USER17> Wow, this is written in a really weird tone, especially considering it's coming from an official Twitter representative. It doesn't feel clear at all what they want developers to do. Either way, it feels very hostile.

<comment><USER21> It seems like Ryan Sarver, along with the senior and/or PR people who most likely collaborated with him, is trying to channel the tone of Steve Jobs's "we don't need any more fart apps" speech.

If nothing else, I think it's advice developers should seriously consider heeding if they want to create value (and generate revenue) using the Twitter ecosystem.

Regarding whether the tone is "hostile" or the message represents "a kick in the teeth," I think people need to keep some perspective: A hundred and how many million tweets a day?! That's a lot! If I were responsible for the big picture at Twitter, supporting your junior high science fair project Twitter client would not be at the top of my to-do list.

<comment><USER22> It's hostile because it's purposefully ambiguous. They would catch a lot of bad PR for coming out and stating that they are terminating all unofficial Twitter clients, so they are trying to dance around the bush. There is now a lot of grey area with respect to what is kosher and what is not.

<comment><USER11> Ironically, it is the ambiguity that is causing so many problems in the first place. It is ambiguity over where they plan to extract revenue that is causing 3rd party devs to choose Twitter-based business models that later threaten Twitter's new revenue model. It is ambiguity in their rules/TOS that is getting 3rd party devs banned (see: Twitdroyd). Etc.

At this point, Twitter needs to realize that the ambiguity isn't helping their PR, its the reason they have a PR problem in the first place.

EDIT: Minor grammatical correction.

</comment></comment></comment></comment><comment><USER23> As an end user (and by no means a power user) of Twitter, I have to say that I don't want a consistent user experience. I want the best user experience for how I use Twitter.

Right now that means TweetDeck, but if something better came along, I'd jump to it. It lets me do things I can't do in Twitter's tools (or that I don't easily see how to do).

So from an 'outsider' on this topic: boo!

</comment><comment><USER24> Ugh, that tears it. I'm not doing any more Twitter development unless Twitter acquires me. Not hires me, _acquires_ me.

I love Twitter and have several friends that work there, but I am losing all confidence in developing on the platform when I am not a big-name company with an official partnership.

Signed, A 3rd party twitter dev since 2007

<comment><USER25> Just a heads up, the website in your profile, tweethook has an expired SSL certificate.

<comment><USER24> yeah... Since the service is now in violation of Twitter API TOS (tweet data resyndication, now only samctioned through Gnip), I've decided to shut it down shortly... no need to renew cert I'm afraid.

<comment><USER26> As a tweethook customer, I'm sad to hear it.

<comment><USER24> As the creator I'm sad to say it :( however I will give plenty of notice before this happens. Still running for now.

</comment></comment></comment></comment></comment><comment><USER27> "in the name of user(experience)".

Back in the Soviet Union a lot of things were happening "by request of the workers", for example an unpaid [and mandatory] additional day of work on Saturday sometimes.

<comment><USER28> That, and I don't know why they can't just be straight out and say what they mean, instead of wrapping every quasi-statement in 'developers ask us if they can..'

<comment> muuh-gnu Being straight out when planning a unpopular move would do them more damage then lying. Pretending to do the exact opposite of what you plan to do has been a standard tactic in sports, politics, warfare or any kind of games for ages.

* <http://en.wikipedia.org/wiki/Head_fake>

</comment></comment></comment><comment><USER29> "Thanks for all your help getting us where we are. Now, get out and shut the door behind you".

</comment><comment><USER30> Man, TapBots just can't catch a break. First they are about to announce TweetBot[1], when Twitter for iPhone (a free, first-party alternative to competitors) is announced, and they recently announced the coming of a re- imagined TweetBot[2].

On another note, I don't understand why Twitter are so callous to throw away their community goodwill on a whim. They already have a lot - just look how they took a stand when the data for one of their users was requested by the U.S. government. And then they do something like this. (After [this](<http://news.ycombinator.com/item?id=2313152>).) And the dickbar!

[1]: <http://tapbots.com/blog/business/say-hello-to-tweetbot>

[2]: <http://tapbots.com/blog/tweetbot/tweetbot-is-coming>

</comment><comment><USER31> _According to our data, 90% of active Twitter users use official Twitter apps on a monthly basis._

I notice the omission of the words _only_ or even _mostly_. I'm curious about the raw percentage of tweets from official/non-official apps.. and the percentage of users who use official applications say, 90+ % of the time.

<comment><USER32> Presumably, twitter.com is by definition an "official Twitter app."

So if you follow a web link to a tweet while logged in or authorize with oAuth, you've used an official Twitter app.

Given that possibly expansive criterion, 90% is on the low end of what I'd expect.

</comment></comment><comment><USER12> From the announcement:

\- _Display of tweets in 3rd-party services_. We need to ensure that tweets, and tweet actions, are rendered in a consistent way so that people have the same experience with tweets no matter where they are. For example, some developers display "comment", "like", or other terms with tweets instead of "follow, favorite, retweet, reply" - thus changing the core functions of a tweet.

While I don't like the idea of 3rd-party services treating Twitter as a white- label medium, it's hard to believe this is coming from the same service that is famous for letting its users establish convention, and then supporting that convention. (@, #, etc)

(Edit: s/email/announcement/)

</comment><comment><USER33> March 11, 2011 - Twitter was fatally injured by a gunshot wound to the foot. Initial reports are indicating this was not an accicdental shooting. Twitter will be mourned and missed by a wide variety of tech enthusiasts.

<comment><USER34> Interesting that it caught fire during one sxsw and then poisoned itself during another one.

<comment><USER33> Yup, and there's a dozen hungry startups who are ready to eat their lunch.

</comment></comment></comment><comment><USER35> I think the biggest material difficulty this will present Twitter is in hiring engineering talent.

I used to get the feel that they wanted to let the ecosystem develop naturally so it could realize it's full potential. That "build great stuff and we'll win" mentality. Now it feels like they've got a "strategy" that they're executing. Without that light touch it just doesn't seem as fun a place to work.

<comment><USER36>
         build great stuff and we'll win

Does that strategy work at all?

To me it seems companies like Google that did that are rather the exception that confirms the rule - building a great business model should be a top priority.

You know what I consider a fun place to work? A company that doesn't have to borrow money to stay alive that also happens to work on cool projects. Even Mozilla is profitable; and even if their partnership with Google goes away in flames at some point, how fucked up is that?

<comment><USER35> _Does that strategy work at all?_

Sometimes! Twitter has done pretty well with it so far. Depending on the specifics of your product you might fail. But my intuition is that making stuff people care about, and only monetizing where it's painless is a pretty airtight strategy, yes.

 _A company that doesn't have to borrow money to stay alive that also happens to work on cool projects_

So you think the only two options are "sacrifice your community's goodwill" and "having enough money to stay alive"? I think there's a middle ground where you can leave some money on the table in order to stay focused on the stuff you care about, but still pay your bills.

</comment></comment></comment><comment><USER37> "As we point out above, we need to move to a less fragmented world, where every user can experience Twitter in a consistent way. This is already happening organically - the number and market share of consumer client apps that are not owned or operated by Twitter has been shrinking. According to our data, 90% of active Twitter users use official Twitter apps on a monthly basis."

If this is true, then what's the point of this announcement. They make it sound like they are already getting what they want...people moving at a rapid pace towards the official Twitter applications. Yet in the same release they come off as scared that the fragmentation is growing. I don't get it.

</comment><comment><USER38> I think what we are seeing is quite a bit of chasm crossing from the platforms. When that happens, the early technical users (who they don't make much money from, btw) get pushed out or at least _feel_ pushed out.

Yes, we helped build the ecosystem and make it a viable company...but if you read "Crossing the Chasm", it is almost a blueprint for what these platforms are going through and doing...they rely on early technical folks to build a base...but eventually need to reject those early users or marginalize them for sake of profit...very interesting read.

<comment><USER39> Yeah, as much as this post makes me not want to touch Twitter with a 10-foot pole, I have to admit that they're not going to go any further as a company by catering specifically to developers concerns. I am, however, counting the days until Evan's departure.

</comment></comment><comment><USER40> Fred Wilson pretty much announced that the status quo was over for Twitter API developers in an article published last April, "The Twitter Platform's Inflection Point": <http://avc.com/a_vc/2010/04/the-twitter-platform.html>

Notable quote:

"I think the time for filling the holes in the Twitter service has come and gone. It was a great period for Twitter and its third party developers."

</comment><comment><USER41> Does anyone think this could rejuvenate something like Status.net (<http://status.net/>) or any other open system for status updates? (I always hopeful about that)

</comment><comment><USER42> Yep. Last paragraph says it all: Use the API for something besides clients.

</comment><comment><USER43> Can't wait for Twitter to join Myspace in the slow death club. This move is certainly a step in that direction.

</comment><comment><USER44> I don't understand why people are so upset about this. It's simple: Twitter Inc. doesn't like apps which are the same as Twitter, or worse. (I don't mean to say that Twitter is bad already: just that Twitter Inc. doesn't like 1. apps recreating Twitter and 2. apps which give a low-quality UI.)

In other words: they urge devs to develop a client with added value. Wether that's apps for "Company Tweeting" or Real-Time Data, it's adding something to the core experience of Twitter.

Most importantly, I think Twitter Inc. still likes "normal" Twitter apps, as long as they have added value: a superior UI. So get devving, and make the new and better Tweetie!

<comment><USER45> Let the market decide. If developers are making clients that are worse than the standard, people won't use them. What is Twitter's product here?

<comment><USER44> If the market was completely transparent, that would be the case, but that's not how it is. For example Yfrog: it looks absolutely terrible, but still it's very popular. If I made Twitter I wouldn't be happy about that.

A new normal Twitter-user (some who doesn't read HN, basically) might think something like this: "Oh, so this is where you post images on twitter? Doesn't look great. How do I login? Ah nevermind, I'll go back to Facebook." At the same time, TwitPic adds something to Twitter, in such a way that it fits in with it.

Bottom-line: users _will_ connect 3rd-party apps and experiences to the API provider, so Twitter is right in making clear that they don't want crappy apps.

</comment></comment></comment><comment><USER46> _A Consistent User Experience_. I believe I've heard that somewhere before... [http://developer.apple.com/library/mac/#documentation/UserEx...](http://developer.apple.com/library/mac/#documentation/UserExperience/Conceptual/AppleHIGuidelines/XHIGIntro/XHIGIntro.html)

</comment><comment><USER47> Translation: Look, the VCs are expecting a payout at some point and the only way we've worked out for making money is through ads. Now that's not going to fly if people can just get some sort of 'ad free' client from you guys. Our hands are tied.

PS. Thanks for helping us get this far!

</comment><comment><USER48> There is no surprise with the aid of #dickbar. I am not going to use Twitter for any serious purpose anymore. This bottom line has violated by basic requirement of information freedom.

Just seeing this issue I really think that there is still spaces for even more Twitter clients. Last months or so there is one called littlecosm.com which is a client+game type.

It is like they simply don't want people to avoid looking at their public timeline without promoted tweets and dickbar. What a shame.

</comment><comment><USER49> I have to believe that this means that Twitter is looking at turning on the revenues and likely with in stream "sponsored tweets" or some other similar type of nonsense and they don't want third parties stripping out these ads.

Its always been strange that they'd let 3rd parties be a primary interaction model since its very hard to monetize other peoples clients.

<comment><USER27> >since its very hard to monetize other peoples clients

Google API key seems to be at least one way to do it.

</comment></comment><comment><USER50> I just remembered an article written by Alex Payne (al3x), former engineer at Twitter (and used to work in the API):

<http://al3x.net/2010/09/15/last-thing-about-twitter.html>

</comment><comment><USER51> It definitely sounds hostile, but I can see where they're coming from. They want to encourage more creative uses of their API, rather than just flooding the market with hundreds of mostly subpar client apps. They've basically reached critical mass as far as third party clients go. Any additional clients are not going to increase their user base anymore. What they really need is more use cases for the Twitter stream. I don't particularly agree with this strategy of leaving a lot of developers feeling like they just got slapped across the face, but it will be interesting to see where the API goes now.

</comment><comment><USER52> Twitter became twitter thanks to its community that always created value and contributed most to its future path. The invention of hashtag and @ were also contributed by community. the power users that always contributed high quality content and conversations to twitter.

The developers that contributed best applications for twitter ecosystem.

but now that it has justin bieber and other celebrities along with millions of their followers twitter feels like it does not need that core contributing community anymore.

To me it looks like start of demise for twitter.

</comment><comment><USER53> Well, I'm done using Twitter. Their engineered experience sucks, but I do like third-party clients.

</comment><comment><USER54> As much as this sounds like the beginning of the end, I do have to agree with one gripe:

> _For example, some developers display "comment", "like", or other terms with > tweets instead of "follow, favorite, retweet, reply" - thus changing the > core functions of a tweet._

Very true. I have accidentally tweeted by "logging in with Twitter" and then "commenting" on comments. Despicable behavior, and it _should_ be stopped. (Alert! Previous statement is narrow in scope!)

</comment><comment><USER55> On the contrary this helps quite a bit. There was a cloud hanging over anyone doing anything with Twitter whether they would find their product in competition with the Mother ship itself.

It also explains apps suddenly losing access to the API and then regaining it. Twitter was asserting its control over standards.

I think if you aren't building a client, following the rules and adding value you don't have anything to worry about. To me that is great news.

</comment><comment><USER12> To expect enduring openness from a privately-owned medium or enduring stability from a single point of failure is naïve.

</comment><comment><USER56> This is an interesting turning point for Twitter and for API's of free services in general. Building apps based on an ecosystem that you have no control over has always seemed like a substantial risk to me, and this assumption is starting to take shape. Twitter's recent move is an example of what happens when a company is ready to monetize their content and wants to cut out the "middle man" so to speak. It's pretty clear that they don't want third parties encroaching on their ad revenue, and while sad, it was inevitable.

I see this as a very disappointing move by Twitter for the fact that they are alienating the very developers that helped build their brand. This is a glaring warning sign for all applications that are based on an external platform. If nothing else, this should serve as a lesson to all developers that free API's should be utilized with discretion.

</comment><comment><USER57> Surprising: "According to our data, 90% of active Twitter users use official Twitter apps on a monthly basis."

<comment><USER10> You can read that as, 90% of active twitter users visit the twitter.com website at least once per month.

</comment></comment><comment><USER58> That's a shame, because I am still in the market for a good Android client. Guess there won't be one, ever.

<comment><USER59> Tweetdeck is pretty good.

<comment><USER58> Thanks, will try.

</comment></comment></comment><comment><USER60> Can anyone point to language in the revised API Terms of Service (<http://dev.twitter.com/pages/api_terms>) that implies "no new Twitter clients"? I'm reading it, but I can't find the smoking gun.

<comment><USER61> I believe that was pulled from Ryan's email:

"... developers ask us if they should build client apps that mimic or reproduce the mainstream Twitter consumer client experience. The answer is no." ... "If you are an existing developer of client apps, you can continue to serve your user base"

<comment><USER60> That's fine, but that's just the author's commentary. The blog piece is just an announcement about the new ToS, which is the defining policy. We need to look for the language in there, not his blog piece.

</comment></comment></comment><comment><USER62> While I understand Twitter's motivation for doing this -- and no, I don't believe it's about consistency -- I think they could have expressed at least _some_ token of appreciation for the devs who helped get them to where they are now.

</comment><comment><USER63> It was bound to happen ... and about time, hopefully it gives someone enough inspiration to come up with something to compete against twitter.

I want to see someone give twitter a run for their money. They're sloppy.

</comment><comment><USER64> I read it this way:

There's now 75k registered Twitter apps. You're not going to be successful making a generic client. Think bigger: there's plenty of room for success in other Twitter verticals.

(and boooo for the fake FUD headline)

<comment><USER65> Not all twitter apps are clients. I would guess that most are not clients.

<comment><USER66> Agreed. I've got a few little Python and shell scripts laying around that have talked to their API at one point. By a loose standard, each is a client. Perhaps there are 74,800 little shell scripts or integration adapters out there, but not what an ordinary person would call a client app. That I'd believe.

</comment></comment></comment><comment><USER67> Twitter claims preventing user confusion as a motive yet the move from old to new Twitter on the web is the biggest source of confusion. I mean, come on. Teaching people an interface isn't rocket science. Do something simple, such as put out a video a week showcasing use of the new interface. Heck, have user contests to come up with videos showcasing the new interface. Or go all out and develop an awesome training and help system, and integrate it into the interface. If users have a problem, do something about it!

</comment><comment><USER68> This just got some more coverage TechCrunch: [http://techcrunch.com/2011/03/11/twitter-ecosystem- guideline...](http://techcrunch.com/2011/03/11/twitter-ecosystem-guidelines/) TheNextWeb: [http://thenextweb.com/twitter/2011/03/11/twitter-tells- devel...](http://thenextweb.com/twitter/2011/03/11/twitter-tells-developers- to-stop-developing-new-twitter-clients/)

</comment><comment><USER69> Anybody who in the first place developed and designed a product around a third-party's ecosystem and API has what they have coming

<comment><USER27> in principle, you're right.

In practice, i must bring MS as a positive (!) example. Not that they were saint or anywhere close to it, yet they didn't even come close to use legal sh!t like EULA/Terms of service to hit developers on their platform. MS provided their own competitive products and used [sometimes dirty] tricks to win.

</comment></comment><comment><USER70> This has got to be at least partially about UberMedia.

Still makes me glad I don't depend on Twitter's platform at all.

</comment><comment><USER4> This is why Twitter is soon to be bankrupt. They don't understand how to stop insulting the people that actually provide the content and value. The value isn't the technology, but the people developing and using it.

</comment><comment><USER71> On one hand, I agree in terms of providing a consistent user experience.

On the other hand, I disagree and think people should be able to build whatever experience they want.

</comment><comment><USER72> This is becoming an increasingly common mistake for tech CEOs: adopt Steve Jobs' attitude without being Steve Jobs.

</comment><comment><USER73> But I don;t want consistent experience. I dislike the experience and want it done my own way!

</comment><comment><USER74> i guess that's what investors call 'feature' as opposing to a standalone product - turns out that many of these clients funded by them are features of twitter

</comment><comment><USER75> USERS>>EMPLOYEE>PROFIT>DEVELOPER

The precedence of things.

</comment><comment><USER76> That is the deafening thud of the other shoe dropping

</comment><comment><USER77> has google not bought twitter yet?

</comment><comment><USER66> Funny timing considering how there's been a noticeable degradation in the Twitter app quality since Atebits got Borg-ified by them. Their plan thus far seems to be:

1\. identify best client out there

2\. buy it

3\. ruin it

4\. outlaw all other (well, new) clients

5\. ...

6\. profit!

</comment><comment><USER78> _consistency and ecosystem opportunities_

couldn't he just write "you're fucked, we're the boss" without all this corporate BS speech?

</comment><comment><USER79> So if no new twitter clients are allowed, but existing ones are "grandfathered" in, does this mean there will be a market of buying and selling these grandfathered twitter clients?</comment>


United declares 4-digit pin login and lack of SSL "functioning as designed" - <AUTHOR> https://twitter.com/sethvargo/status/617873824344702976

<comment><USER2> > That means the attack surface for accessing someone's account is NP hard, > but N is always equal to 4.

FYI, the "N" in "NP hard" is not a number. It stands for nondeterministic. The mention of "NP hard" in the first place just seems...unnecessary.

<comment><USER3> Is he perhaps joking? Even a brief read of the Wikipedia article makes it clear that NP-hard isn't a mathematical expression in which 'N' stands for a number...

<comment><USER4> He could be in the tweet (giving the benefit of the doubt), but there's no way he is in the email reading it in context.

</comment></comment></comment><comment><USER5> It's not a bug _for the purposes of a bug bounty program_ because logging in with a 4-digit pin is the actual design, not an unintended flaw in implementation

</comment><comment><USER6> Title seems quite linkbaity. In a 4digit PIN-based system, being able to log in with a 4 digit PIN isn't a vuln, it's how the system works.

They even state up-front that improvements to the system are in the works.

<comment><USER7> Agreed. However, United still has very glaring security issues with their site that go far beyond the 4 digit PIN. I can't provide concrete details because I still have a pending bug bounty report, but stuff along the lines of bad/missing HTTPS and easy hijacking of account management sessions.

</comment></comment><comment><USER8> Also, when you factor in the human tendency to pick very easily guessed PIN codes, it's laughably easy. [1] 11% are "1234"

Also, when you log into the United website, you can transfer airline miles. True, once someone complains about their miles disappearing, United might pull them back and ban the receiving account, but it might take a while.

It would be trivially easy to steal lots of airline miles into one hacked account and then sell them onto other people on the open market. When United takes them back, the buyers will be without recourse.

[1] [http://www.datagenetics.com/blog/september32012/index.html](http://www.datagenetics.com/blog/september32012/index.html)

<comment><USER9> > Also, when you log into the United website, you can transfer airline miles. > True, once someone complains about their miles disappearing, United might > pull them back and ban the receiving account, but it might take a while.

Put that into context - there are several groups of people:

A - those who are accruing miles who don't know/care

B - those who accrue miles but only use them/care when they are going somewhere in which they want to redeem them (ie vacation)

C - those who check their accounts daily

I would argue the vast majority of United's customers fall into A or B. Which means that by the time the customer figures out what happened - the miles will be long gone. And I'm sure United's response will be "sorry can't do anything".

> When United takes them back, the buyers will be without recourse.

That is assuming they are even willing or the miles haven't been redeemed already.

Playing devil's advocate this isn't United's fault really - what is the balance between security and ease of use? From a business stand point you want the service as easy as possible to use so people give you money. The average person doesn't want to deal with email verification, complex passwords, or one time passwords - they just want to enter their credit card number and buy the ticket. Though, I'm sure United is making enough to lose a few customers...but it's all about money.

</comment></comment><comment><USER10> Well, is that how it's supposed to be functioning?

The tweet says it's a security vulnerability, their response says it's functioning as designed. Not mutually exclusive.</comment>


Don't publicly expose .git or how we downloaded your website's sourcecode - <AUTHOR> https://en.internetwache.org/dont-publicly-expose-git-or-how-we-downloaded-your-websites-sourcecode-an-analysis-of-alexas-1m-28-07-2015/ <comment><USER2> On the flipside it would be super cute if a site used [https://example.com/.git](https://example.com/.git) to redirect to their source. Aaaand I something to do tonight.</comment>


My 23andMe DNA Results - <AUTHOR> http://www.techcrunch.com/2008/03/02/my-23andme-dna-results/ <comment><USER3> Yes, $1000 is a lot of money for that test. No, it is not incredibly useful. We're in a period of time when DNA testing is mainly for early adopters. However, the Moore's Law equivalent for DNA sequencing blows away the Moore's Law for transistors: every year genetic sequencing has become cheaper by tenfold.

23andme's disease risk indicators aren't overly meaningful, because they only test for a few SNPs and true disease risk is made up of many SNPs and multi nucleotide mutations and deletions, as well as levels of miRNA expression. Many of the mutations are only studied in caucasians. For now, most genetic tests are interesting rather than explicitly useful. Five or seven years from now, after Google's 100,000 genome project is complete and you can get a whole genome test for $1000, genetic testing will be very useful. Let's just hope that the results of that study are completely public.

<comment><USER4> Is 23andMe's test for HIV resistance the same gene as your startup tests for?

<comment><USER3> That would make sense, though I thought they only tested for single nucleotide polymorphisms and the HIV mutation in question is a 32 base pair deletion.

</comment></comment></comment><comment><USER5> Social software with a 'how closely I'm related to you' feature would be compelling. Social networks obviously apply, but how about when you exchange emails with someone... wouldn't it be cool if it mentioned a common ancestor in the footer? Oh, and on a dating site, automatically filter out all first and second cousins!

<comment><USER6> maybe incestdating.com ?

</comment></comment><comment><USER7> The limitation of SNP techniques is that the magnitude of association between a particular allele and a disease have turned out to be rather low - in the order of 1-2 times increased risk. This is virtually meaningless on an individual level - for example if there is a 1:1000 risk of a particular disease in the population and you have the risk allele you would still only have a 1:500 risk of getting the condition.

A possible explanation for this is that that all of the alleles that are tested in genome wide association studies are found relatively frequently in the population - it may be that rare alleles exist that confer far greater risk e.g. 10-100 increase and it is these that mediate the majority of the inherited risk of a condition. These rare alleles could not be detected by a microarray based approach but would be identified by massive resequencing. A preliminary resequencing effort is already underway: <http://www.1000genomes.org/> and within the next few years whole genome resequencing on an individual basis will become feasible with massively paralell techniques such as Selexa.

</comment><comment><USER8> About 10 years ago, I considered the possibility of a gadget that connected to a home computer and allowed you to perform genetic testing at home - <USER2> revealing information to third parties. They'd be a large market for such a device. Unfortunately, it isn't feasible yet but it will be.

<comment><USER9> What are the inhibiting cost factors?

<comment><USER3> For SNP testing, the cost of micro-arrays and micro-array reading machines are way too much for at home use. Whole genome testing right now is astronomically more expensive than SNP testing.

However, if the rapidly decreasing cost of genetic sequencing keeps up, then it will eventually be possible to create at home genome sequencers that feed into your home computer to analyze the data. The privacy paranoid will have to pay a significant premium for this privilege.

Also, a DNA extraction machine would have to be bundled with the at home sequencer, ideally in one machine, and DNA extraction machines are also too expensive for home use. Without a machine, DNA extraction involves proprietary solution combined with various steps of heating and centrifuging.

<comment><USER10> A fluidics station is not cheap, and neither is the rest of the typical Affy rig (and Illumina is worse), but having set up more than a few, I have to tell you, the cost of the components isn't actually very great. (As in, the parts and labor. The price paid to the company is most assuredly huge.)

If there were actually demand for it, someone could throw together the equivalent of an open-source array reader kit for (guesing, but not without basis in fact) $10K or so. God knows it's faster and easier to work around Affy or Illumina's junkware with R than it is to get anything done with their binaries... but that would be silly because who outside of a hospital or lab _really_ has that much use for one?

But sequencing-by-synthesis methods that can use WGA on small samples are the key to a truly accessible and useful map of an individual's genome. I don't really care how my genome differs from Craig Venter's; I want to know how it differs from itself as I get older, I want to know how it differs from itself as I am exposed to environmental factors, and I want to know how it differs from the baseline for my 'eigen-ancestry' in terms of disease risk.

There are so many statistical piles of shit that have already been stepped in (particularly WRT linkage analysis, but I'm sure we'll eventually see a good laffer from a GWAS of some sort now that they're all the rage) that I'd really rather have the tools to work on my own, thankyouverymuch...

</comment></comment></comment></comment><comment><USER11> This opens up a whole new level of narcissism. "My DNA is better than yours." :)

<comment><USER12> And discrimination.

</comment></comment><comment><USER13> I find this kind of thing fascinating, but I'm surprised no one has commented on the health insurance angle here. I wonder how long it will be before "discount" health insurance is available if you agree to take this test. All kinds of fun implications once we go down that road...

</comment><comment><USER14> Oh man, I had no idea something like this existed! Shades of Gattica, but SO SO cool!

Also reminds me of Dawkin's writing on a "Moore's Law" for genetics, basically saying that there's an exponential equation describing number of genes sequenced for a fixed cost.

Guess we've gotten at least to the point where $1000 buys one (apparently) meaningful information about your genetic structure.

Methinks I'll wait until the cost has fallen by another order of magnitude or so . . .

</comment><comment><USER15> I think this might be a good chance for family members of people who suffer from rare and un-curable diseases to see if they too are susceptible. Other than that I think 100$ might have been a good price for this vanity.</comment>


We Re-Launched The New York Times Paywall and No One Noticed - <AUTHOR> https://open.nytimes.com/we-re-launched-the-new-york-times-paywall-and-no-one-noticed-5cd1f795f76b <comment><USER2> When I first read the title, I thought maybe it was because everyone was simply getting around it in the various ways they do, and so they wouldn't notice it for lack of it ever being rendered on their screen.

It could also mean that people click away from it so fast they have no idea what's being advertised, and thus don't notice the changes.

But less pessimistically, it actually chronicles a Change Management process that worked out well in the end.</comment>


Can you trust 37signals with your password?  - <AUTHOR> http://www.jgc.org/blog/2009/05/can-you-trust-37signals-with-your.html

<comment><USER3> Oh boy, that's an embarrassing newbie mistake to make.

<comment><USER4> What's worse is that they've known that it's an embarrassing security flaw for years, but they apparently thought other things were more important. Not really very comforting.

<comment><USER5> "Embarassing security flaw"? Come on. We audit several major web applications every week --- things that are far more sensitive than 37s, like banking, trading, and pension --- and we see sites store plaintext passwords all the time. I've never seen any vendor's security report write someone up for this. If it did get written up, it'd be "Severity: Low", along with "enabling weak SSL ciphers" and "exposed server version information".

I'm not trying to be an apologist here, but "someone is wrong on the Internet" if they are saying that storing passwords badly is a major vulnerability.

<comment><USER6> Really? We're going to downmod the most active security professional on HN? A guy who's built a 25+ person company on the basis of analyzing web applications for security? FFS, did we learn _nothing_ from yesterday's expert kerfuffle?

If Thomas says it's not really a big deal in practice, then _it's not really a big deal in practice_.

<comment><USER4> On the contrary, it's a big deal to me because it's _my password_ and I judge that it's being stored in an insecure manner. I really appreciate Thomas's expertise, but since my data is at risk as a customer, my opinion is really the one that counts.

<comment><USER7> If you're not already using different passwords for each website, you can't really complain _too_ much.

<comment><USER8> but it's still the password for THAT site.

<comment><USER7> Sure, but if someones managed to hack into the server, they can steal your account regardless of if the password is plain text or not.

<comment><USER9> no its cool, they use macs

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> I would take it a step further. Why email plain text passwords? It usually stays in your inbox. This increase the chance of someone being able to get your password. It now exists on your laptop/desktop and on a email server, depending on your settings. There should be a reset password, but not a recover password. Send a link to a secure page which asks for something the user knows/has username ?

<comment><USER8> So many sites email your initial registration details to you in plain text. Even if they store them hashed up in future it's just a bad bad idea :(

I know my damn password - I just typed it in :)

<comment><USER11> I know, it's really annoying MySpace do this

</comment></comment></comment><comment><USER12> This kind of beginner mistake makes you wonder how 'hacker safe' their system really is. You can bet that they will be improving their security soon -- making bold claims about security is one way to guarantee lots of free pen testing.

<comment><USER13> > wonder how 'hacker safe' their system really is

It's not. Not more than anyone else, anyway. 37signals and Fog Creek are masters of marketing and mind control. There are free tools, or at least superior commercial tools, that do everything their stuff does.

<comment><USER14> Care to expand on that? I am looking for something for team collaberation like basecamp and curious as to what is out there.

I recommended basecamp to my boss to check out but after seeing this I am a little hesitant about it.

Edit: I am hesitant because I cannot guarantee that all the users of basecamp will use a different password than the normal one for their email.

<comment><USER15> you can try Tonido workspace

</comment></comment></comment></comment><comment><USER16> One thing worth pointing out is he's saying that they're storing plain text in the database, which may not be the case. They may be storing the password in the database with two way encryption. I'm not arguing the merits of that, only pointing out he's claiming fact on something he has no specific details on.

<comment><USER17> If the server can decode it so can anyone who has access to the server. Not only that, but 37S reveals the password of other people's accounts to the admin. Pathetic.

<comment><USER18> "Pathetic." is a bit excessive...

<comment><USER17> No, revealing people's passwords is pathetic. They are a multi-million dollar company, it's about time they Get Real.

</comment></comment></comment></comment><comment><USER19> That doesn't necessarily mean that it's in plaintext. It could just be a 2-way encryption algorithm. That's what I did for my Twitter app pre-OAuth. That way, the passes are encrypted, but I could still decode them to send them to Twitter.

Now, the way I did it, at least, the key for decrypting it was in my code, so if someone hacked, there's a good chance that they would look through the code and figure out what the algorithm was and what the code was.

Still, if they just took the db and got out, and I fixed the hole before they realized it and came back, they would have a very hard time getting the passes.

37signals might be doing something like that, which is better than nothing. Now, they have no reason not to use a 1-way encryption algorithm, so it's still less secure than it should be.

<comment><USER20> Why go through the trouble of a "2-way" encryption scheme which, as you point out, could easily be compromised by someone with access to the server, instead of just storing a properly salted hash?

<comment><USER21> Because he needs the plain-text password to send to twitter for auth.

</comment></comment></comment><comment><USER22> You said "37signals stores passwords in plain text in their database"

You have no way of knowing how they store their data! And saying something like this is ludicrous and insulting, IMHo. Sure, they emailed you your password. That doesn't mean the password was stored in "plain text"... it just means it was stored. Yes, a one way hash would be better, but they stored the password. That doesn't mean the password was not encrypted when it was stored. It also does not mean the encryption key and the storage database are not on different servers -- which would be harder to crack, since it would mean two servers would have to be compromised. There is the possibility that they used two way encryption. That exists, you know...

Just sayin'...

<comment><USER23> Occam's razor says to me that if they didn't take the time to make one-way hashes, they're not doing anything especially clever with the storage. Certainly no dual-machine way of handling them because that's surely more complicated than using SHA1 or MD5.

</comment></comment><comment><USER24> People are missing the point. The main reason for this is not to defend against "hackers" so much as malicious employees within the company. If you hash and salt the passwords, it's simply not possible for anyone within the organization to access them. Even if you trust all your employees, it can help in avoiding liability.

</comment><comment><USER8> The main securityy issue is not so much that the data is in plain text if extracted - it is the fact that it can be instanlty used.

If you can only pull hashed, salted passwords from a site there is a LONG delay before you can make use of it, if at all. But with a plain text password a cracker can pull paswords, access accounts instanlty, harvest the data and potenetially ruin your site in minutes. There is no time delay in which potentially you can catch the intrusion.

The defence by delay is one of the STRONGEST defence mechanisms you can have. Every day that data is unusable to a cracker the less value it has for him/her and the more chance the intrusion will be noticed.

</comment><comment><USER25> LOL, a favorite like 37signals does something so egregiously wrong, is reported, and there's plenty of security 'experts' to say no big deal. This is a HUGE deal, and thanks to the OP for pointing it out. And you call yourselves experts. Note to self, be sure to avoid writings by Thomas Ptacek, if these are his standards.

</comment><comment><USER26> reddit made this mistake early on and they learnt their lesson. They no longer store passwords in plain text.

The popularity of a service does not guarantee that it's developers are covering all the bases.

I'm glad Django stores all the passwords as a sha1 hash.

<comment><USER27> _I'm glad Django stores all the passwords as a sha1 hash._

This is better than storing plaintext passwords, but it still makes a brute- force attack very cheap. Use a well designed key derivation function which is expensive to attack. (And come to BSDCan'09 next week to hear me talk about this!)

<comment><USER28> Django uses a salted hash - each password is stored with a random hash code unique to that password, e.g.:

sha1$0ae33$b8a9502237851f302170e1bb207d4eb3f36d9a31

The 0ae33 is different for each stored password, and is used as part of the SHA1 hash. This means you have to brute force each account separately - <USER2> can't just use a pre-generated SHA1 lookup table.

It sounds like you know your stuff though - if there's anything we could do to make this secure (while not depending on any libraries other than the Python standard library) please share!

<comment><USER5> That's still not secure, because SHA1 is very fast. To get "secure" from that, you need to iterate the function several thousand times, or use bcrypt.

<comment><USER27> Or use scrypt, which is far more secure than bcrypt. :-)

</comment></comment></comment></comment></comment><comment><USER29> The comments are impressive... pretty much all of them are people rushing to the defense of 37 Signals.

<comment><USER30> You must be new here... ;)

</comment></comment><comment><USER28> Anyone know if 37signals still allow people to XSS their own Basecamp accounts? <http://forum.37signals.com/basecamp/forums/5/topics/3155>

<comment><USER31> I haven't used Basecamp in a while, but I was distressed to discover this when screwing around with HTML in todo lists a while back.

I could put arbitrary JavaScript in the todo element, and I verified that it would execute when run by another user.

Combine that with plain text password reset and you just got pwnd bad.

</comment></comment><comment><USER32> Anyone who asserts in blanket terms that his application is secure is providing evidence to the contrary. Anyone who actually groks security won't make any such claim without loading it with carefully-chosen qualifiers.

</comment><comment><USER11> Whilst doing hashed passwords is a no-brainer and it solves process problems like employees emailing passwords to people (who maybe impersonators) I don't think it solves all the problems with password security.

Unless you have a strong password policy, john the ripper can often find several passwords (out of 100+) in literally a few _seconds_ by doing dictionary attack, variants and common terms. I would say that someone's hashed password should be well protected as a unencrypted one would be even inside an organization.

<comment><USER11> ...and your both downvoting this because you believe every security problem is solved by having hashed passwords?

Another point is, do sites even protect against brute force remote hacking of passwords, Twitter for example got hacked that way.

To be clear I believe they should hash their passwords, but it's not the only measure you should take.

</comment></comment><comment><USER33> A long time ago I learned a technique where you use a random salt to add several bytes to a password. The salt is not stored, but rather the authenticating server does a brute-force search for it, using the user's password as a stem.

For some reason, it just doesn't seem useful to me to store the salt with the user's record, if you're worried about someone with a rainbow crack running through your password file.

Edit: that last paragraph was stupid.

<comment><USER4> You lost me...the way I've always seen salts used is just before hashing, but the same salt is used for all the passwords. Then when authenticating passwords, you salt & hash the incoming password and compare to the stored record in the DB. Am I doing it wrong?

<comment><USER17> Using the same salt for all records makes it significantly easier for someone to crack your whole DB. A different salt for each row means they'd have to go through the effort of creating a rainbow table for _each_ row instead of a whole database.

</comment></comment></comment><comment><USER34> While it's important that the passwords aren't stored in plain text, it should be noted that it is also the last line of defense, not the first. There are plenty of other things to stop you on the way there (not having access to the email, not being able to crack into their data center, the normal stuff).

Just because passwords are in plain text it doesn't mean that suddenly everyone is in trouble.

<comment><USER17> One of the most common ways for data to be stolen is from the inside. Having 500,000 user accounts with plain text passwords is a valuable commodity, all it takes is a pissed off employee and a SELECT email, username, password FROM users INTO OUTFILE '/tmp/users.txt'. Odds are you'd have access to tens of thousands of email addresses and from then on it's easy enough to crack tons of other accounts.

<comment><USER34> Very true, and a point I didn't consider.

</comment></comment></comment><comment><USER35> I would have expected Rails libs to store hashes by default. Don't they?

<comment><USER36> Rails was extracted from Basecamp. The authentication mechanism is something of their own MVC design.

The most popular authentication libraries do store salted nonce hashes by default.

</comment></comment><comment><USER37> Protect yourself against lax companies like this with the PwdHash Firefox extension. <http://www.pwdhash.com/>

</comment><comment><USER38> Military.com is another company that stores their passwords in plain text.

</comment><comment><USER39> obviouky. qhy da fuck not.</comment>


How Chinese students who return after studying abroad succeed–and why they don't - <AUTHOR> https://www.scmp.com/comment/insight-opinion/asia/article/2157081/how-chinese-students-who-return-home-after-studying <comment><USER2> Couldn't help but notice that those who failed to find a job abroad also failed to find a job in China. Speaks volumes about having chosen the wrong profession they can't succeed in.</comment>


Ask HN: Does Passion ever come back? - <AUTHOR> The last time I felt "passionate" was way back in grade school. I want that jump-out-of-bed, work-all-night feeling again.
Does it ever come back? Should I even be pursuing passion? The reason I ask the latter question was a previous HN post that concluded the average person justifies taking advantage of people who claim they are passionate. If that is the case, how can I be comfortable being a jack-of-all-trades master of none?
Finally, I got diagnosed with depression (take it with a grain of salt). People who consider themselves struggling with depression, how do you find that energy/joy again? <comment><USER2> I've never had depression or anything as serious, but I definitely know what it's like to feel burned-out. Twice I've had the feeling of just not wanting to do anything: first towards the end of my PhD, and then after a ten-year run in the finance industry. I had pushed so hard for so long that the end results were irrelevant.

If you're in therapy, start with _why_ do you feel the way you do. Also, what do you actually want to be passionate about?

I've found that _working on my goals_ has been my biggest source of happiness. I also seek-out other people who are interested in similar goals, which has led to a lot of important social connections.

My conclusion is that _living in the present_ and not worrying too much about the past or future has been the most critical aspect of happiness overall. I think you might benefit from practicing that as well.

</comment><comment><USER3> I can totally relate to this. I'm in same shoes. Thing I can tell you is that, if you wish to get it back start doing small thing that are easy to do and allow yourself to fail. Be happy about it. You are human just like everyone else. If you think that you need to be somewhere in high place just to feel happiness, then you need to inspect on that thought and correct it. I wish to write more on this. I might write own journey on blog and share you the link.

Hope this help.

Yes definitely you can get it back, your passion and that energy.

</comment><comment><USER4> See something awesome and long run for It.</comment>


Ask HN: which functional language to learn? - <AUTHOR> I'm looking at learning a functional programming language, but not able to decide which one.  The language should be fun to learn and also have decent job opportunities.
Based on some initial reading, Haskell and Erlang seem to be good choices.  Can anyone suggest a language?
My background (not sure if it matters) I've worked with Java/PHP/Ruby, developing desktop and web applications. <comment><USER2> Clojure. Without a doubt. It's by far the easiest and most productive Lisp around right now. You get a modern core library with great support for concurrency, and you can use Java libraries with ease. The new Clojure book published by the Pragmatic Programmer guys a pretty good read, and it gets into the important aspects of functional and concurrent programming. I've been having a blast so far.

<comment><USER3> How big should be the server to run this site (with all its traffic), if it could be ported from ark to Clojure? =)

</comment></comment><comment><USER4> What about clojure? With a Java background it's easier to grasp, has all the modern features and a friendly, supportive community. It's load of fun, you could even use SICP with it. For job opportunities you need a good load of luck with any functional language. With such a close integration with Java you have a high chance for a stealth clojure project. :-)

</comment><comment><USER5> I'd suggest Scheme, just because the SICP videos make learning it easy and fun ([http://groups.csail.mit.edu/mac/classes/6.001/abelson- sussma...](http://groups.csail.mit.edu/mac/classes/6.001/abelson-sussman- lectures/)). And, once you get the functional concepts, Haskell and/or Erlang should be relatively easy.

<comment><USER6> I think this is a good idea to first learn the basic functional concepts using Scheme and the SICP videos (heard a lot of good things about the videos and the book). I'm learning Haskell (I'm a C# guy) and some things are a _bit difficult_ to understand if you have an _object oriented_ background. I think I'll have a look at the SICP videos, too

<comment><AUTHOR> Did you learn Scheme and then moved to Haskell, or directly started with Haskell?

<comment><USER6> I directly started with Haskell, but had some difficulties with the functional concepts! this is why I second the idea of michael_dorfman. I think it will help you a lot to understand everything _better_. and I personally like video lectures a lot. not that I'm lazy and don't want to read, but sometimes, when something is explained visually or by a specialist in the specific field, you just _get it better_ in your head :)

</comment></comment></comment></comment><comment><USER7> I think this comes up enough that we should have some sort of FAHN: Frequently Ask(ed) Hacker News.

That said. Scheme with SICP, or The Little Schemer and then SICP

<comment><USER8> I've got to second The Little Schemer. I ran through it earlier this year, and it was the most fun I've had programming in a long time.

</comment></comment><comment><USER9> Haskell:

<http://learnyouahaskell.com/>

<http://book.realworldhaskell.org/read/>

<comment><USER10> Notes about Haskell:

It's strange, but Haskell is more difficult to read than write. This is because most code on e.g. Hackage uses some very complicated gymnastics involving Applicative, Arrows, or whatever. So it's hard to learn from other people's programs.

Also, a warning: learning Haskell might screw with your ability to write code in other languages! It took me two weeks before I stopped making every line of Python a lambda.

<comment><USER11> I'm really curious to see how other people are progressing through the learning process for Haskell (and other HM-based functional languages). I rarely use lambdas, and I feel that Haskell is much easier to read than to write. Clearly there's something different about our approaches. I learned SML back in school, picked up OCaml about 3 years ago, and picking up Haskell was _still_ a bit of a trip.

<comment><USER12> I also find I use lambdas less in Haskell than in other languages. I think it's because in Haskell, constructs like partial application, function composition or lifting are concise and natural to express, and those constructs cover most common use cases for an anonymous function. I think

map (find needle) haystacks

is clearer (as well as shorter!) than

map (\haystack -> find needle haystack) haystacks

In most other languages things like partial application are a pain to express, so a lambda is an easier way out.

(Now I'm imagining the six lines of Java I'd have to write to achieve the same effect as those four words of Haskell, and trying not to giggle. Functional style is addictive.)

</comment></comment></comment></comment><comment><USER13> In my opinion don't learn any LISP, Common LISP or Scheme, it doesn't matter. Why? Fragmentation. It's very hard to write something a bit complex that can run on the various LISP compilers/interpreters without heavy changes. Also, there is a lack of good and up-to-date 3rd party libraries/frameworks which leads to having to write things that most languages already provide by default or than can be easily obtained.

Go with Scala, Clojure or Haskell. The first two run over the JVM and seem to have a very nice community behind them. Haskell is very cool and it will definitely change the way you look at programming.

There is also F# which is very cool and runs over the .NET framework. If you're into Microsoft stuff then it might be worth it.

<comment><USER14> Well, technically Clojure is a lisp, but it does indeed depart from the heavyweight lisp legacy as represented by Common Lisp. And portability is much easier when all your libraries are in JVM. :-)

Scala started earlier than Clojure and has a bigger community around it. Clojure is clean and grows quickly, it has a very good potential. Besides, it has a strong and multifaceted support for parallel (multicore) programming. Both Scala and Clojure run on top of JVM and interop with it.

Haskell has had a strong following in academia for quite a while now. Newer languages borrow from it.

I have not tried F# which, as far as I understand, is a kind of ML on .NET. Its community seems to be smaller, but it may be due to the usual animosity some people feel regarding anything that comes out of Microsoft. Reportedly the language is well designed.

<comment><USER13> Maybe F# acceptance will grow when Visual Studio 2010 comes out, since it will be one of three new native languages: IronPython, IronRuby and F#.

<comment><USER14> It may happen, but it would compete with the well established Ruby and Python (in addition to C# and VB). Anyway, I am glad that they will be added to the bunch.

</comment></comment></comment></comment><comment><USER15> Ruby, used that way, is quite a functional language. I think you might find a lot of similarities to Scheme, which might make it easier to get in to. I know I did (although reversed .. I learned Scheme first).

</comment><comment><USER16> Haskell is a bit into the weeds if you're just starting out. I jumped in with Erlang, as its pretty pragmatic so the tutorials out there tend to focus on getting crap done and not so much theory.

Once you've written some code and feel comfortable with FP, then drink the Haskell-aid.

</comment><comment><USER17> I learned OCaml first, and then switched to F#. Out of all languages I know (OCaml, Java, C#, C++, Python, VB, Lisp) - IMHO F# is the best one. Learning curve is pretty steep though, once you move past the basics.

<comment><USER18> > Learning curve is pretty steep though

Do you mean it gets difficult, or that progress gets fast?

<comment><USER17> It gets difficult. F# has pretty much everything from every other functional language. Even though F# is very consistent language. There are a lots of concepts to understand.

<comment><USER19> No, it has just a few concepts that if taken _seriously_ (i.e. don't try to write imperative/prescriptive code) will lead to the natural discovery of many of its other features (or you'll end up inventing them yourself).

<comment><USER17> I am talking about continuations and workflows -> these concepts are not that straight forward, especially if you are coming in from imperative programming background.

<comment><USER19> Fair enough. What I mean is that F# (and Haskell) can be useful without knowing about Workflows (and Monads). By the time you find yourself needing them you'd either invent them (fairly easily) or find them... It's not much harder than INNER JOIN in SQL which I also think most people would eventually invent if the language didn't have it.

</comment></comment></comment></comment></comment></comment><comment><USER14> Clojure. It's a lisp on JVM.

</comment><comment><USER15> One more thing that you may or may not know is that functional programming languages are a kind of fuzzy concept. There are at least two different categories (well, probably it's more a continuum, but ..), being functional programming languages vs. function-level programming languages. (Note: Someone please correct me, if I'm confusing the terms here). Lisp's belongs in the first category, where Haskell probably belongs in the latter. The first category is more similar to main stream, procedural languages, where the latter is more abstract. Which is a better choice is open for debate; On the one hand, you'll probably grasp Lisp faster than Haskell, on the other hand you might end up writing procedural code in it, instead of function oriented code.

See: [http://en.wikipedia.org/wiki/Function- level_programming#Cont...](http://en.wikipedia.org/wiki/Function- level_programming#Contrast_to_functional_programming)

</comment><comment><USER20> I recently asked myself the same question, and I ended up settling on SBCL (Common Lisp).

Emacs coupled with SLIME provides the best development environment I have yet experienced. For me, the greatest downside is that the code I end up with is often quite system-specific.

<comment><USER14> I too settled on SBCL for a while, but then looked around a bit wider. Clojure is an intriguing development. I recommend that you look at it, both the language and the community. It has a good promise, borrowing the best from the older lisps and leaving behind the unnecessary legacy.

So, unless you need to support or interact with past Lisp code, I think Clojure may be a better tool for most of us. YMMV, as usual.

</comment></comment><comment><USER19> As I'm sure you know, functional programming is a style and you can use it for any of the languages you mentioned (yes, including Java - objects are a poor man's closure but closure's are a poor man's object) [1]. One thing that _might_ help is to try using functional idioms in the languages you know. Then you'll appreciate the syntatic help that "real" functional provide for that style.

[1][http://people.csail.mit.edu/gregs/ll1-discuss-archive- html/m...](http://people.csail.mit.edu/gregs/ll1-discuss-archive- html/msg03277.html)

</comment><comment><USER21> Javascript

<comment><USER14> Javascript is a great language (and widely misused, alas). However, calling it a functional language is a very big stretch (unlike lisp).

<comment><USER15> Javascript has a lot of Scheme legacy. I'd definitely call it a functional language.

<comment><USER14> Javascript can be used that way, and some of Javascript technologies suggest that, but it can and usually is used in the mainstream imperative way. People who have not been exposed to functional programming before touching Javascript (which is an overwhelming majority) may not even know about its functional capabilities.

</comment></comment></comment></comment><comment><USER22> In consideration of your background, scala would come to mind. There is some dispute about whether it's a functional language, though.

</comment><comment><USER23> I work for a "microsoft shop." This means that if there is an MS and a non-MS choice of technology, we'll always take the MS one. Consequently, F# is the only possible choice for a functional language at work.

<comment><USER14> I too work for a Microsoft shop. Installed Emacs, perl, MinGW/MSys with bash, cygwin (do not use it, though), python (do not use it), etc. JVM is already installed on all computers except the production servers. So the work that is of a "personal" scope (editing a file, analyzing a log, etc) I can use any technology which is available to me.

Of course, when we are talking about a group effort, we need a technology that everyone in the group is understanding. It is more difficult to convince others (including management) in a Microsoft shop to use non-Microsoft technologies. But it is possible.</comment></comment>


First Czechoslovak radiotelephone networks: AMR - <AUTHOR> https://medium.com/@tangero/first-czechoslovak-radiotelephone-networks-amr-c00df4acf8d8 <comment><USER3> >Welcome to Medium

>Sign in to discover more from experts in tech, politics, culture, creativity and more.

Is this going to become the new norm? Blocking dialogs demanding we login? This is 100% unacceptable

<comment><USER4> At least you can click this one away.

</comment></comment><comment><USER5> As a fun fact a lot of the people who live there believe(d) that Nikola Tesla was a Czech/Slovak due to the (at the time) prevalent domestic 'Tesla' brand name on various electronics (including popular TVs).

<comment><USER6> I haven't met a single one who thought that, or even heard about it, so it is probably not that widespread.

<comment><USER7> Also I've never met anyone who thpught that. On the other hand there is the folk etymology of TeSla = "technicky slabsi" = "technologically inferior", which has some grain of truth as for political reasons the Tesla conglomerate tried to disassociate itself from Nikola Tesla by explaining the name as abbreviation of either "technika slaboprouda" (phrase that essentially means "electronics", litetally "low voltage technology") or "telefon slaboproud" (~ phone and electronics).

</comment></comment></comment><comment><USER8> An interesting topic, although the article could use some proof-reading. Or perhaps it was Google-translated from Czech?

<comment><USER4> Also, several technical terms and abbreviations are introduced without any explanation. Still an interesting read.

<comment><USER7> My try at explanations of terms I've found weird or unclear: UTO - <USER2> Telefonni Obvod ~ Area code "Selective selector" \- direct/selective calling in two way radio systems, but in this case it more or less implies what is known trunked radio stalk - trunk, although IIRC Motorola uses the term stalk for "sub-trunk" or something like that.

In all AMR is essentially analog trunked radio system with the role of operator/dispatcher completely automated and without the ability of direct or repeater calls between nearby stations.</comment></comment></comment>


Apple reportedly under investigation by SEC and DOJ for phone slowdown - <AUTHOR> https://techcrunch.com/2018/01/30/apple-reportedly-under-investigation-by-sec-and-doj-for-phone-slowdown/?ncid=rss&utm_source=tcfbpage&utm_medium=feed&utm_campaign=Feed%3A+Techcrunch+%28TechCrunch%29&utm_content=FaceBook&sr_share=facebook <comment><AUTHOR> Hopefully this will lead to some regulations pertaining to Planned Obsolescence like in France.</comment>


Would a Boycott browser plugin work? - <AUTHOR> Just a small idea I've had, and can't find anything similar except for specific boycotts.
A browser plugin that:
- Users submit boycotts (eg "Evil Corp Boycott" which has 100 websites listed)
 - Browser plugin users sign up to boycotts
 - Anytime you browse a website in one of the boycott lists it asks you if you want to continue, or visit an alternative page
 - Could even extend cleverly into product listings (EG "Evil Chocolate Corp" products on Amazon are obscured)
Boycott as a service if you will!  If users wish to go to an alternative, perhaps there's some referral bonus you can get to monetise the plugin.
Boycotts never seem to be effective as it takes education, conscious effort and meaningful numbers.  If this sort of plugin got enough reach I think it solves a lot of those issues. <comment><USER2> Technically, the first part could emulate what can be done with DNS black hole implementations like Pi Hole. For the second part to work you'd almost need to go around the first DNS part and actually load the image (if it comes from their CDN), figure out what size it is, and substitute it. This would still generate part of the traffic EvilCorp would be after as they would register a little tiny bit of info about "you" unless you're also doing a concerted effort to fill in creative garbage there.</comment>


What's with the broken "more" link every few minutes? - <AUTHOR>

Hi guys,<p>Just wondering... what's the reasoning behind the "more" link breaking down every few minutes? <comment><USER2> the 'more' link invokes a closure stored in a hashtable. deciding how to expire these cosures and continuations is probably the hardest problem in web development today. most often we just wind up using an LRU, which would mean that your 'more' link would go stale once some number of other such links got generated in the same webserver.

</comment><comment><USER3> Not sure, but it occures for me too (only if I leave a page idle for a while, and then click the 'More' link).

<comment><USER4> Me three.

</comment></comment><comment><USER5> this has been my only problem with hn. good links. great discussion. can't get more links w/out going back to the top

</comment><comment><USER6> Ditto here.</comment>


Thousands of unconscious eye movements stop us from going blind - <AUTHOR> http://www.telegraph.co.uk/health/healthnews/4602894/Thousands-of-unconscious-eye-movements-stop-us-from-going-blind.html <comment><USER2> The headline is inaccurate. If you do not have microsaccades you do not "go blind." If you stare at the exact same spot without flinching your eyes adapt the the image projected on the retina and the image fades away until you move your eyes again. Adaptation in vision is completely different from going blind and it is actually a good thing. For example, if something obstructs your vision permanantly your brain learns to ignore it (all of the senses work this way.) Adaptation and microsaccades check and balance each other.

Also, this is old news. I learned this when I was still in school so I don't understand how "new research" has uncovered this.

</comment><comment><USER3> I understand why this is on HN (eyes are cool and one of the best-known complex biological computational systems, though we've got a ways to go), but I'm at a bit of a loss as to why this is news to the Telegraph. I was taught this twelve years ago in Psych 101. Literally, PSY101 at Michigan State, I'm not just using 101 as a metavariable meaning "low level course". What's my point? Whatever root study this was extracted from probably says something _even more_ interesting, or at least more novel, and the reporter must have gotten side tracked by the introductory material.

</comment><comment><USER4> A decent article, but artfully skirting the edge of the linkbait zone: "Going blind" is typically thought of as a permanent thing. Better to have said "going temporarily blind".</comment>


YouTube and WebGL video feedback mashup - <AUTHOR> http://sp0t.org/videoriot

<comment><AUTHOR> note how you can put in your own video, adjust the FX, and then share the result.</comment>


ITP-NYU Thesis Presentation – live streaming - <AUTHOR> http://itp.nyu.edu/thesis/audience.html

<comment><AUTHOR> Watch all thesis presentations from the Interactive Telecommunications Graduate Program at NYU - live streaming. Some great projects</comment>


I am going to start automating my life one email at a time. - <AUTHOR> https://plus.google.com/108259413842523229630/posts/WRNd4zzmMep

<comment><USER2> No suggestions, but I'm interested to hear what you learn in this. I've wanted to do similar, but email broke for me because I can't arbitrarily sort the list. I could tag messages/tasks with P1/P2/etc, but I'd really prefer infinitely-granular sorting. Also, I don't believe all of my email clients support displaying in this tagged sort order. (in my case, I use gmail in browser and android email client).

I'd be happy to adopt a new email client and have all my email forward there, but it would have to continue to support all my standard email needs, like archiving, address book, lists, etc.

I've thought about building a company around this, but it strikes me as a big problem, because you'd need to support all the standard email stuff, and build a bunch of clients, and all that stuff has been done in spades by existing products.</comment>


The Missing Social Technology Sector - <AUTHOR> https://www.drmaciver.com/2019/08/the-missing-social-technology-sector/ <comment><AUTHOR> Archive: [https://web.archive.org/web/20191214182535/https://www.drmac...](https://web.archive.org/web/20191214182535/https://www.drmaciver.com/2019/08/the- missing-social-technology-sector/)</comment>


Reaction-Diffusion reaction simulator - <AUTHOR> https://pmneila.github.io/jsexp/grayscott/ <comment><USER2> Why does the initial drop form a square after a few iterations? Is that real or it's only an artifact of the square lattice of the simulation?</comment>


Politicians weigh renewal of Net access tax ban - <AUTHOR> http://news.com.com/Politicians+weigh+renewal+of+Net+access+tax+ban/2100-1028-6185868.html?part=dht&tag=nl.e703 <comment><USER2> "my own position is we ought to have a temporary moratorium until we finally resolve the issue of how the states are going to support public services with an eroding tax base predicated on the growth of e-commerce."

Stop supporting public services?</comment>


The hidden sexism in CS departments - <AUTHOR> http://www.blogher.com/swept-under-rug-hidden-sexism-cs-departments?page=full

<comment><USER2> This kind of sexism isnt really isolated to CS unfortunately.

If that guy had called the author the _n word, which I'm not sure I can even type without offending someone, the situation would have been handled differently. Interestingly, society will still tolerate derogatory behavior towards certain groups of people, but not others.

Also if that guy were a woman, and the author was a man and the interaction were something like "...I dont like some _dick/asshole/jerk* telling me what to do", then the issue wouldn't be about sexism, it would be about one person being inappropriately hostile toward another.

For the sake of discussion, I wonder if it is more useful to boil some feminist issues down into people issues so that more people can relate and respond.

Instead of addressing it as sexism, I wonder if the author brought it up as generic hostile behavior, would the situation have been handled differently... maybe not?

No one of any stripe or colour should have to deal with that kind of attitude in the workplace, whether or not it is sexist, racist, homophobic, or just generically mean, but managers/supervisors can be conflict adverse, and try to avoid reprimanding people in general. Having to deal with the situation is just more work on their plate.

I wonder these things, because I have my own very likely sexism influenced "situation" at work with my boss. Everyone agrees that he is being a jerk, there is no argument there. I also happen to LOVE to explore and discuss gender issues, but when I bring up this situation or others with that lens, peoples' eyes cloud over.

</comment><comment><USER3> I'm sorry, but please learn to differentiate between a shitty day and overall sexism. When people are angry, they'll strike so that it hits the hardest, it just so happened that it was a woman and the derogatory term against her is 'bitch'. So, please, get over yourself, and report the incident as an incident, not as a case.

Also, tell the kid to grow up, it might help him in life.

<comment><USER4> And the other part of this is the social skills lesson: [many] people do not like being told what to do and may get angry, even if telling them was from your perspective a rational action.

It's no different from how people don't like being told they're wrong, even if they objectively are.

</comment></comment><comment><USER5> I think pressing the issue has to do with if its systemic of the department or an isolated incident at an individual level. If the student has only one complaint against him, I don't know if a reprimand is worthy unless you had multiple parties who felt it was completely out of line. I think making the party aware that how it made you feel is probably the best thing you can do.

Also FYI to the original poster: I'm not sure how private you want the post to be, but just the references to team leaders and fishbowl lets me know you and I went to the same Nike funded school.

I'm not sure how much anonymity matters, but I was able to deduce this rather quickly. I'm long graduated and hold a different degree so I don't know any of the parties but just be wary.

</comment><comment><USER6> You can't have it both ways. If you don't want to be seen as a nag or as 'the next Adria Richards,' don't bring this up with the faculty department head after a single incident. Single incidents are handled between or amongst the people involved, or they are ignored.

Chronic behavior warrants administrative attention, though. The language and behavior described in this article _is_ wrong, and if it happened all the time it would absolutely warrant intervention.

</comment><comment><USER7> Here's the problem:

" _I immediately apologized_ "

Why?

<comment><USER8> That is certainly not 'the' problem, which implies that her apology was the only thing anyone in the story should have done differently.

</comment></comment><comment><USER9> Sexism is if you're Noether in 1915 and you can't get a faculty postion because you're a woman.

Sexism is _not_ if you are being a nag and you get called a bitch as a result. The guy in the story just sounds like a jerk who wasn't taking his TA responsibility seriously.

Finally, even if there _were_ sexism in that one CS departmenT it wouldn't mean that there's hidden sexism in CS departmentS. That's just stupidity and assumption.

Because one female had a problem in one CS department, she implies the same problem exists everywhere from Timbuktu to Helsinki?

<comment><USER10> It was abuse, using a misogynistic word, in a department where there is already a dearth of women due to the hostility they face. Brushing it under the carpet by denying her experience isn't helpful. You don't need to read this story to learn of sexism in CS departments, just ask any woman who does computer science and you can hear plenty of stories.

<comment><USER11> "Bitch" being a misogynistic term is a stretch...

<comment><USER2> Its more about what was communicated/interpreted than the actual words.

Take for instance: "I'm not going to let some _bitch_ tell me what to do" vs. "Hey bitches, whats up?"

the first statement could communicate that the speaker has issues with females telling him what to do. The second statement is playful and affectionate.

However, because the word bitch is so generic and well used, the first speaker could easily only have issues with unpleasant people, not females. Its not clear.

That's why it is better to talk about a person's pattern of behavior, rather than labeling an isolated incident as sexism.</comment></comment></comment></comment>