How to Cold Email Investors [video] - sahin-boydas https://blog.ycombinator.com/how-to-cold-email-investors-michael-seibel/ <comment><USER2> As a VC, I strongly agree with all of these tips except for the one about tracking opens. Like most people, I don't love being tracked.

I especially agree with the first tip about a cold email's goal being to pique enough interest to get a positive reply. The goal is _not_ to convince someone to write a check on the spot by writing a 10-page email -- that's an unattainable goal and no one is going to read a cold email that long.

To use an analogy, a cold email should be like a movie trailer -- or even a movie poster. A movie poster doesn't give you a long summary of a movie, but it gives you enough info to decide if you might be interested. (I wrote a little about this analogy a few years ago: [https://www.codingvc.com/what- movies-can-teach-you-about-pit...](https://www.codingvc.com/what-movies-can- teach-you-about-pitching-to-investors)). A good rule of thumb is to list ~3 bullet points that you think make your company stand out the most. These could be about the team, the product, the traction, or anything else.

It's also good idea to mention your company's stage. Lots of emails don't mention what round they are trying to raise or how far along a company is, and most investors operate in a narrow band. Roughly speaking, pre-seed investors are a fit for <=$1.5m, seed for $1.5m-$4m, and Series A beyond that.

If you send emails from your startup's email address and use LinkedIn, add the email address to your LinkedIn profile so that people can search by it. If your name is not unique and your company name isn't in your LinkedIn profile, people won't be able to look up your background and experience.

Finally, light personalization helps, faux personalization hurts. Light personalization could be a sentence like "It looks like we both went to Dartmouth!" (human connection) or "I saw you invested in companies A and B, which help accountants and lawyers bring their paperwork online. Our company is helping auditors bring their paperwork online." (shows effort/research). Faux personalization is stuff like "I did some research and based on your investment thesis I think you'd be a great fit" (intentionally vague and can be sent to every investor) or "I see you invested in MediaStartupA and SaaSStartupB, so I think you'd really like my RoboticsStartup" (name-drops startups, but the startups are random and completely unrelated).

FWIW most of these tips are not specific to emailing investors, and they can apply to cold emailing anyone.

<comment><USER3> >As a VC,

Have you ever invested - transfer has cleared, they have the money - into a company that cold emailed you?

<comment><USER2> One so far (a company called Pex, the founder's HN handle is doh). Always looking for more. :)

We've also done a decent number of investments through accelerators that were not YC. That's somewhere between cold inbound, cold outbound, and warm intro.

</comment></comment></comment><comment><USER4> a higher chunk of cold email i get don't bother explaining what the company actually does. please don't do this.

when i do see an interesting company, i want to read more immediately. when a deck or something isn't included, it kills that momentum. you don't have to include everything, just give something.

i skip everything that has clicktracking on links. it usually means that it wasn't a targeted email and was sent out by a mailing list.

edit: another thing people do is have a "VP of fundraising" or someone external send the email. this is also a bad look. it should be from a founder or the CEO.

edit edit: i will honestly review your pitch if you email me and reference this thread. generally i don't give negative feedback because i don't think most founders really want it.

<comment><USER5> > generally i don't give negative feedback because i don't think most founders > really want it.

As a founder, I strongly disagree. The feedback I care about most is negative feedback. Negative feedback helps me improve.

If I don't agree with your negative feedback, next time I'll communicate better why. If I agree, that helps me address the flaws in the business sooner. I'll be grateful, not upset. Just like with user/customer interviews.

The legal risks that dissuade employers from giving feedback to job applicants don't apply for investors. If you're trying to keep your options open to invest later, I'd rather return to someone who pointed out a flaw that I then fixed which led to success.

I realize most people in general don't react well to negative feedback, so maybe this is just me, but I imagine there are others out there like me.

" If you can trust yourself when all men doubt you, But make allowance for their doubting too; "

<comment><USER6> There isn't as much of a legal risk, but it's definitely mitigated.

In addition, the feedback they gave is now written. What if the founder lacks social etiquette and tweets "VC Y said my idea sucks because Z [some charged topic]"? If you look at the missed out on investment X/Y/Z emails that VCs sometimes release (anti-portfolios), you'll notice almost aways the releasers asks for permission first. VCs network effects largely need to be polished and appear to be knowledgeable about sectors -- giving feedback to a random startup that might be horribly wrong would hurt that reputation.

It makes sense as to why many VCs don't give feedback.

That being said, the answer is to never ask for direct feedback. Instead, you should have a middleman and backchannel. Ask the middleman to find out why they didn't like X -- this generally works. The middleman is impartial and can be objective (versus the founder who is often defensive) and is able to extract truth.

</comment></comment></comment><comment><USER7> Please don't track opens and don't use the 'confirm receipt' flag. Both of these trigger many spam filters and your mail will possibly not get through.

<comment><USER8> What spam filters do these trigger? I have never seen any evidence of open tracking resulting in spam flags.

<comment><USER9> That's because you count them as part of that overwhelming "never opened" group.

</comment></comment></comment><comment><USER10> Was half expecting this whole article to be "don't"

<comment><USER11> It's always surprising to me how many people in tech need to seek investment. Saving some scratch over a few years of paid employment, then bootstrapping, seems like a seldom-traveled route.

<comment><USER12> > Saving some scratch over a few years of paid employment, then bootstrapping, > seems like a seldom-traveled route.

Probably because most people don't in their wildest dreams have the kind of spare cash left at the end of the month to do something like this.

<comment><USER11> Indeed; I should have been more specific in referring to people already working in the Bay Area technology scene, where salaries are quite high.

<comment><USER13> And cost of living in the Bay Area is quite high to go along with it. Unless you're single with no kids, it's probably not very feasible for most people.

<comment><USER14> Very few people with kids to support should try this no matter where they live. When it just you (a supportive spouse with a day job can be helpful, but supportive is key) the worst case can get pretty bad: you can sleep under your desk in the cheapest roach apartment in town, eating beans for dinner - <AUTHOR> on less than 1000/month for everything (you are taking a risk that you won't need the insurance you are skipping). This allows you to live for a long time on very little cash flow. Your bankers will wonder how you can run a business with so little money in the bank but you will always be on time for your minimal bills. It won't matter that you can't afford activities, because other than your daily 30 minute exercise in the local park you won't have time for any activities (even this is optional, but for your health I recommend it). Hopefully the business takes off after a couple years and you can settle down to a more normal schedule.

Once you have kids to support it gets harder. Not only are there more bills to pay, spending so much time on business means you miss many once in a lifetime opportunities to see the kids as they grow.

<comment><USER15> "Once you have kids to support it gets harder. Not only are there more bills to pay, spending so much time on business means you miss many once in a lifetime opportunities to see the kids as they grow."

The Torah confirms:

"... a man should build a house, plant a vineyard and then marry a wife" (Sotah 44a).

</comment></comment></comment></comment></comment></comment></comment><comment><USER16> But is cold emailing worth it? Most investors claim that they (and most others) never respond to cold emails. It's been said that reaching an investor through their network is a kind of mandatory IQ test.

<comment><USER17> I've mailed VCs as a first-time founder and got a response or follow-up meeting.

<comment><USER18> In what year though? I feel like a lot of VC's have adopted this trend of forcing you to befriend random people they have funded before, to introduce you in. Not because it is actually a good method, but because they saw a few popular VCs were doing it and jumped onboard.

</comment></comment></comment><comment><USER19> Almost as bad as not telling what the product/service is, is explaining it in very generic terms. "We provide life as a service" or "Integrate across multiple platforms" or something.

And, don't defend yourself if someone points it out! (Food is life as a service, get it? That's what food is!)

</comment><comment><USER20> From the outline I miss: Stroke their feathers.

I have quite a few interesting discussions with people in academia whom I've never met before but work in something I'm interested in at that point in time. Quickly explaining what you've read and why (hint: their articles!) I feel helps in moving from "homework"-question to might be interesting. I always figure that most professors mainly meet people in their circle and not a lot of people outside, so in the basis are happy to explain something to someone that comes across as authentically interested.

</comment><comment><USER21> One way to think about this is the "barbell strategy" due to Nassim Taleb. Make emails incisive and direct; decks should be contextual and comprehensive.

</comment><comment><USER22> I built a machine which is now being prototype-tested by a government in Europe (law enforcement). How do you go about raising cash to build more machines and reach out to more governments in other countries?

<comment><USER23> Get in on one of the many EU startup programs. There are some people who specialize on filling up the papers exactly as the bureaucracy wants it. I don't think the money comes with any strings attached (other than having to show you spent it on what you said you were going to spend it on), but do your own research.

</comment></comment><comment><USER24> How do you determine market size? It seems like it's an inflated best guess for a relatively unique product.

</comment><comment><USER25> Good advice, but one question. Is there a list or consistent way to reach out to various investors easily?

</comment><comment><USER26> a _video_ about how to do email? what's next, an audio lesson on how to send a fax?

what's worse than no docs? video docs.

</comment><comment><USER27> Something I wrote about how to approach investors. Not looking to promote the place it is at. Anyway...

1\. Build bridges with investors before you may need to cross them, ie. Don't go to them when you need the money. There are a multitude of angles to use, but each angle has to come from a core place of self-less and selfish interest. Know what they want and need, know what you want and need. Each angle will also dictate how early you can / should get on their radar.

2\. If you are introducing your startup to them, then around 6 months. If your angle is to aid startups in their portfolio, introduce startups to them (filter them, don't send them any and all), or introduce family offices looking to put funds into a pool; then you can contact them a lot earlier.

3\. There is another way that you can connect with investors, "get an intro to us via someone in our network". With some investors this will be the only way.

4\. Note the investor landscape, find out their investment thesis. See if their portfolio has any that could be competitors, any synergies, etc.

5\. Find out the required milestones (for your current stage and the next one). This can be a difficult one to find out, for it can pin some of them down a bit too much, especially when they take so many other things into consideration. If they don't mention it on their site, and there is nothing in Crunchbase et al, you'll have to ask them down the line.

6\. Find out more about the appropriate partner at the VC firm whom is involved in your niche. If you can't find the appropriate partner, aim for the top, and have them point you in the right direction.

7\. Acquire information about the partner and use it to formulate an email that is about them. I will typically provide a few of my thoughts on something they said in an article. They will be genuine thoughts. No brown-nosing, no compliments for the sake of it, etc, etc.

8\. Find out the firms current position in the fund life-cycle: are they open to new investments, only open to portfolio synergies, only follow-on funds left, etc.

9\. If the investor's portfolio has competitors and/or synergies find out where they stand on this. Some will be open to funding competitors, some won't. If so, find out how things are kept ethical and above board.

10\. Find out what their investment approval process is; stages, duration, etc.

11\. Ask them for their due diligence (DD) checklist, and work on that organically. Until then, use this one: [https://seraf- investor.com/compass/article/seraf-toolbox-due...](https://seraf- investor.com/compass/article/seraf-toolbox-due-diligence-checklist)

12\. DD goes both ways, so find out what you can about them, what they are like after investment.

13\. Prepare a presentation deck, not a pitch deck, and present it to your team. Let your team know beforehand, and to attempt to trap and flummox you as you walk them through it.

14\. Update the deck and send it to a few of the investors, and use them as data points. The reason it's not a pitch deck is because the deck should explicitly state that you're not looking for funding at this moment in time.

15\. Send it to ones you either have good relations with, and ones that do not fund in your geographical area. There are some gems out there who will go out of their way to aid you and to give you feedback. Granted they may not know the launch country market, but they will know the startup niche. Basically work your way inwards to the set of investors you are targeting, using the feedback to hone and refine startup / deck.

16\. If you don't want to slice by geography, or want to start closer to home, slice the investors into tiers. Can be based on many things, niche relevancy, track record, connections, dumb or smart money, etc. Work your inwards from the ones you least want.

17\. Once you get to the set of investors you are interested in, same thing, not looking for funding yet. If it's a decent startup / deck you could be asked to come in for a chat, or to keep them updated as to your progress.

18\. If you are going to go down the path of external funding, then investor pre-validation is vital.

19\. Keep them informed as to your progress, monthly update is fine. Keep it short and to the point. Be brutally honest, so good and bad, hits and misses.

20\. Even if your angle of approach is for your own startup, keep an eye out for any startups that you think they would be interested in. Same thing with investors and family offices, some of them go solo (or dedicated fund manager), some want to put their funds into a pool.

21\. When you are ready, send the pitch deck.

One last thing, no one ever got funded off a pitch deck. Napkin maybe. but not a deck. It's a foot in the door at best. Besides, founder(s) of an early stage startup, they're investing in you.

</comment><comment><USER28> Serious q: What's the best way to track opens?

<comment><USER29> Praying to beelzebub that the reader has "download images" enabled in their email client.

</comment></comment><comment><USER30> I'm sorry, based on my personal experience I consider this bad advice. Investors don't cut checks to companies that cold email them. It's a waste of time.

If you are really committed to doing this, there is one way you can do this. Concurrently and genuinely make a company2 and try to raise money for it. Send cold emails only for company2. It doesn't matter how great company2's business plan is, of course. You'll never raise money for it this way. On the last slide list other companies with similar initial growth propositions, the logo and name are enough: Facebook, Uber, Company1 etc.

While the investor will throw your pitch deck in the trash, regardless of how great it is, as they do so they'll probably get out their checkbook for Company1 without even talking to them. (Based on your last slide.)

Investors behave a bit like sheep, I'm afraid.

At any rate: don't cold email them but if you must this is the only way I would ever go about it.

</comment><comment><USER31> Don't forget the importance of negging.

<comment><USER32> What do you mean?

<comment><USER33> OP is probably referring to a conversational technique where one person tries to gain rapport with another by (sometimes slightly) insulting them. It's more common in the hookup scene, "pickup artist" scene, etc, FWIW.

I'm not aware of its usage in VC pitching, but does not sound like a good idea.

<comment><USER34> It's a reference to this scene from Silicon Valley:

[https://youtu.be/N6Zz-Nkkaxc](https://youtu.be/N6Zz-Nkkaxc)

<comment><USER32> Ah got it. I had forgotten about this. What about bsack slamming? Does it work these days?

</comment></comment></comment></comment></comment><comment><USER35> What percent of tech investors enable "Display Remote Images" for their email?

Being frank on the subject, I'd look down on anyone who claims to be knowledgeable about technology yet enables remote images, i.e. open tracking.

<comment><USER36> Why is that? I f you work at a company where you are constantly emailed screenshots, even if you are aware that image tracking is not in your best interest are you going to bother with this inconvenience?

Constantly switching email format modes is super annoying to clients and everyone you work with.

<comment><USER35> > Why is that? I f you work at a company where you are constantly emailed > screenshots, even if you are aware that image tracking is not in your best > interest are you going to bother with this inconvenience?

Email includes the ability to incorporate attachments[1] including images that are displayed inline. Those show up just fine. This is specifically in regards to _remote_ images.

Having the images in the actual email also has the advantage of keeping a record of the assets associated with the conversation. As opposed to having them disappear from the remote location at some arbitrary point in the future.

[1]: [https://en.wikipedia.org/wiki/MIME_attachment](https://en.wikipedia.org/wiki/MIME_attachment)</comment></comment></comment>


I want you to give up programming - <AUTHOR> http://engineering.thetrainline.com/2015/07/07/i-want-you-to-give-up-programming/

<comment> vezzy-fnord The ambiguous revulsion of object orientation is the hallmark of the inexperienced functional programmer.

<comment><USER2> Or the bitter experience of an old, cynical, object oriented programmer.

<comment> vezzy-fnord I think that reflects the prime error, though. It's the false equivocation between objects as PL constructs and objects as software architecture.

</comment></comment></comment><comment><USER3> "Look at your IDE. Look at the menus and buttons and hierarchical whatchamacallits and text-filled panes."

I use emacs. Without menu and buttons etc. Guess it's not talking about me.

"hands up anyone who wouldn't claim to be an expert in object-orientation!"

 _raises hand_. Yes, not talking about me.

"So, I'm asking you to give up programming – or at least everything you have learned about programming and believe is true. I want you to give functions a go."

That's a bit of a typo - functions are also part of imperative languages. Fortran has functions but is not a functional language.

<comment> vezzy-fnord Author's obviously talking about pure functions, not procedures or subroutines.

</comment></comment><comment><USER4> First mistake of functional programmers approaching oo: thinking it's about the objects.

It's mostly about decomposition and message passing. If one fixates on mapping reality on objects they are in for a bag of hurt.

And what's message passing if not functions? But that doesn't make it functional programming. The method of decomposing problems and composing code to build solutions is the key.</comment>


The way I work, Matt Mullenweg, annotated - <AUTHOR> http://ma.tt/2009/06/the-way-i-work-annotated/

<comment><USER2> FYI, this is a rewrite of an Inc. magazine article we discussed here: <http://news.ycombinator.com/item?id=652412>

</comment><comment><USER3> Listening to a song on repeat all day drives my wife nuts. It's just how I roll. Roll on, Matt.</comment>


How do we end the divisive mindset? - <AUTHOR> Society today is wrought with divisiveness. It's shown in the rhetoric that the media uses, and is ever present in our own thoughts and conversation. Even applications such as Facebook cater to this divisiveness with their content bubbles, supporting our confirmation bias and failing to properly educate us in critical thinking and analysis. I want to know what the community at HN thinks we can do to help end the divisive rhetoric and "information combat" that is occurring. <comment><USER2> Throw your smartphone in a lake, quit social media, stop reading the news, move to a mixed-race neighborhood and then join a bowling league.

You might only just need to go outside and walk around talking to people about their interests.

The world is a wonderful place when you're not being frightened and primed to make unnecessary consumer purchase s.

Absolutely stop thinking there is some technical solution to these problems.

</comment><comment><USER3> Great question. Here's what I think...

It's a lot easier on the personal level than at the societal level.

The big hurdle for society to leap over is the profit to made off of promoting division by reinforcing people's fears. The leaches that sell fear based hate and political division have a constitutional right to spew and there's not a lot we can do to change that, nor should we try.

We can, however, influence people's desire to seek it out by using targeted media campaigns to counter the divisive messages they produce with those that invite cooperation.

The hurdle to do that effectively is the cost of the effort. "We" don't own a big media outlet, or have the budget to produce quality content and distribute it. To be fair, this is being done to the extent it can be with current resources available to those who are working on it, but not in a focused way. There are media sources that do work on producing unbiased content but not really unity by looking for and exposing common ground.

Since before the elections last year, on a personal level, when I have interacted with either "Liberals" or "Conservatives" I have purposely tried to find and expose common ground and there's actually a lot there.

As an example, when I talked to Trump voters about "the wall" it was easy to find common ground by pointing out the expense and ineffectiveness of a wall in comparison to enforcing existing regulations and reducing incentives for illegal immigration, and for making legal immigration easier for seasonal and temporary workers, which all my "liberal" friends would support.

When I pointed out that "Big Corporations" have an obligation to help maintain and improve the communities they sell their products in they agree with that. We all agreed that government waste is out of control and needs to be reeled in.

So, there is common ground and a lot of it, but no money and little effort is being spent on cultivating it.

<comment><AUTHOR> Thank you for the response. I do agree that money is a large component to this situation. I also do think some people actively discuss the existence of this divisiveness. So then, is the problem a lack of discussion around methodology and how to implement solutions? You mentioned that the effort is the largest cost in deploying positive solutions. Specifically, those solutions would be used to educate individuals on what divisiveness looks like and how to combat it. How to recognise bias.

I do think you are right, and that we need more resources supporting the efforts to bring us together instead of pulling us apart.

</comment></comment><comment><USER4> Is it any different from how it was before? Perhaps the same diversity of opinion was always there, but some people simply didn't have a voice -- and now they do.

I don't know if I even believe this hypothesis, but I haven't seen any systematic study to prove/disprove it. Simply many assertions that people are more divisive.

<comment><AUTHOR> Thank you for the response. My original post wasn't meant to specify that the climate is /more/ divisive, but to ask the community what kind of ideas we can implement to make the community /less/ divisive.

Also, a friend recently sent me this article which might support the idea that climate has indeed become more divisive, even if this wasn't my original post's reasoning.[1]

1\. [http://www.nbcnews.com/politics/elections/how-big-data- broke...](http://www.nbcnews.com/politics/elections/how-big-data-broke- american-politics-n732901)

</comment></comment><comment><USER5> I'm not sure, but within the context of social media, I think fewer memes and more actual conversations would help.

</comment><comment><USER6> I think the question really is: can the tech community come up with do-able ideas that can a) reach the population at large, b) use crowdsourcing and artificial intelligence to identify and tag/mark fake news and unfounded opinions c) possibly use blockchain for tagging/marking crowd-classified news....So that fake news, divisive propaganda, trolling, etc. are quickly identified and indelibly marked as such....This will not entirely solve the problem (artificial intelligence is no match for natural stupidity), but it should contribute towards reducing its effects

</comment><comment><USER7> Censorship. I know this doesn't fit with the techno libertarian mindset, but I think it's a viable solution.

Let's say I'm about to share an article that claims the holocaust never happened. (This might be illegal in certain places, but let's say it's legal in your country). The platform could warn me that this is not factually accurate. It could flag my post for others as not accurate. Or it could prohibit the share.

</comment><comment><USER8> By spreading truth and facts. The anti Trump media and anti media Trump are destroying the core fabric of news consumption in this country and that's what's causing the divisiveness and hatred.

Stop hatred. Spread the facts. Learn the facts.

<comment><USER9> What is the truth anymore? Who do you trust to provide the truth?

<comment><USER8> Truth = Unquestionable facts. Independent organizations like fact check.org.</comment></comment></comment>


It's Time to Move Beyond the RSS Reader - <AUTHOR> https://medium.com/i-m-h-o/e8d643c44f2

<comment><USER2> If you find that it feels like work to go through your RSS feeds, then you're doing it wrong. Plain and simple. Your whole argument for why RSS readers are bad seems to consist of "I have too many feeds", and "I have a lot of other programs open at the same time."

I have around 40 feeds right now, and I look forward to updates because I'm subscribed to a lot of interesting content without a whole bunch of filler. But here's the thing: even if I don't have time to read everything, I just click "mark all as read." That's why that button exists. The world doesn't end when I click it. It's not like e-mail where I have to read through everything to make sure I don't need to reply to someone. I continue on with my day and await future updates.

The whole argument about an "app-centric world" and having so many things open at once is completely irrelevant because it rests on the faulty assumption that RSS readers are demanding of users. They're not, if you're using them efficiently. And even if they were, I have a really hard time believing that having 30+ tabs and 10+ programs open at once is "not atypical". Maybe for the extremely heavy web users, but not for the average person.

If you insist on being subscribed to a ton of RSS feeds and only want the best posts, then perhaps you'd like Digg Reader. I haven't explored it too much, but they display a little dot beside the most popular items (as determined by social media). I'm pretty sure NewsBlur also tries to figure out which content you're the most interested in, but I haven't tried it out either.</comment>


Armageddon Computer? - <AUTHOR> What is your favorite iso for an offline computer, if the Internet goes out? Maybe something with an encyclopedia, offline maps, photos? <comment><USER2> Depends on what you want out of a computer. If you want a general purpose (as in write programs and run them) Plan 9 is a pretty self-contained operating system and software system if you are confident in your C and C++ abilities. I've also heard that BSD is pretty well documented internally, so if you know that system, you should be ok.

Alternatively a fun retro setup could be an apple II or a windows 98 box with Encarta disks.

As a specific distro that is directly focused on what you specified, Endless OS seems to have the Encyclopedia and other preinstalled apps for online use you were talking about.

<comment><USER3> Which leads to another interesting take on the situation. Which OS would make a good starter to rebuild from? It should be small, easy to build, and cover just core features including network. Even single-user, single process like Windows 98 as suggested could work, although we'd want much newer source without cruft. The GUI also seems superfluous--maybe just high density text panes.</comment></comment>


How close are we to developing a vaccine for COVID-19? - <AUTHOR> https://www.theguardian.com/world/ng-interactive/2020/jul/20/coronavirus-vaccine-tracker-how-close-are-we-to-a-vaccine <comment><USER2> Article misses that a small Russian elite has already been given a vaccine (folded into a study, back in April) and that China has approved their vaccine for immediate use by their entire army (PLA.)</comment>


Pyke - a knowledge-based inference engine (expert system) written in 100% python  - <AUTHOR> http://pyke.sourceforge.net/ <comment><USER2> If only this had existed when I was doing my senior thesis... and if only I had known Python then...

I can't wait to play with this.</comment>


Princeton's Marriage Market Theory Worked for Me - <AUTHOR> http://www.bloomberg.com/news/2013-04-03/princeton-s-marriage-market-theory-worked-for-me.html

<comment><USER2> "Optimal portfolio theory, applied to marital choice, suggests that better diversification can push households closer to the risk-return frontier."

This is a call for bigamy? But with bigamy we tend to be short on women, that is, long on men, so that his call is for more wars, with only men soldiers, to kill off the excess men? While he is a Harvard prof and, thus, no doubt with a Ph.D., he concentrates on undergraduates marrying each other. But what about an undergraduate woman marrying a graduate student or young professor (who cares about money) man? Or a man recently graduated they meet at, say, some Princeton social function, who has a successful startup? So, he neglects graduate students and profs because he doesn't like them? And he assumes that a Princeton woman would look only for Princeton men and, thus, omits Columbia, Courant, Yale, Cornell, Brown, MIT, and Harvard? He really believes that only a Princeton man is good enough for a Princeton woman? After all, he's a Harvard prof!</comment>


A letter to the Editorial Board, Journal of Algorithms (2003) [pdf] - <AUTHOR> http://www-cs-faculty.stanford.edu/~uno/joalet.pdf <comment><USER2> For those who didn't read, allow me to briefly summarize the contents of this letter:

\</comment><comment></comment><comment>--

This is a letter written by Knuth to the board members of the Journal of Algorithms. This journal means something special to Knuth, as he was one of the creators of the journal in 1979.

In this letter, Knuth describes the evolution of the journal. It used to cost about 30 cents per page in the 80s, but costs began to skyrocket in the 90s. The costs really began to skyrocket when Elsevier became the publisher.

Knuth argues that in the 80s, it was publishers who were responsible for all the typing, editing, and formatting --- things which were quite hard. But now (after Knuth made and proliferated TeX, which became still easier with LaTeX) authors and software do much of this work. So Knuth argues that costs should have gone down, not up.

The remaining several pages involve Knuth inviting the editorial board to consider the future of the journal. He paints four broad options:

1\. Should they stay with Elsevier? 2\. Should they switch publishers? 3\. Should they go towards a SIAM model? 4\. Or should they do something like the arXiv or PLoS and become pure open access, perhaps through finding some university (or universities) to host them?

\</comment><comment></comment><comment>-

I'll also note what ended up happening.

The entire board resigned shortly afterwards, as they could not come to an agreement with Elsevier. Then Knuth (and other editors from the Journal of Algorithms) started the ACM Transactions in Algorithms shortly after.

The Journal of Algorithms (now under Elsevier but without Knuth) stopped being published a few years later, in 2010.

Some other editorial boards resigned from Elsevier as well --- with varying levels of impact.

<comment><USER3> Thanks!

Naturally I was curious about the big looming question "ok, so what is the cost/page for the new ACM TALG, then"? I surfed the journal's pages (at [http://talg.acm.org/index.cfm](http://talg.acm.org/index.cfm)) for a while but was unable to come up with an answer.

A subcription to just the journal is $360, I assume that's yearly. But the number of issues per year seems to vary, and I failed completely to figure out the page count for a typical issue. I hope it's cheaper than before! :)

Also, I _love_ that the journal has submission rules that limit authors to max one paper regarding P != NP per 24 months:

 _No author may submit more than one paper to J. ACM, ACM Trans. on Algorithms, ACM Trans. on Computation Theory, or SIAM J. on Computing in any 24 month period, purporting to resolve the P versus NP question or related long-standing questions in complexity theory, except by invitation of the Editor-in-Chief._

I wonder if such limitations are needed/common in other fields, or if it's more of an in-joke. Also, there's a typo in Knuth's address on the Editors page. :)

<comment><USER4> Access to the whole ACM digital library is $99 if you are an ACM member (which costs another $99 yearly,) so it is really $360 only if you want the printed version.

</comment></comment></comment><comment><USER5> Aftermath: [http://www.cs.colorado.edu/~hal/s.pdf](http://www.cs.colorado.edu/~hal/s.pdf)

See also [https://en.wikipedia.org/wiki/Elsevier#Resignation_of_editor...](https://en.wikipedia.org/wiki/Elsevier#Resignation_of_editorial_boards)

</comment><comment><USER6> This year, I decided to pony up for ACM lifetime dues with digital library access. That's $3960, or 20 years worth of dues at this year's rate. I think that's a fair cost for a professional in industry.

IEEE, on the other hand, is an annoyance. Annual dues are $198 this year too, which essentially gets you a print subscription to Spectrum magazine (free online; bloated with ads) and Google-hosted e-mail account (no ads; internally spammed by IEEE), but that's effectively it. With a basic 3 papers/mo digital subscription (which should be included at no additional cost as part of annual dues IMHO), that'll set me back $425.40 this year alone...over 2x ACM annual dues for a tease of relevant content. Despite having spent the past few years wait until the end of January to internally deliberate whether I should stay legit and renew or seek alternative means, I nevertheless end up paying the piper for another year.

For all intents and purposes, Elsevier can suck it. About 2 years ago, a few of their business development guys came to my division to pitch a new service. There's only one other guy (PhD candidate at the time) in my division who follows the literature, but he wasn't there for the pitch. That gave me free reign to take up the entire Q&A session pointing out broken or deficient aspects and subtly jab at the irrelevance of their product to our mission. In the end, the bosses didn't bite on the product...they would have taken us to the cleaners otherwise.

</comment><comment><USER7> academic journals are such a scam... the absolute worst place to have a for- profit business model.

rip aaron swartz.

<comment><USER8> Indeed.

That's a relatively recent development, however. Not that long ago, they were virtually not-for-profit firms. Then they got acquired. And restructured to maximize profit.

</comment></comment><comment><USER9> One thing is not knowing how to be brief, as he says, and another one is not wanting to reach the point. What's the TL;DR?

<comment><USER10> In essence: the publisher (Elsevier) is charging too much for doing too little. As the editorial board, please informally vote on what to do (change to a University publisher, change to ACM publishing, change to a University press publisher, change for-profit publishers, do nothing and keep Elsevier).

</comment></comment><comment><USER11> Elsevier sounds like the Martin Shkreli of academic publishing. All class.

[https://en.wikipedia.org/wiki/Martin_Shkreli](https://en.wikipedia.org/wiki/Martin_Shkreli)</comment>


Ask HN: do users like OpenID? what's the current consensus? - <AUTHOR>

What the title says. I personally don't use OpenID much, as I find it not substantially more convenient than using a password manager. But what's the current consensus. Have operators of web businesses found that users like it, dislike it, or are neutral about it?<p>Just wondering if I should bother with it for my new thingy. <comment><USER2> I like the concept of not requiring a site-specific login and password for every site. But I don't feel that OpenID succeeds at this. As a user, I find few sites that support OpenID and most of those don't work with my OpenID. Login with twitter or login with Google seem popular but tie one in too tightly to a single provider. Mozilla persona (<https://login.persona.org/>) seems really promising to me but it is too new to have any good data.

</comment><comment><USER3> Based upon current users signing up with us - 90% choose OpenID or OpenAuth over a site specific sign-up. I use it myself for my own site.

<comment><USER4> That is really interesting. I was looking at doing OpenID for a project I'm working on, but figured it was a bit dead in the water and didn't have a large enough user base to make a dent. Your data point is making me take a second look.

Did you have an increase in total # of signups after you added OpenID as a sign up option?

</comment></comment><comment><AUTHOR> Poll: UPMOD THIS if "YES"

</comment><comment><AUTHOR> Poll: UPMOD THIS if "NO"</comment>


How shortsighted neighborhood activism fuels SF's housing crisis (1999) - <AUTHOR> https://web.archive.org/web/20001001083046/http://www.sfweekly.com/issues/1999-08-18/feature.html/printable_page <comment><USER2> In the similar city ( to SF ) Vancouver, Canada, pro development policies have allowed developers to build tons of very tall housing developments.

Guess what, housing costs in Vancouver are almost as ridiculous as in San Francisco.

I'm not sure what the answer is anymore, besides revolution!

<comment><USER3> It really depends on how your country treats housing. Is it a consumable good or an investable asset? If your country conflates the role of housing as shelter with it being a primary store of wealth, then demand doesn't just reflect demand for housing. It reflects demand for a safe, appreciable asset in a ZIRP world, which is what urban housing becomes because cities will never be able to physically scale their infrastructure or capacity as rapidly as capital can move through their property values.

Not only has Vancouver built a lot, it simultaneously cultivated immigration programs to bring external capital into the local housing market. [http://www.tandfonline.com/doi/abs/10.1080/14616718.2015.111...](http://www.tandfonline.com/doi/abs/10.1080/14616718.2015.1119776)

Other countries, like Japan & Germany, treat housing as a consumable good or even something that depreciates. So even though Tokyo is one of the most developed cities in the world, housing actually goes down in value. [http://freakonomics.com/2014/02/26/why-are-japanese-homes- di...](http://freakonomics.com/2014/02/26/why-are-japanese-homes-disposable- full-transcript/)

<comment><USER4> > _Other countries, like Japan & Germany, treat housing as a consumable good > or even something that depreciates._

Vancouver isn't a country. The country is Canada, and Canada has places where your real estate will depreciate, like somewhere in the middle of Saskatchewan. How properties value over time is determined by the market conditions. Neither Canada, nor Germany nor Japan are communist states which flat-out dictate your property value.

The values of the _buildings_ on a property themselves depreciate as they age, everywhere in the world. Nobody will pay as much for a run-down place that needs demolition as for a newly built or renovated, "move in condition" place. That doesn't matter so much if the property is valued 10:1 or more over the structures on it.

Tokyo is an ambiguous term because it simultaneously refers to a metropolitan area in which some 37 million people live, which spreads far beyond the city, and the property market prices and dynamics differ.

Japan as a whole went through general _deflation_ through the 1990's and early 2000's and it may be returning. Its population has also been shrinking.

</comment></comment></comment><comment><USER5> This is crazy, I feel like this could have been written in 2015.

<comment><USER6> Except for the prices. :-)</comment></comment>


Ask HN: Should new grad go to startup or big company? - <AUTHOR> I will be graduating next semester. This would be the job hunting season. Just wondering if any of you have suggestions. Should I head into the startups or big company? Thanks! <comment><USER2> Some recent discussion on the subject

[https://news.ycombinator.com/item?id=18245418](https://news.ycombinator.com/item?id=18245418)

</comment><comment><USER3> Big company. Stable paycheck will change your life for the better.

Once you have a nest egg of 100k USD or so, you can weather pretty much any storm and can accept riskier employment.</comment>


Mitch Kapor's new project: Handsfree 3D (Control Second Life avatar without mouse or keyboard) - <AUTHOR> http://www.handsfree3d.com/

<comment><USER2> This is great. Lack of a good interface for immersive worlds is one of their biggest problems IMO.

<comment><USER3> I second its greatness but the name is all wrong!

It's not only _not_ hands-free, you also now have to use your arms, legs, jump in place, lean, twist...

I didn't watch the whole thing because I don't want to know how they handle sex... _shudder_

[http://www.secondlifeherald.com/slh/2007/09/afternoon- delig....](http://www.secondlifeherald.com/slh/2007/09/afternoon-delig.html)</comment></comment>


The Book of Shaders: Noise (2015) - <AUTHOR> https://thebookofshaders.com/11/ <comment><USER2> The Book of Shaders is so good. It's a shame it's abandoned, I would love to read the rest.</comment>


Show HN: Automatically find companies from your CSV list on Product Hunt - <AUTHOR> https://github.com/kvap/search-product-hunt <comment><USER2> Are you sure you want to publicly share `api_key` and `api_id`?</comment>


A python script to download lectures from Coursera.org - <AUTHOR> https://github.com/LoganDing/Coursera.org-Downloader Help you to download lectures (videos and slides) from Coursera.org, a free online education website which provides free Stanford, UCB, and UM courses. <comment><AUTHOR> Anyone enrolled coursera's course, please feed back.</comment>


Memory and C++ Debugging at Electronic Arts [video] - <AUTHOR> https://www.youtube.com/watch?v=8KIvWJUYbDA <comment><USER2> They say they can't pass parameters to delete so they had to use a macro instead to be able to pick the right allocator. But why not just store the pointer to the allocator along with the block and then have operator delete call the allocator? Is it just because they don't want to store an extra pointer with each block?

<comment><USER3> It's kinda an implicit rule in game development that you don't do at runtime what you can do at compile time.

</comment></comment><comment><USER4> Having the privilege of worked nearby Scott Wardle before, I can say he's an incredibly approachable and helpful guy. It's exciting to see him on the front page of Hacker News. Go Scott!

</comment><comment><USER5> OK. Maybe I just don't understand game development very well, but I don't get why some of the problems they had in the post-MMU era even existed.

1) Memory Fragmentation - why? This seems like it would only be a problem if they ran their entire game in the same virtual address space.

2) Subsystem A corrupting Subsystem B's RAM - once again, wouldn't one run the sim code in one address space, the rendering in another, etc. and have strategically shared pages for them to transfer data back and forth?

It really seems to me like the idea is 'yeah, we had virtual memory, and it was great, but we didn't really use it'... Granted, they put guard pages on some allocations, but that's akin to using supercomputer to solve your family budget. Lots of power available, but using it in a trivial way.

I acknowledge that there's some cost to a context switch, and that the 2005 generation used PowerPC with its fairly cache-inefficient hashed pagetable (poor locality), but the benefits of having a hard wall in memory between major system functions is immeasurable (I'm guessing that on PPC, they just set up a few Block Address Translation registers and called it 'good enough').

Then again, I come from a safety critical background .. we make aerospace code, so it's developed using the methods described in the article about 'the right stuff' that was up a day or two ago. We're really fond of having really hard walls between every resource we can (memory, CPU time, I/O bandwidth, FS bandwidth ... you name it) for major system functions. I realize that in game programming most of those walls aren't practical (due to performance impact) or necessary, but the memory one is fairly cheap and incredibly helpful.

PS - if you're wondering, we prevent memory leak problems by just disabling dynamic allocation post-boot, which happens on the ground. Our stack utilization is also required to be statically analyzable, which means that you can't do things like recursion. These limitations make the design of some algorithms extremely painful, but what other software have you ever heard of that can truthfully claim 0 memory leaks, guaranteed. We also do 100% code coverage (at the machine language level), 100% decision coverage, static and dynamic worst-case timing analysis, etc. etc. etc. Look up 'DO-178B' or 'DO-178C' if you're curious about what's done and why safety critical stuff is insanely expensive. More recently we're throwing in fuzzing for good measure, but fuzzing doesn't turn up a whole lot in extremely thoroughly tested code that's been reviewed line-by-line by dozens of engineers (and is subject to strict design limitations).

<comment><USER6> Here is all you need to know to understand game development. It's just two things.

Firstly, on a home console there are just two playable frame rates: 30 fps and 60 fps. This means you can only have frames either less than ~16.6 ms or ~33.3ms long. The next step is 20 fps and if you were even allowed to ship a game like that it would not make any money so you would likely get fired anyway.

You will do very unsafe things to stuff as much as possible into a game's frame because your competition is already doing it and your designers demand it. There is only one thing you could possibly sacrifice a little bit of performance for - development time.

Thus there is this second thing: a game has to ship before you run out of money. The most common production time is about 18-24 months. This is for millions LOCs of source code and terabytes of source assets (textures, models, video, sound etc) written, often from scratch, and tested.

How long does it take to ship software for a new plane in your business? I'd be terrified to even approach a plane that had shipped in 1.5 years, least fly in it.

<comment><USER7> >>Firstly, on a home console there are just two playable frame rates: 30 fps and 60 fps.

This is probably very basic but I am going to ask anyway: why are 40fps, 45fps or 47fps not possible?

<comment><USER8> Because your monitor is (probably) refreshing at 60hz. Your frames will display for some integer number of monitor refreshes - at 1 you'll get 60fps, at 2 you'll get 30fps.

Over a second, it's of course entirely possible to get something in-between, where some frames are displayed for 1 refresh, and others for 2 refreshes. Inconsistently waffling between these is going to be more jarring than sticking to one.

Recently, you have things like nVidia's... gsync? Which make the monitor refresh rate variable with compatible monitors, to match the game framerate, making 45fps entirely possible, and reducing the jarring from varying frame lengths. But this recent, rare, and likely PC and/or GPU vendor specific still.

</comment></comment></comment></comment><comment><USER9> I imagine game developers are the few people left using C++. Does this come down to not being able to get around pauses in garbage collection?

I wrote a little C++ in iOS a few years ago when I thought I might try to share some code with Android. Unfortunately, Objective C++ was slow to compile. I think the biggest problem with C++ is that it's simply harder to get correct code:

[http://www.gamasutra.com/view/news/128836/InDepth_Static_Cod...](http://www.gamasutra.com/view/news/128836/InDepth_Static_Code_Analysis.php)

[Update]

Sure, there's a lot of code that was started 15-20 years ago that was written in C++ because it was the best thing at the time. Java's JIT has greatly improved. I'm sure C# is also great. Large apps like Hadoop are written in Java. IBM's Watson is mostly Java.

[http://www.drdobbs.com/jvm/ibms-watson-written-mostly-in- jav...](http://www.drdobbs.com/jvm/ibms-watson-written-mostly-in- java/229300226)

Why does C++ offer advantages over C# on Windows, for instance? In 2015, starting from scratch, where is C++ needed?

Please consider that I was using C++ when it was cfront. I seem to be getting a lot of "how naive" from people who've probably never used C++. Yes, there are dozens of desktop apps in C++, especially legacy, but there are millions of apps, mobiles apps, and web apps that are in other languages.

<comment><USER10> Too bad nobody directly addressed your question as to whether it had anything to do with pauses which would be unbearable on the gamer's experience.

Perhaps the question is still open whether properly managing allocation, using object pools as well as other strategies would enable writing triple A games with a managed language.

Or perhaps all we need is a GC race (à la JS engine race we've seen in the major browser) which Google might very well be starting with the recent efforts on the Go garbage collector.

<comment><USER3> It's not that you couldn't write a triple A game with a managed language.

It's that you can _quite easily_ write a triple A game _without_ using a managed language.

For games, managing memory is not a big problem. For other kinds of apps, it can be. In some apps the lifetime of an object is not well defined. But in games, it tends to be very well defined.

If you want a good explanation of the problems game developers face when trying to use GC, go read Rich Geldreich's post on it ([http://richg42.blogspot.com/2015/05/lessons-learned-while- fi...](http://richg42.blogspot.com/2015/05/lessons-learned-while-fixing- memory.html)).

<comment><USER11> There some AA or AAA games using languages that not are C/C++ . Severence: Blade of Darkness (Aka Blade: The edge of darkness), have a lot of code on pure Python. And it's well know that Naughty Dog use a variant of Lisp on his games.

<comment><USER3> I'm sure there are - that's not what I said.

Also, Naughty Dog's games do _not_ use Lisp, they use a custom language that _looks_ a little like Lisp, but has no garbage collector.

<comment><USER12> Naughty dog used to use Game Oriented Assembly Lisp (GOAL), which was very scheme like. They dropped it for C++. Although they still use a Racket dialect for some gameplay scripting.</comment></comment></comment></comment></comment></comment>


Making Connections to Facebook More Secure - <AUTHOR> https://www.facebook.com/notes/protect-the-graph/making-connections-to-facebook-more-secure/1526085754298237 <comment> mike-cardwell It concerns me that they were able to brute force a key for facebookcorewwwi.onion. If they can do that, what's to stop somebody else coming along and brute forcing a key for the same hostname.

Looks like Tor hidden services are now broken to me...

[edit] What's to stop Facebook from brute forcing a key for any of the existing hidden services?

[edit2] If Facebook can brute force keys like this, so can the NSA and GCHQ. Tor hidden services are officially broken.

[edit3] A colleague of mine suggested that this might be simply Facebooks way of making it public knowledge that Tor hidden services can no longer be relied upon.

[edit4] Facebook are saying (on the Tor Talk list) that they generated a load of keys starting "facebook" and then just picked the one which looked most memorable, and were extremely lucky to get such a good one:

[http://archives.seul.org/tor/talk/Oct-2014/msg00433.html](http://archives.seul.org/tor/talk/Oct-2014/msg00433.html)

<comment><USER2> Nothing, and it's interesting that they have enough computational power to do that for a relatively trivial project.

Meanwhile, whilst I applaud Facebook going above and beyond here, this doesn't set a good precedent.

Firstly, Onion service are very slow. There is no need to pay this cost for a service whose ownership is not actually hidden. If the Tor project made it easier to reliably identify traffic from Tor exit nodes, Facebook could apply whatever rules they wanted to Tor traffic without needing to slow things down for everyone.

Secondly, by doing this, there's now a risk that other firms who want to be on the cutting edge of privacy will try to copycat this approach, even though it makes no sense and is very complex and expensive to set up. Worse, users might think it's some kind of "gold standard".

Thirdly, it doesn't actually solve any of the reasons why Tor traffic is routinely discriminated against and harassed: Tor is effectively a "bulletproof ISP" that shields a lot of abuse and hacking. Merely making a Tor hidden service specifically for Facebook doesn't solve that, at all.

<comment><USER3> > _Worse, users might think it 's some kind of "gold standard"._

That may be the worst unexpected consequence. Once onion services become more mainstream, I fear FB's example - no matter how well intentioned - will turn into an engineering nightmare. After all, after one of the best known online brands does something clever, you can expect copycats to follow.

First, we'll get clueless PHB types demanding long vanity names.

Second, some services will happen upon neat onion addresses and ride the wave. Their very existence will act as a goal post for the others.

Third, a vocal segment of users becomes accustomed to seeing "perfect" vanity names. After all, such name means that the entity behind the name has enough resources to actually get a proper vanity name.

Amidst all that, somewhere between stages #2 and #3, we will see (horribly misguided) vanity onion service name markets. A bit like domain name squatting from the late 90's, but with far worse consequences: at least with domain names the only thing transferred was the control over the DNS entry. Because onion service names are directly mapped to the private keys, selling a $VANITY.onion address is the same as selling _a copy of the private key._

Caveat emptor, indeed.

<comment><USER4> Are naive users and Tor worth worrying about?

The list of "you have to" involved in making its use meaningful is pretty long, and "normal" users aren't good at caring about details like that.

Please nobody construe that as a dismissal of the needs of those users, that isn't what I'm getting at.

<comment><USER3> > _Are naive users and Tor worth worrying about?_

Right now? No. But in a near future? Possibly yes, if Firefox decides to include a built-in Tor client. [0]

Even if the article (and the slashdot thread I lifted it from) were vapourware right now, the idea clearly has been floated enough to make it an attractive option.

[0]: [http://www.dailydot.com/politics/tor-mozilla- firefox/](http://www.dailydot.com/politics/tor-mozilla-firefox/)

</comment></comment></comment></comment></comment><comment><USER5> The most interesting part of this (to me) is that they brute-forced the .onion address (which is normally the SHA-1 hash of a public key).

Good thread on StackExchange about how to do that: [http://security.stackexchange.com/questions/29772/how-do- you...](http://security.stackexchange.com/questions/29772/how-do-you-get-a- specific-onion-address-for-your-hidden-service)

<comment><USER6> Tor still uses SHA1? I understand clueless download sites (such as FossHub) and projects still using MD5 and SHA1, but I would hope projects that are supposed to be about security would've stopped using SHA1 a long time ago. If they dread moving to SHA2 because of its much slower performance, they should at least use BLAKE2 [1].

Even NSA-influenced NIST recommended against using SHA1 after Dec. 2013. And when NIST recommends a deadline for change, you know you should be doing that at least 3-5 years earlier to be safe against state sponsored/NSA attacks.

[1] - [https://blake2.net/](https://blake2.net/)

<comment><USER7> Agree. I never understood why onion names are so short; they're not even the full SHA-1 hash:

> The .onion name is computed as follows: first the SHA1 hash of the DER- > encoded ASN.1 public key is calculated. Afterwards the first half of the > hash is encoded to Base32 and the suffix ".onion" is added. Therefore > .onion names can only contain the digits 2-7 and the letters a-z and are > exactly 16 characters long.

(Source: [https://trac.torproject.org/projects/tor/wiki/doc/HiddenServ...](https://trac.torproject.org/projects/tor/wiki/doc/HiddenServiceNames))

<comment><USER8> Then move to I2P where there are inanely long .b32.i2p hashes. I believe Tor stuck to sixteen to balance ease of use with security. I2P decided not to truncate their hashes since they already have memorable short.i2p entries in downloadable hosts files.

<comment><USER7> .onion addresses aren't particularly memorable anyway (Facebook's nonwithstanding). They wouldn't have to go to insane lengths like I2P does, but it seems like not cutting the SHA-1 in half would make it much stronger. I just feel like in striking a balance, they should err on the side of huge security margins. On the other hand, I don't really have an intuition for the strength of the current addresses, so it's not meant as criticism as much as a quest for understanding.

<comment><USER8> Although I agree it isn't cakewalk to memorise an onion URL, it is possible and many people do it usually by grouping or mnemonics. I'm not against any change/improvement to the current address generation system in Tor; there are certainly other better possibilities for both security and scalability.

</comment></comment></comment></comment></comment></comment><comment><USER9> Although this will be useful, I hope users will keep in mind that identifying themselves while using Tor could make their other traffic less than anonymous. In the Tor Browser Bundle, compartmentalizing your traffic via frequent use of the 'New Identity' feature is usually a good idea.

Using this would also add to the data that one of the world's most aggressive advertisers and an NSA PRISM partner will have about you as a Facebook user.

One plus: at least the login page appears to load correctly without javascript enabled.

Edit to add: someone whose only interest is in not sharing their IP address/location with Facebook could access this URL via facebookcorewwwi.tor2web.org but the usual browser fingerprinting and potential tracking caveats apply

<comment><USER10> > identifying themselves while using Tor could make their other traffic less > than anonymous

Why? With data encrypted end to end the only people who know you've identified yourself are you and the end service.

<comment><USER9> suppose you see an article in your news feed while using the hidden service and click on it; facebook still has a good chance of learning about your browsing habits that way, even if you start from a hidden service. facebook might then learn which exit your non-hidden-service traffic exits to, and from there, it might have information to offer to advertisers about the identities of tor users using a given exit around the same time.

even just having a strong authenticator of your real identity active on tor at a given time may be concerning, depending on your threat model.

<comment><USER11> Where "advertisers" can be replaced by "NSA" for a more lucrative business model... :-/

</comment></comment></comment></comment><comment><USER12> If you want more information on the specifics behind how FB did this, here is a really really informative mailing list conversation about it. Instead of coming up with facebookcorewwwi and then searching for it, they found a bunch of "facebook" first, and then picked the best one.

[https://lists.torproject.org/pipermail/tor- talk/2014-October...](https://lists.torproject.org/pipermail/tor- talk/2014-October/035412.html)

</comment><comment><USER13> From Tor:

"So I'm totally anonymous if I use Tor?

No.

First, Tor protects the network communications. It separates where you are from where you are going on the Internet. What content and data you transmit over Tor is controlled by you. If you login to Google or Facebook via Tor, the local ISP or network provider doesn't know you are visiting Google or Facebook. Google and Facebook don't know where you are in the world. However, since you have logged into their sites, they know who you are. If you don't want to share information, you are in control."

</comment><comment><USER14> While Facebook gets props for their astonishingly clever .onion address, it seems rather odd to promote unlinkability while continuing to enforce their legal names policy. I'd probably respect this a lot more if it was accompanied by setting up Tor exit nodes, which invites actual risk and things like FBI visits.

<comment><USER15> You can at least browse public Facebook posts without logging in. But I think the main point is to avoid local censorship, reducing Tor to a simple proxy.

<comment><USER16> There is no difference from accessing Facebook from .com and .onion in that case. If the main point would be to avoid local censorship, they would have a bigger effect if they instead of focusing power on running a hidden service, spent the effort on running an exit node.

</comment></comment></comment><comment><USER17> I think its much more likely that facebook is utilizing this to better track abuse. Its not always easy to tell if a user is using tor, and a statistically higher percentage of tor users are doing things facebook doesnt like.

By creating a entry point, they can more easily track and label users that even use that entry point, to better handle abuse.

</comment><comment><USER18> Can the NSA 'tag' a specific user using Tor? If so, wouldn't using Facebook over Tor then provide them with a direct link between your FB identity and your other Tor activity?

<comment><USER19> Yes. If someone captures identifiable information then a user can be identified. This can be minimized by using SSL to connect to services. A service may share data so you should also use only a single service within a Tor session. That includes closing tabs to prevent ajax requests.

A new session can be created by restarting Tor or from the tor indicator if within TAILS.

<comment><USER20> Note that, although you are right that you should _usually_ use https on tor, it does NOT APPLY to hidden services. Hidden Services are end-to-end encrypted, regardless of whether you use http or https. That is also why a site like Silk Road simply used http: it was a hidden service.

The reason for this is that it never leaves the Tor network. Traffic from a tor client to a hidden service goes (encrypted) through relays, but never exits. Basically you are entering a validation of the public key when you type in the .onion address, so nobody can tamper with the connection.

</comment></comment></comment><comment><USER21> Can someone help me understand the intended user experience?

As I currently understand it, you connect anonymously to Facebook, login and link your activities to your real life identity and Facebook turns over the information that you provide to whatever powerful government entity you are hiding from.

Why would anyone do this?

<comment><USER22> Probably because the latter half of your assertion, that "Facebook turns over the information you provide to whatever government entity you are hiding from" is a lie. This protects people who feel they need to hide the fact that they are connecting to Facebook from an observer/ISP.

<comment><USER21> Maybe my phrasing was overly strong. As I understand it, there are no guarantees that the information that we put into a service like Facebook can be kept out of the government's hands. Whether or not Facebook is doing it willingly, is not relevant to my question.

What is the value in using tor to connect anonymously to a system that ties back to your real life identity?

[http://venturebeat.com/2014/05/15/how-the-nsa-fbi-made- faceb...](http://venturebeat.com/2014/05/15/how-the-nsa-fbi-made-facebook-the- perfect-mass-surveillance-tool/)

<comment><USER23> The tie is only temporal, and it's still anonymized.

The only concession is that now the government you're avoiding _might_ know you use Tor, if Facebook tells them.

\----

Here's the usage case: you're a foreign national visiting a country with a restrictive firewall, like China's. Now you can continue to communicate with people back home.

Facebook already had your information, in this scenario, so nothing has changed except that they know people from China are desperate for their services. That's only good, in my book.

</comment></comment></comment></comment><comment><USER24> Which CA signed the .ontion cert in that case? Self signed?

<comment><USER25> No. It's a fully valid ceritifcate issued by DigiCert to

        CN = *.facebook.com
        O = "Facebook, Inc."
        L = Menlo Park
        ST = CA
        C = US

with a bunch of altnames

        DNS Name: *.facebook.com
        DNS Name: facebook.com
        DNS Name: *.fb.com
        DNS Name: *.fbsbx.com
        DNS Name: *.fbcdn.net
        DNS Name: *.xx.fbcdn.net
        DNS Name: *.xy.fbcdn.net
        DNS Name: fb.com
        DNS Name: facebookcorewwwi.onion
        DNS Name: fbcdn23dssr3jqnq.onion
        DNS Name: fbsbx2q4mvcl63pw.onion

<comment><USER24> Thanks - learned something that you can put anything in the alt names list. So digicert is not checking those to be valid domains and controlled by the cert requester?

<comment><USER26> You can't put _anything_ in the SubjectAltName field, you can put anything that _isn 't_ a valid TLD (and not have to validate it).

<comment><USER27> So Eve could also get a cert for facebookcorewwwi.onion?

<comment><USER26> Yes. I submitted a request for one just now, actually. Hopefully the CA doesn't flag it for containing Facebook.

<comment><USER26> Just had it issued. Probably going to write a blog post now.

<comment><USER28> Did you get it from DigiCert? Or from another CA?

<comment><USER26> GlobalSign.

edit: They've revoked the cert. :(

<comment><USER2> But does TBB check for revocations? I bet the answer is no because otherwise it'd be sending the sites you visit to CA's via OCSP and Tor would never want that. So I think you still win.

<comment><USER29> You could still get a full revocation list (via Tor or not). In fact using OCSP over Tor should be safe? FB sees some-exit-node, sends you a cert, CA sees some-other-or-same-but-not-provably-you requesting status of FBs cert. Unless FB sent you a specially craftet, session-spesific cert, CA would only see that "someone" checked the status of FBs cert. And with no immediate link between "you" and "someone"? Much as DNS over Tor is safe (but DNS over udp isn't)?

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER30> I dread to think how much electricity it cost them to brute that vanity URL.

</comment><comment><USER9> adding a link to roger's super-thoughtful and basically authoritative blog post on the subject: [https://blog.torproject.org/blog/facebook-hidden- services-an...](https://blog.torproject.org/blog/facebook-hidden-services-and- https-certs)

</comment><comment><USER31> Heh, my first reaction was, 'shoot, they brute-forced an address!' and I see that a lot of others had the exact same idea. I wonder how tough that was to do—I'm guessing that they didn't use Shallot!

Looks like some sort of CA structure is going to be pretty vital to Tor…

<comment><USER32> CA structure is not vital to tor at all. All connections to hidden services are encrypted and authenticated end to end. the URL serves as the public key.

<comment><USER31> The public key which is obviously brute-forceable…

</comment></comment></comment><comment><USER33> Huh.. I wonder if something like Cloudflare would offer something like this next? (Whether or not they might brute force vanity URLs is another matter)

<comment><USER9> not sure if you're trolling, but i wish cloudflare weren't so overtly hostile to tor users! i've already stopped using all but a few cloudflare sites for this reason.

<comment><USER34> On the other hand, tor users are very hostile to Cloudfare. The percentage of traffic from tor that is malicious is not small.

<comment><USER9> just about everywhere else, service providers have figured out ways to allow access while managing abuse.

cloudflare ends up being a HUGE pain and practical barrier for the vast majority of people who use tor to exercise their right to read.

<comment><USER34> Sure, but Cloudfare is where you go when you have already had malicious users causing trouble. It doesn't seem crazy that it would be a huge problem for Cloudfare hosted sites (and as such, the block).

Sites that want Tor users should do well and avoid services like Cloudfare, but for sites that don't care it's a very effective way to cut out malicious actors.

It's not nice in a freedom sort of way, but for ad supported sites Tor traffic is worthless and there is little incentive to try and cater towards it.

</comment></comment></comment></comment></comment><comment><USER35> Last I checked, Facebook doesn't work at all unless you are logged in.

So I can now tell Facebook my personal information and a list of associates _securely_ , which it will then promptly share with any government interested.

I guess its the best way yet to illustrate the basic problem with Tor (no technology in the world can protect you from giving the bad guys your home address), but can't shake the feeling that this makes an utter mockery of the idea behind Tor.

<comment><USER9> two words for you: censored users

</comment></comment><comment><USER36> I'm sorry, but even the thought of a more secure Facebook site won't get me to post on there.

</comment><comment><USER37> awesome! I can now securely hand over my personal data to a company that will turn around and sell it...what a relief...</comment>


Why is the opt-in toolbar scam still acceptable? - <AUTHOR> Aside from when I need Photoshop, I've been using my Chromebook 80% of the time & loving it but over the last year, I've had 3-4 family members and friends ask me to help them remove toolbars/search helpers and other shit they downloaded by mistake while installing a legit piece of software on a Windows box.
The industry should have evolved beyond this practice by now. I'm sure there's a less invasive profit center.
This practice specifically preys on the less tech savvy. Not cool... It seems like reputable companies would distance themselves from the practice but some of the most popular software still tries to get you to opt-in via a strategically placed checkboxes or misleading question. It's time for us to stop accepting this. Our parents, kids and friends deserve better.
Thoughts? <comment><USER2> Strictly speaking, it's usually opt-out, i.e. the "install toolbar" option is selected by default, usually in fine print at the bottom of the installation screen, and you have to notice it and un-check it.

<comment><AUTHOR> Yup, sorry. That's what I meant. If you aren't tech savvy or very careful, you breeze right by it because it's often proceeded by questions that have to remain checked.

</comment></comment><comment><USER3> IMO the problem is that windows does not have a proper built-in package manager. People rely on binaries installed from possibly shady websites to install their software.

This would be a non issue with a proper package manager (that or a well curated "app store").

Installers should be a thing of the past, they hardly serve any purpose in this day and age.

You can't expect people to stop doing that if it makes them money. I'm pretty sure the vast majority here doesn't accept this kind of behaviour (whatever that means), but so what? We're not the target anyway.

<comment><USER4> Package managers would do nothing to stop vendors from bundling toolbars. They bundle toolbars because it makes them money, not because they have to ship their own installers...

<comment><USER3> If you bundle crapware in your package it gets rejected. Problem solved.

Look at Steam. Look at the various un*x package managers. They don't have this problem. When I install/update a game through Steam I don't have to worry about crapware (besides steam itself, but that's an other issue).

<comment><USER5> You want Microsoft to get to decide what software people can and cannot install on their PCs? Seriously?

<comment><USER3> No, I want Microsoft (or a third party) to propose a curated App Store for common applications on Windows. You would still have the option to install software through other means.

It would be a huge win for Microsoft IMO, better user experience, software updated automatically for better security, less chance to spread a virus etc...

I'm not advocating a walled garden, I'm advocating a fenced garden you can leave at any moment if you need to and you know what you're doing. Best of both worlds IMO.

It would also simplify the work of the devs, because right now most windows applications feature a custom and non-standard way to check and download updates. Or worse, they don't check, making sure that virtually nobody updates them ever.

<comment><USER6> Given that their current walled/fenced garden is overrun with weeds [0], I wouldn't expect much of Microsoft.

As for 3rd party curated stores, we don't need to look beyond Adblock whitelisting Google ads to see where that's headed. Once any 3rd party store reaches critical mass, dollar signs start showing up and it won't be long before "official" weeds begin to creep into the 3rd party garden.

It might be possible for the EFF or a related body to step in and mandate that before installing a toolbar/extension browsers run a check against a Web Of Trust (WOT)-like decentralized system gathering ratings from actual users for all toolbars and extensions. This is a long-term play, one that is unlikely to come to fruition given the massive amount of co-ordination necessary for relatively little payoff.

Realistically, it's up to the users to get savvy. People get ripped off all the time in the real world and no one has managed to put a stop on that, why expect anything different from the virtual world.

Edit: I just had an epiphany in the shower that leads me to believe I closed off the discussion too soon. My initial thinking was that since this was a social engineering issue a technological solution was impossible. It took a hot shower to remind me that we have solved a similar issue with technology before; we know this as "Parental Controls".

Adopting a similar system for naive users has huge benefits — the control remains in userland instead of in the hands of a 3rd party which means its scalable (new users can begin using it right away instead of waiting/hoping a 3rd party would approve) and specific (opt-in/opt-out remains a choice of the user, so savvy users remain unaffected by the needs of the naive).

It works via a browser setting that a savvy relative can turn ON for the user. Once turned ON, all extensions and plugins including toolbars are blocked. Savvy user can whitelist some extensions etc during setup. Problem solved.

We can call this system "Special Controls", which I think is the best name that describes the purpose of the feature without offending the sensibilities of the user.

[0] [https://news.ycombinator.com/item?id=7161609](https://news.ycombinator.com/item?id=7161609)

</comment></comment></comment></comment></comment></comment><comment><USER7> I agree that this is a tactic that preys on the less tech savvy folks, and share your continued astonishment that reputable companies would engage in these drive-by toolbars/extensions that are bundled in installers.

YC has invested[0] in a company called InstallMonitizer[1] that appears to help developers and advertisers connect in the pay-per-install marketplace.

[0] [http://www.techdirt.com/articles/20130115/17343321692/why- ar...](http://www.techdirt.com/articles/20130115/17343321692/why-are-y- combinator-andreessen-horowitz-backing-drive-by-toolbaradware-installer.shtml)

[1] [http://www.installmonetizer.com/](http://www.installmonetizer.com/)

Sadly it does't seem like a practice that will go away any time soon. I'd like to do some digging around on developer forums and see if any folks have shared their experience and would be able to comment on the amount of extra revenue that they see from such programs.

<comment><AUTHOR> Interesting.

</comment></comment><comment><USER8> The worst bit of social engineering of this kind that I recently encountered was contained in the OS X installer for μTorrent. Halfway during the installation process you get a large body of text along with the buttons AGREE and DECLINE. You immediately think you're looking at a license agreement and click AGREE. Then you realize what the buttons actually said was:

AGREE to this offer DECLINE this offer

And the offer obviously is to install some toolbar crap into your browser. Normally I'm very careful not to install any adware or toolbars, but this one caught me off guard.

</comment><comment><USER9> Correct. I've noticed incredibly SEO optimized pages for popular free software (VLC I think). That is what people like my parents find if they google form such products. If you install from one of these pages you get a lot of crap- and adware. It wouldn't be a problem if they didn't score so high for names of free software...

<comment><USER10> There is even worse, my mom installed Kies the other day from a website which was better referenced than samsung's (Kies being the synchronizing app for samsung devices for ppl wondering). It cost her € 10 through sms payment. Well maybe it was some sponsored link but in the end its just the same for "elder" people who dont have a minimum tech background (or common sense you might add). Anyway no other website than the official developper / distributor one should come first when doing such a straightforward search. This leads to a terrible customer experience for both google and samsung along with some easy earned money someone who doesnt deserve it.

</comment></comment><comment><USER11> Meta question for browser designers... is there any possible reason or purpose for toolbar addons other than spamming users? No? Oh, then take out the entire functionality, please. It'll be a massive net gain to humanity.

Since they won't, makes you wonder how much they're being paid to leave it in.

<comment><USER12> On Firefox, toolbars are just one of the many functionalities that extensions have available, and that allow them to completely modify the UI. And yes, those capabilities are useful: see Firebug, Vimperator, etc.

<comment><USER11> I don't disagree with your assessment of usefulness, solely with the assumption that useful = net gain to humanity.

As a guy who uses firebug, I'd much rather download a special built executable of firebug for myself, once, than spend a lifetime cleaning up relatives browser bars.

(edited to rephrase, what I'm asking for is a market bifurcation where stereotypical end users can't install toolbars and stuff to get owned, but devs are given the ability to screw their browsers up. Or we simply distribute dev tools separate from end user tools.)

<comment><USER12> What makes you think that spammers won't convince your relatives to download "special built executables" that add those toolbars? In the IE world, the way to create one of those toolbars _is_ to develop an executable - a DLL -, but we all know that didn't stop them.

In the end, browsers can only do so much; you need full process isolation at the OS level to avoid these problems.

</comment></comment></comment></comment><comment> slipstream- Just deliberately search in google, yahoo and bing for "download <insert popular software or game here>", find the obviously pay-per-install-crap ads, report them. (say they try to get the user to download malware, which adware is.)

<comment><USER13> 'Download flash player' in Bing gives me a bunch of dubious sponsored links before the official installer. Google has taken the step of removing all of those and linking to the official installer first.

<comment><USER14> Last I checked, the _legitimate_ Flash installer from Adobe tries to install McAfee.

And the Java updater for Windows tries to install the Ask toolbar on _every update_. I feel like these are programs I can't really avoid installing, either. Scum!

</comment></comment></comment><comment><USER15> (The biggest of these unwanted craps being Chrome.)

<comment><USER16> Is Chrome being installed without your consent when installing some other piece of software? Could you give a specific example, that is new to me.

<comment><USER17> It's in the standard rotation of shovelware. You don't get it 100% of the time but I had a Flash update for Firefox try to install Chrome last week.

</comment></comment></comment><comment><USER18> When I visit my parents, I end up having to remove the Ask toolbar. It always returns due to the frequent java updates having the Ask install box ticked by default.

<comment><USER19> Put Ninite on their boxen and set it to autoupdate java, perhaps?

<comment><USER20> I want to believe that 'boxen' is a Brian Regan reference and not just a typo :)

<comment><USER21> Its been in the jargon file for a while – [http://www.catb.org/jargon/html/B/boxen.html](http://www.catb.org/jargon/html/B/boxen.html) – I guess its an obvious analogy with ox/oxen.

<comment><USER19> Also VAX/VAXen.

</comment></comment></comment></comment></comment><comment><USER22> How could any industry evolve beyond such easy money? As long as there are users who will put up with Google/MyCoolWebSearch/ALOT/Conduit/Baylon/etcetera messing around with their settings and information these firms will never move away from these tactics.

If I rememeber correctly, Ccleaner was removed from Ninite due to the automatic refusal of big G's toolbar.

</comment><comment><USER23> Yes this practice should not be acceptable, if a company does it I actively avoid them and recommend friends do the same. I think the market for this sort of thing will ever be shrinking as more and more of the technology generation grow into adults. It's a shame that normal people out in the world are completely unaware this is even happening on their systems. I often speak to people who've falled foul of this practice and they don't even know where it come from and don't seem worried that something appeared without them approving it. Most of the time they just assume that's how it's always been and they'd not noticed it before.

</comment><comment><USER24> I tried installing something ostensibly legitimate from download.com. The "download.com installer" masked the opt-in of 3 separate craps with EULA acceptance prompts. If I was just slightly less paranoid about this stuff, I would have clicked through all of them.

And to be clear, they were not checkboxes, or "custom install" options. They were straight-up walls of text in tiny textareas, with only "accept" and "decline" buttons.

My instinct was to decline them, and they just kept coming. After I dismissed the final crap, the installer then downloaded the real installer for the app I was trying to install.

<comment><USER25> Having moved to OSX, but by no means a zealot, there are many things I miss about Windows.

This - download.com and others - is absolutely not one of them.

</comment></comment><comment><USER26> One software that I really appreciate, Freemake Video Converter, perpetrates this "scam." Personally, I prefer unchecking a box once to seeing ads on every use. But I agree it's a pretty shady tactic. I'm sure the problem will go away as tech literacy increases. Until then, so few people will be both aware and bothered by it that there will be no sudden change... just like issues in the non-tech world!

</comment><comment><USER27> I 100% agree, but the problem is that people have adblockers everywhere now, so toolbars are pretty much the only place left to serve ads.

<comment><USER28> Really? I know some people use them, but my impression is that most people do not use ad blockers.

<comment><USER29> It's still low, but it IS likely on the rise; at least, I hope so, given how advertisers are not averse to poisoning the well by allowing ads that are distracting, or downright evil.

I know I avoided using adblockers (I want to support my favorite websites after all)...until I had one particularly pernicious ad served to me on comics.com that hadn't been vetted, and caused my browser window to minimize, and displayed a popup right over my (Windows) system tray, styled to look like a system alert, indicating my system wasn't secure and I needed to click here and download X. That was the final straw, and I haven't looked back.</comment></comment></comment>


More functional C# - <AUTHOR> I added this code as a comment to a thread that was almost all the way off the front page by the time I got to it.  It was a response to some 'functional folks' criticizing the verbosity of c#.  While you can certainly do c# the java way, you can also do it in a near functional way.
I decided to post the code as a full submission because I think c# often gets dismissed as Java copy-cat, which hasn't been true in a decade.
The code (non-destructive, no side effects) calculates square roots :

    public static void Main()
    {
        const int n = 21;

        Observable.Generate<double,double>(1, x=>true, x=> 0.5 * (x + (n/x)), x=>x )
        .Scan(new {prv = 0d, cur = 0d}, (prev, curr) => new {prv = prev.cur, cur = curr})
        .FirstAsync(_ => Math.Abs(_.cur - _.prv) < 1E-10)
        .Select(_ => _.cur)
        .Subscribe(Console.WriteLine);

        // this is just to compare values, so is not part of the solution
        Console.WriteLine(Math.Sqrt(n));
        Console.ReadLine();
    }
 Read the more OO c# implementation that inspired me here: https://news.ycombinator.com/item?id=7044497
Read the Haskell code that inspired both here: https://news.ycombinator.com/item?id=7043943 <comment><USER2> You can write Java code which works similarly to your C# code by using RxJava: [https://github.com/Netflix/RxJava](https://github.com/Netflix/RxJava)

Or Python, via RxPy: [https://github.com/Reactive- Extensions/RxPy](https://github.com/Reactive-Extensions/RxPy)

Or JavaScript, via RxJs: [https://github.com/Reactive- Extensions/RxJS](https://github.com/Reactive-Extensions/RxJS)

Or Ruby, via Rx.rb: [https://github.com/Reactive- Extensions/Rx.rb](https://github.com/Reactive-Extensions/Rx.rb)

Or Objective-C, via Rx.ObjC: [https://github.com/Reactive- Extensions/Rx.ObjC](https://github.com/Reactive-Extensions/Rx.ObjC)

Your code is a good demonstration of how Rx works though, and it's nice to know it's becoming more popular.

<comment><USER3> Rx was invented by Microsoft, so C# is a rightful first choice for Rx examples :). That code doesn't demonstrate Rx per se, it demonstrates how lambda expressions, extension methods, anonymous types, type inference enable a succinct backwards-compatible (to some extent) functional syntax in C#.

<comment><USER4> Look at the type signatures of many LINQ and Rx methods. I would hardly say they are succint. While just using expressions can be compact, maintaining a functional library or creating functional methods in your application will be a chore in c# due to the verbosity of the type syntax (Type inference won't help you on method signatures)

</comment></comment></comment><comment><USER5> But why do things "near functional" when you have F# which is fully functional?

<comment> V-2 Because "near functional" is sufficient most of the time and if there is no compelling reason to split your codebase among two different languages, you shouldn't do it. Not to mention that there's probably 1000 C# developers for every F# developer

Have a look at [http://www.indeed.com/jobanalytics/jobtrends?q=c%23%2C+f%23&...](http://www.indeed.com/jobanalytics/jobtrends?q=c%23%2C+f%23&l=)

And someone has to maintain your near functional or functional code

<comment><USER6> I used to use this argument and only now I realize how flawed it was. At some point there were 1000 COBOL programmers for every <your favorite language> programmers. If you decide to go with COBOL career, you will be maintaining bad software for years.

<comment><USER7> The GP was speaking from the standpoint of the business rather than that of the developer.

</comment></comment></comment></comment><comment><USER8> C#'s functional side is why I actually really enjoy working with it. I get to use a nice blend of OO and functional, where each makes sense. OO more on a macro scale, organising code.

<comment><USER9> The future is to have multi-paradigm languages.

Each paradigm gets used depending on the type of problem being solved.

<comment><USER10> Hopefully, the future is having multiparadigm developers. At the moment, most developers seem to struggle with their first... most of the time without realizing it.

</comment></comment></comment><comment><USER3> Maybe it's strange for them to see something that is both functional and highly practical?

PS: once Roslyn get's finally released, Java will never catch up again.

<comment><USER6> No one is using Java because it has great features compared to C#. Java is essentially what C# 2.0 used to be and C# has already moved on to V5. People use Java because it's cross platform. When you write server code you want it to be able to run on whatever box instead of paying for hefty Windows hosting. With now Oracle at helm, Java is likely the worst choice for any new project.

</comment></comment><comment><USER11> I'm guessing Observable, Scan, FirstAsync and Subscribe are all from the Rx reactive/observable framework? I haven't seen them before.

<comment><USER12> Observable, Scan and FirstAsync are from Rx. (FirstAsync is roughly equivalent to LINQ First(), except that it doesn't block.) This particular Subscribe method is also part of Rx, but it's basically a helper method around the BCL System.IObservable<T>.Subscribe(IObserver<T>) that saves you having to implement IObserver.

</comment></comment><comment><USER13> Absolutely - C# 3.5 introduced a beautiful suite of FP-ish features that made the language fun to write functional code with, and later versions of C# parallelized and asynced those FP-ish features.

</comment><comment><USER14> What's the point of writing code in a functional way to end up with something that is completely unreadable?

I'd rather have code written in simple, well factored functions and classes and easy to reason about, than having to deal with such a mess of functional code.

Don't get me wrong, functional code can be very elegant and clear, but the example provided here is a huge turn off to me.

<comment> V-2 I don't like the underscore notation (I think it's foreign to C#), but other than that it's very readable to me, so I guess it's a matter of practice and (acquired) taste

</comment></comment><comment><USER4> While sprinkling a few expressions like this around is nice, it's quite a chore to embrace a true dataflow or similiar functionally typed design through your whole application, because the types in c# are so verbose i.e.

        public Generate(TState initialState, Func<TState, bool> condition, Func<TState, TState> iterate, Func<TState, TResult> resultSelector, IScheduler scheduler)

<comment><USER15> Methods with that many arguments are probably not a very good idea anyway.

<comment><USER4> Unfortunately there's probably not a great alternative in many cases such as this

</comment></comment></comment><comment><USER16> I have read a lot of lang. wars and complaints about programming languages... but C# is one of the only languages that I can't remember reading any complaints about. None.

I must conclude, by the usual Stroustrup quote, that no one uses C#. (yes this is tongue in cheek)

<comment><USER17> Well, I use it =) C# is a language with a somewhat limited market ("Enterprise" applications running on Windows Servers, and yes, I know about Mono). And in this market, a very strict subset of C# (see: Java) is happily used. I know a lot of people who refrain from using even lambdas and implicit typing, let alone the other "fringe functional stuff", because "they make things complicated".

<comment> V-2

       C# is a language with a somewhat limited market
       ("Enterprise" applications running on Windows Servers,
       and yes, I know about Mono)

One would think that Windows Phone - fastest growing smartphone OS - would go before Mono... geez, I make a living out of desktop C# apps (WPF). Not solely, but on a daily basis.

<comment><USER18> Fastest growing is easier to achieve when you have low market share.

Mono is significantly more important for the future of C# than Windows Phone.

<comment><USER19> You can make it even easier by pretending old versions of your mobile OS don't count. Or at least it appears you're allowed to do this if you left all your prior mobile users high & dry after promising them upgrades, twice.

</comment></comment></comment></comment></comment><comment><USER20> This is a joke, right?

<comment><USER21> This is hobbyist code. It should never actually be used out in the real world. Once you make the distinction, you can better appreciate code snippets like these.

<comment><USER22> If you are going to criticize this approach to C# you are going to need to be more specific - the classic argument for this kind of thing is correctness, and against is optimization, is it the latter you are implicitly pointing out? And if so, what insight as to implementation details that you think make the solution slower?</comment></comment></comment>