US tells India it is mulling caps on H1Bs to deter data rules - <AUTHOR> https://www.reuters.com/article/us-usa-trade-india-exclusive/exclusive-us-tells-india-it-is-mulling-caps-on-h-1b-visas-to-deter-data-rules-sources-idUSKCN1TK2LG <comment><USER2> Master Card and Visa are failing, because we have something better in place.

BHIM (Bharat Interface for Money) developed by National Payments Corporation of India.

\- Transferring money from one personal account to any new account (adding a beneficiary account) would take more than 4 hours.

\- One needs to login each and every time to transfer money.

\- There is a chance of forgetting password and account being locked on multiple tries.

\- Extra charges for transferring money.

All this problems were solved by BHIM new UPI (Unified Payments Interface).

\- Linking bank account with app (takes less than 1 minute)

\- Transferring money doesn't have any extra charges

\- No password, but 4 to 6 digit pin for transaction.

\- Safe, transaction can be done only from mobile which is linked with bank.

Additional benefits,

There is no need to give personal information, one can provide UPI address or Virtual UPI address.

In Google Pay app,

If my Gmail account is email@example.com

Then my UPI would be, xyz@ok{bankname}

If my bank is SBI,Then my UPI is xyz@oksbi

Mentioning this address, anybody can make a payment or request one.

Edit: Formatting

<comment><USER3> I completely believe it. I spent two months in Hyderabad. India is WAYYY ahead on the payments game.

Every business, no matter the size, accepted mobile payments (usually PayTM, but I saw support for PhonePe, Zeta and others). The US is super behind on this; very, very, very few retailers accept Square Cash, more accept PayPal, none of them accept those payments easily. Any app that does mobile banking requires KYC verification. For mobile payments, usually support soft KYC, which you can easily fake, but only lasts 180 days. For anything else online banking related, hard (in-person) KYC was required.

Every terminal supported credit/debit cards (though using international cards was a crap-shoot, and AMEX even more so) and all of them expected Chip + PIN. People were legitimately surprised when they saw that I had to sign. Some didn't even ask for the signature because they weren't used to it.

Everything in India uses SMS OTP and requires an India phone number to receive it. This was super annoying before getting a Indian SIM card, but once I did, I realized how nice of a system this was.

There were many things about the India experience that I wasn't a fan of; paying for stuff was definitely not one of htem.

<comment><USER4> >>India is WAYYY ahead on the payments game.

Only if you(and the person receiving) can afford a smart phone, and an internet connection.

The edge US has is the cards are ubiquitous, they cost nothing to carry and use. Every one has them, and every one receiving them has the readers. Most credit unions don't charge for checking accounts, and transaction fees are $0.

US is WAYYY ahead on the payments access game.

<comment><USER5> Not just that but getting an account to process international card is very difficult in India and setting up recurring payments or SaaS very difficult.

<comment><USER6> I recently tried to buy Office 365 from MS India. It just kept on failing with my India debit card even though it accepts both debit/credit cards. The error message was not helpful and finally came to know from customer care that it was due to the debit card. So, it can go both ways.

</comment></comment></comment></comment></comment><comment><USER7> >The move, however, was not solely targeted at India, the source said.

>"The proposal is that any country that does data localization, then it (H-1B visas) would be limited to about 15% of the quota

It does sound targeted at India and perhaps China because they are the largest countries with English speaking populations and take a large percent of visas. I doubt the European countries or most other countries will be affected by this since they have way smaller populations and fewer people looking to work in the US.

Anyway I am not totally opposed to restricting new H1B visas to 15% since work based green cards are 7% max per nationality causing long delays. They just need to make sure that people waiting for green cards close to a decade while on H1B are not affected by this.

However, if this does happen, it will accelerate offshoring to India tremendously and end up benefiting work immigration friendly countries like Canada. Microsoft already has a large campus right across the border in Vancouver, and other companies will follow suit with setting up in Canada and India.

</comment><comment><USER8> As an Indian - good! This will help the local IT industry tremendously.

<comment><AUTHOR> I wonder, how much do Indians prefer emigration vs remote work? Assuming pay is equal

<comment><USER6> Even if pay is half or one third, I prefer India (saying as someone who was an h1b in US for 6.5 years). India has a lot of problems-bad infrastructure, crazy traffic, poor air, bad policing and so on. Life in India is basically like playing a game in difficult mode while US is easy mode. But the peace of mind that comes with not having to live in the uncertainty that h1b brings is insanely huge. When it comes to quality of life, while things like good air matters, the "uncertainty" seems to override pretty much everything else, at least in my case. I guess my lizard brain sees it as "US has lot of resources that will get you lot of food, but there are plenty of predators, so you must go somewhere free from those, and until you do that I am going to make you miserable". It may sound stupid, but that's how I make sense of my experience as an h1b.

Based on my rough estimates, when I compare an h1b (earning $100k in midwest per year and paying $1000 per month rent with a stay at home spouse and kids) vs the same person working in India with spouse also working (both earning ₹50-70k per month), the person in India can save more or less same. And if that person were to try in one of the good companies in big cities say Bengaluru, they most likely will save more.

Bankruptcy due to medical bills is another major concern (one of my h1b friends faced this, ended up wiping out all his savings he had from his 1+ year stay in US, and I think some of it went to collections).

Another issue is the one faced by h1b spouses, who are predominantly women. With the proposed removal of h4 work authorization (h4 means spouses of h1b), this becomes an even bigger issue considering that Indians typically have to wait anywhere from 15-20-50-150 years for the green card. Imagine being completely reliant on your spouse on a foreign country with absolutely no support. I wouldn't want to be in that situation, I don't want my wife to be in that either. One can never know when a person will change.

>Sharing her experience while interacting with the victims of domestic violence, Peshawaria said overarching their rather harrowing lives is the fear of social stigma that is particularly intense for the women who come from south Asia. More often than not, they have been told stories about how a wonderful life awaits them in America, the world's richest country, which would be a dramatic improvement for them compared to what they experience in India," she said.

[https://www.news18.com/news/india/indian-american-lawyer- aut...](https://www.news18.com/news/india/indian-american-lawyer-authors-book- on-domestic-violence-among-south-asians-in-us-1996111.html)

And reports like below makes me suspicious of how great the immigrant life is actually. I am not saying crimes/suicides don't happen in India, but its not that reassuring since I am not sure if its murder-suicide or if they were targeted.

* June 2019-Iowa family of four found dead with gunshot wounds: [https://www.nbcnews.com/news/crime-courts/iowa-family-four-f...](https://www.nbcnews.com/news/crime-courts/iowa-family-four-found-dead-gunshot-wounds-n1018081)

* May 2019-'Why haven't they found the killer yet?': Sikh family want answers in West Chester (quadruple) shooting: [https://www.cincinnati.com/story/news/2019/05/08/west-cheste...](https://www.cincinnati.com/story/news/2019/05/08/west-chester-sikh-family-shooting-ohio/1130155001/)

* February 2019-Friends reel from suspected murder-suicide death of Sugar Land, TX, couple: [https://www.newsindiatimes.com/friends-reel-from-suspected-m...](https://www.newsindiatimes.com/friends-reel-from-suspected-murder-suicide-death-of-sugar-land-tx-couple/)

<comment><USER4> As some one who returned from US, this is how I look at US/Outside India stay:

1\. Ensure you are rich/have lot of money.

2\. Ensure you are healthy.

Even if one doesn't apply to you, life can be hell outside India. This is to an extent you won't even get a shoulder to cry upon. A lot of people think they have a social structure in the US, until they have call upon on in the times of emergencies, and realize they have none. A lot of this depends on a major disease never touching you, and having life long 20% YoY career growth. You have to be lucky beyond belief to fit into this definition, this is regardless of how hard you can or are working.

The problem with this luck game is, no one is lucky enough to be lucky forever. Most people who settle in the US are really having tons of luck going for them in early life. That's the good news. The bad news, is if you plan to toss a coin a billion times, and a straight 10K heads have shown up. Guess what a straight 10K tails are coming sooner or later.

Go figure.

<comment><USER9> Isn't there a burgeoning Indian community though ?

<comment><USER4> Most of it won't come to your help. You would be hard pressed to call upon a close friend.

In most cases its colleagues who graduate to being friends. But those generally wither away when you change companies. Others are made at community centers, they are mostly like frenemies.

If you plan to settle in the US, ensure you don't get poor and stay healthy.

</comment></comment></comment></comment></comment></comment><comment><USER2> Reason for storing financial data within the country is, because in India corruption rate is high and no.of tax paying citizens are very less.

Indeed it is important for us to store financial data within the country to stop non tax abiding citizens.

Money laundering is also a huge problem. Citizens were being educated, not to take cash in large amounts, for the same reason.

Even after demonetization, government was not able to get rid of black money.

Edit: grammar

<comment><USER10> How would requiring information be stored in the country prevent corruption?

Countries can already demand any business records of their citizens from a business as a condition of doing business in that country or citizens.

The US requires that any fin business that does business with US Citizens report to the United States government or be cut off from the US financial system. A lot of international banks responded by closing the accounts of Americans rather than deal with the costs of compliance.

<comment><USER6> I don't know much about this topic (finance). But since I see news reports regularly of Indians depositing black money in foreign banks, I am posting this. I am not really sure if this 'financial data must stay in India' requirement could solve the problem of black money.

>The total amount of black money deposited in foreign banks by Indians is unknown. Some reports claim a total of US$1.06 - $1.4 trillions is held illegally in Switzerland. Other reports, including those reported by the Swiss Bankers Association and the Government of Switzerland, claim these reports are false and fabricated, and the total amount held in all Swiss bank accounts by citizens of India is about US$2 billion. In March 2018, it was revealed that the amount of Indian black money currently present in Swiss and other offshore banks is estimated to be ₹90 lakh crores or US$1500 billion.

[https://en.wikipedia.org/wiki/Indian_black_money](https://en.wikipedia.org/wiki/Indian_black_money)

Getting Switzerland to release that information isn't that easy. I have been hearing about it for at least 5 years, may be more. Even 4 days ago, there were reports like this: [https://www.businesstoday.in/current/economy- politics/noose-...](https://www.businesstoday.in/current/economy- politics/noose-tightens-on-swiss-account-holders-details-of-at- least-50-indians-being-shared/story/356528.html)

</comment></comment></comment><comment><USER11> The efficacy of this as a deterrent seems to depend on the notion that India would like its citizens to be able to obtain H1 visas from the US.

Is that the case?

<comment><USER12> Yes and no.

Yes, because it directly affects the business of large outsourcing companies. It also drops remittances, one of the largest sources of dollars for India.

No, because for many decades, India has been trying to keep their smartest citizens to build their own country. Making local companies, serving at local hospitals, teaching at local schools and universities. They want their own Google, Microsoft, Sun Microsystems, Adobe instead of Indian citizens working in the US for US corporations. They were just unsuccessful for so many years because countries like US drained the well-educated so much.

Ultimately, this will be a great deal for India. India doesn't want remittances. They want their own companies to make software that the world wants to buy.

<comment><USER13> Help me understand the first part. Why do you need a US visa (well, THAT visa - I understand a 'fly over for a meeting' visiting visa) as an outsourcing company?

What I mean is: How are the outsourcing companies affected by this?

<comment><USER12> Its a business visa to allow exchange of ideas quicker, better.

Imagine GE, a company with a pool of power electronics talent in the US, wants to build specialized power plants for the Indian market. They can't do it remotely from the US. They will fly their US employees to India to study the market, understand rules and constraints, design and consult local Indian teams. The US employees need to stay there for years to build those things.

All that requires India to give US citizens the visa to work for such a long time. And India does give that. Business visas in India are easy to get.

Reverse the roles and if an Indian company wants to use their own pool of talent to do business in the US, H-1b are the only ones available for long term business related work, which got totally distorted by politics over the years.

[https://www.usa-corporate.com/start-us-company-non- resident/...](https://www.usa-corporate.com/start-us-company-non- resident/intro-us-business-visas/)

<comment><USER3> Then why doesn't India restrict inflow of US citizens in return?

</comment></comment></comment></comment></comment><comment><USER14> if free flow of data across countries helps in privacy then HIPAA should not have rule that healthcare data of US citizens need not be stored only in US. Will USGOV relax that norm ? the Indian govt rules are about storing financial data within the country and not gmail data.

<comment><USER15> There's so much wrong with this.

HIPAA doesn't talk about US citizens or distinguish different types of records based on any properties of the people that those records cover. The words citizen do not appear in HIPAA or HITECH. HIPAA applies to any records by covered entities, which is what it discusses, regardless of who those records refer to.

There is no requirement in HIPAA that PII must be stored in the US. This is such basic info it's in the HIPAA FAQ from HHS [https://www.hhs.gov/hipaa/for- professionals/special-topics/c...](https://www.hhs.gov/hipaa/for- professionals/special-topics/cloud-computing/index.html). Question 9 is unequivocal, you can store data outside of the US, but you need to think about any dangers or risks associated with this. Which is totally logical.

There are lots of reasons to have issues with the US. But not what you're talking about.

</comment></comment><comment><USER16> lol. If you don't change your data rules, we'll shoot ourselves in the foot by removing the cheap labor that we've become addicted to.

<comment><USER17> It would be a good thing in the long term. Too many programming jobs are taken up by things like this, especially jobs for fresh college grads. I wouldn't mind harsh limitations on all software offshoring/worker importing in general.

<comment><USER18> Right, because college grads in STEM fields are just really struggling to get good high paying jobs right now.

<comment><USER19> RAND corporation found that the H1B program reduced tech worker's salary by 9%.

</comment></comment></comment></comment><comment><USER20> The Problem is TRADE not H1B visas . ...

Simple example every Enterprise level company has IT department in US. the CTO or the VP of the company wants to save money by going to offshore business model ... so how does this work, let say an infrastructure IT support in company consists of ( storage, database, network , System admins etc say about 150 employees) then a new CTO or VP of IT comes in and he decides to go for offshore model then enters the cheap low tech incompetent service companies from Asia bids these projects here .. let say 200 Million dollars for 5 years 24/7 support .. so these Body shopping company decides to have about 60 employees offshore and 10 employees onshore here in USA using H1b visa ... now the CTO of the company feels happy for saving money and starts firing ..sorry (Let go) of those 150 citizens..... this happens in every company across this country i know because I've seen it All..

now those employees who given their flesh and blood to those projects over years gets emotionally raged...at the time of KT( knowledge transfer) to those H1B onshore slaves.. saying you guys are taking our jobs away. and all that BS. BUT they forget One big Logic/common sense..that they lost their jobs because satanic .. crooked CTO's or VP of IT of their own company and due to the company it self .... not because immigrant came over H1B visa..

Let say for the argument of emotional mob .. that the H1b is completely removed by some revolution...do you really think the jobs will come back hahaha... those body-shopping companies will be more happy because that will give them a chance to make more money.. they will make 100% offshore and then they wont even keep those 10 h1b resources onshore.. they will make a deal with those crooked CTOs to operate everything from offshore ...so the emotional mob will be still unemployed even after H1B is removed ..

the solution is the current administration should bring up the trade barriers a Bill to stop offshore business model completely which they wont do since this country is built and run by Rich CEOs.......

</comment><comment><USER21> _Pompeo said the Trump administration would push for free flow of data across borders, not just to help U.S. companies but also to secure consumers' privacy._

How does 'free flow of data across borders' help secure consumers' privacy?

Setting caps on H1Bs is the US governments prerogative though this will have adverse impact on US-India relationship.

<comment><USER12> > How does 'free flow of data across borders' help secure consumers' privacy?

This is not about consumer privacy. This is about corporate profit. Visa, Mastercard and other US banks want to maintain fewer datacenters around the world. They already have them in the US (because US law) and they possibly also feed that data to US govt.

With such localization laws, US corporations are having to invest in other countries. They are lobbying to bully other countries for profit and this administration is ready to support profits at any cost.

<comment><USER8> Maintaining foreign data centers isn't really an issue for large companies. All cloud providers already support various data residency and compliance requirements. Companies are happy to follow these laws if it means more business for them.

It is the US government which has a problem because it wants direct access to data from foreign countries & corporations. In fact Microsoft was involved in a very long legal battle with them over it - [https://en.wikipedia.org/wiki/Microsoft_Corp._v._United_Stat...](https://en.wikipedia.org/wiki/Microsoft_Corp._v._United_States).

</comment></comment></comment><comment><USER22> Instead of worrying about location of the servers, the real point should be which government should be in control of the data. Even if the data is located in India under US government pressure on a company, say for some investigation, the US would still be access the data; the companies can still sell the data to other US-based companies.

Or, is location being used metaphorically over here?

<comment><USER23> Perhaps. But you still have oversight and physical access. You could bug the servers. You could monitor their network and so on. Your courts could create orders against the data on your servers. Also it's very dangerous as we have seen to have all your citizen's data exposed as it could allow like a country to better socially engineer your public and determine outcomes of elections.

I would double down and say if you do that, I will ban all H1Bs from leaving the country. Let's see how Trump and Silicon Valley feels about that.

<comment><USER22> > You could bug the servers. You could monitor their network and so ... > determine outcomes of elections

This is again irrespective of the server's locations.

</comment></comment></comment><comment><USER24> More Americans travel to India on business than Indians seeking H1-Bs.

If the US wants to limit work visas to Indians, India should limit any work based travel of Americans to India.

<comment><USER25> This is a joke? You realize work visas are different from travel visas, right?

</comment></comment><comment><USER26> Bit of an empty threat. Probably hurts America more than India.

</comment><comment><USER23> If you don't let us steal all your user data, we won't brain drain your country. Sounds like a good deal for India other than the remittances sent back by citizens.

<comment><USER27> This was pretty much how I read it.

</comment></comment><comment><USER28> This is quite a silly threat as it would reduce brain drain. Cool, go ahead, keep smart Indians in India while also not spying on Indian citizens because their data is also kept in India. Win-win for India.</comment>


Unsecured MongoDB databases expose Kremlin's backdoor into Russian businesses - <AUTHOR> https://www.zdnet.com/article/unsecured-mongodb-databases-expose-kremlins-backdoor-into-russian-businesses/ <comment><AUTHOR> This here might be some of the laziest attribution work in the history of the internet, really makes you question the sanity of the author.</comment>


GnuTLS considered harmful (2008) - <AUTHOR> http://www.openldap.org/lists/openldap-devel/200802/msg00072.html <comment><USER3> The annoying thing about GnuTLS is that it normally might not be very widely used, except that the Debian project initiated a huge push to make software linkable with GnuTLS instead of OpenSSL, because of issues with the OpenSSL license[1]. So if you're a Debian or Ubuntu user, you're probably relying on GnuTLS a lot more than users of any other distribution, or people who compile the upstream sources themselves. (Not that OpenSSL is a panacea, but at least it gets more attention than GnuTLS).

[1] The OpenSSL license is incompatible with the GPL, making it technically illegal to distribute binaries of GPL programs linked with OpenSSL (so Debian refuses to do so), unless the GPL program has an OpenSSL license exception.

<comment><USER4> The irony of what's happening here, that dogmatism about a belief is causing an inferior solution to be used, is infuriating and one of the reasons people have such a problem with dogmatic personalities like rms. It's technically illegal to use a better solution because of something as relatively unimportant as a license. Think of it like a Maslov's hierarchy - <USER2> strong security is _way_ more important to most people than having a proper copyleft license. But instead of being pragmatic, we're stuck with a ridiculously dogmatic solution that ends up harming way more than the ill it was trying to cure.

It reminds me a lot of environmentalists going crazy to ban nuclear power in the 70s before we had as clear a grasp on the impact of dumping carbon dioxide into the air.

<comment><USER5> > The irony of what's happening here, that dogmatism about a belief is causing > an inferior solution to be used, is infuriating and one of the reasons > people have such a problem with dogmatic personalities like rms. It's > technically illegal to use a better solution because of something as > relatively unimportant as a license.

Why do you jump to blame the GPL and rms, when one could just as easily fault the OpenSSL authors for using the 4-clause BSD instead of the _far_ more common 3-clause?

> It's technically illegal to use a better solution because of something as > relatively unimportant as a license.

No, it is technically illegal to distribute compiled binaries that use OpenSSL, because the OpenSSL authors wanted to retain the advertising privileges. But it is not illegal to _use_ the software as long as it is distributed in source and compiled by the end user.

I would not call licensing unimportant. As long as software is copyrightable, licensing terms are _highly_ important.

<comment><USER6> The reason the GPL is annoying is that free license with an advertizing clause have existed for a very long time and are actually widely used. A quick look at the about box of various software will usually show you a long list of mandatory acknowledgements for various open source licenses.

The problem is that the GPL willingly refuses to permit advertizing clauses. Is there a congent argument about why an advertizing clause is a limitation of freedom? The GPL is more often than other free licenses putting restirctions on usage of diversely licensed software. It is an impediment. And, as we see, it has real-world consequences. There is more risk for freedom using bad software security than wielding to innocuous clauses.

<comment><USER5> > The problem is that the GPL willingly refuses to permit advertizing clauses. > Is there a congent argument about why an advertizing clause is a limitation > of freedom

The advertising clause is not a limitation on freedom. The 4-clause BSD license is a free software license; it just happens not to be compatible with the GPL (not all free software licenses are).

The reasons for this are very practical: not only does it place additional restrictions on the software (which is not permitted by the GPL), but if multiple 4-clause BSD projects are used, each project requires its own separate advertising statement (the 4-clause license does not permit combining these into a single sentence): [https://www.gnu.org/philosophy/bsd.html](https://www.gnu.org/philosophy/bsd.html)

> The reason the GPL is annoying is that free license with an advertizing > clause have existed for a very long time and are actually widely used.

Most modern projects using permissive licenses use 3-clause BSD, MIT/X11, or Apache, all of which are compatible with the GPL. In this day and age, choosing a 4-clause BSD license is a fairly conscious decision to make the project incompatible with the GPL.

<comment><USER7> Choosing the 4-clause BSD license is a conscious decision to continue to receive credit for all your hard work, when a proprietary software company comes along and includes your code in their product. To me this is a fair compromise for proprietary companies who refuse to open up their source code (i.e., would never touch GPL at all).

<comment><USER5> As I mention in a reply to the sibling comment, I don't fault the developer for choosing a free software license that suits their purposes. I just don't think it's fair to blame the _GPL_ for the incompatibility that happens when a developer chooses a 4-clause BSD license.

(Also, remember that the developer could always dual-license - ie, "GPL or 4-clause BSD - if you want to use my software in proprietary code, then you have to advertise me").

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> It's a shame this is being upvoted so highly when it's factually incorrect. A rebuttal can be found here: [http://nmav.gnutls.org/2011/05/is-really-gnutls- considered-h...](http://nmav.gnutls.org/2011/05/is-really-gnutls-considered- harmful.html)

It's rather silly that the news of a critical bug in GnuTLS that was caused by a goto somehow makes non-news and factually wrong information from 5 years ago popular.

<comment><USER9> I was a bit curious about this quote:

" _It turns out that their corresponding set_subject_alt_name() API only takes a char \_ pointer as input, without a corresponding length. As such, this API will only work for string-form alternative names, and will typically break with IP addresses and other alternatives. _"

Yes, an API designed for strings will break if you pass it a struct in_addr _ or something, but it should be fine with a dotted-decimal string, right?

<comment><USER10> The issue is that they designed a API taking a NUL terminated string in the first place, as it should have been something more generic. They knew little enough of X.509 they didn't bother to handle every cases.

My understanding of RFC 3280 is pretty old, but the relevant ASN.1 type describing a subjectAltName seems to be :

SubjectAltName ::= GeneralNames

GeneralNames ::= SEQUENCE SIZE (1..MAX) OF GeneralName

GeneralName ::= CHOICE { otherName [0] AnotherName, rfc822Name [1] IA5String, dNSName [2] IA5String, x400Address [3] ORAddress, directoryName [4] Name, ediPartyName [5] EDIPartyName, uniformResourceIdentifier [6] IA5String, iPAddress [7] OCTET STRING, registeredID [8] OBJECT IDENTIFIER }

The IP address case is represented as an octet string, and the octet 0 is legitimate, making their API broken...

<comment><USER9> That's the X.509 certificate format, right? It's not a code interface.

My point was that it's not reasonable to expect an interface that appears to be accepting a string to also accept random bytes; "10.0.0.8" isn't the same as 0x0a000008.

</comment></comment></comment></comment><comment><USER11> Money quote from the message thread: "I can't even find the words to express how gross this is." ([http://www.openldap.org/lists/openldap- devel/200802/msg00100...](http://www.openldap.org/lists/openldap- devel/200802/msg00100.html)) Interestingly, the conversation stays somewhat civil even after that quote, looks like professionals at work :)

<comment><USER12> The quote seems to simply be complaining about the repeated use of the subexpression "strlen(str)", by implication because it's needless and inefficient.

Except that it's not. At least on glibc, strlen() is declared "pure" to the compiler and (unless otherwise defeated by pointer aliasing) repeated calls will be optimized away.

That's not to say that this is the best way to write the code, but the concern seems poorly informed.

<comment><USER13> It's not an efficiency concern, it's a security concern.

<comment><USER12> Common subexpression elimination isn't normally considered a security technique, so I guess I don't understand your point.

Maybe you're saying it's a "code smell" kind of thing and that being sloppy here indicates more subtle problems elsewhere? Which then hits the argument about whether this is really "sloppy" or just intentionally simple.

Shrug. My point was just that this needs better evidence. There is no demonstrated bug in the linked code, and the assertion that it is "gross" (OP) or "insecure" (you) seems poorly justified.

<comment><USER11> The basic concern is that strlen() shouldn't be used at all on the data that's passed to the given function since that data may be binary and not - as the function assumes - null-terminated string. The code is "sloppy" and the complete certificate handling seems to be sloppy. I don't want to be the judge of that, but if you read the whole post and the ensuing thread, the argument is made quite well and convincingly. And seriously, the last place I'd like to see a sloppy implementation that assumes that the given data is benevolent and does not contain a malicious payload is - guess what - a TLS library.

<comment><USER14> There's only so much an API can do with garbage input. If this function took a pointer and a length, that's not a magic fix, you could still pass it a bad pointer and/or a bad length..

<comment><USER11> The problem here is that binary input is valid according to the spec [1]. It's not malicious input in the sense that a programmer is using an interface deliberately wrong but rather in the sense that a counterparty could send you a non-garbage certificate that contains that data - which would be valid, but still break this code. That's not comparable to passing a bad pointer or a bad length.

[1] at least according to the post. The fact that gnutls added a binary interface later seems to support that reading.

<comment><USER14> Yes, the spec says the field can be string or binary. The API only handles string fields. The API should be (and was) updated with a function that handles binary fields, but there's nothing wrong with the original function.

If this was C++, and the function took a std::string, would you say it was horribly broken because you serialized a 4 byte IP address into a 4 byte std::string buffer and the function didn't handle it correctly?

<comment><USER11> Seriously, if the function deals with untrusted user input and pretends to conform to a spec, weasel wording around by saying that the function does only partially conform to the spec and will blow up in the users face when passed other, spec compliant input and then deferring all responsibility to the user, yes, that counts as horribly broken in my books (even though you were the one to introduce those words). That's what we have libraries for, so that me and you don't have to deal with this mess that x509 cert parsing is - I've seen enough of it that I know I don't want to go down this particular hell hole - and I've just been standing at the sideline and watching others wrestle with it.

<comment><USER14> functions don't conform to specs, the API and library as a whole should conform to the spec. It's perfectly valid to have one function that supports strings and another function that supports binary data.

<comment><USER15> Did they have such a pair of functions?

<comment><USER14> They do now, and the first one is still using strlen(). Does the existence of the second function mean it's now ok for the first to use strlen()? You can still crash the program if you send binary data to the string function instead of the binary function..

<comment><USER16> So essentially it's an issue with C being weakly typed?

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER17> No matter how you look at it, C is the wrong choice for security relevant systems software. But where is the alternative?

<comment><USER18> Actually C is an excellent choice for security relevant systems software because the issues for developing in C are well understood and can easily be mitigated by following 30 years worth of best practice patterns and using the correct development tools.

The issue is developers are not using the tools or following the best practices because they think they know better than 30 years worth of experience or get caught up in bikeshedding about ideology, licenses and which line the curly braces go on.

<comment><USER19> Can you link to the 30 years of best practice document, I must have missed it.

<comment><USER18> A good place to start:

[http://www.amazon.com/The-CERT-Secure-Coding- Standard/dp/032...](http://www.amazon.com/The-CERT-Secure-Coding- Standard/dp/0321563212/)

Online:

[https://www.securecoding.cert.org/confluence/display/seccode...](https://www.securecoding.cert.org/confluence/display/seccode/CERT+C+Coding+Standard)

Others:

[http://www.amazon.com/Secure-Coding-Edition-Software- Enginee...](http://www.amazon.com/Secure-Coding-Edition-Software- Engineering/dp/0321822137/)

[http://www.amazon.com/Style-Guidelines-Programming- Professio...](http://www.amazon.com/Style-Guidelines-Programming-Professional- Programmers/dp/0131168983/)

[http://www.amazon.com/C-Traps-Pitfalls-Andrew- Koenig/dp/0201...](http://www.amazon.com/C-Traps-Pitfalls-Andrew- Koenig/dp/0201179288/)

<comment><USER20> Another good read _(it probably does not reflect how you want to write C code, the rule about dynammic allocation is probably extreme if you are not writing code to fly spaceships, but I think it is good to read regardless)_ : [http://lars-lab.jpl.nasa.gov/JPL_Coding_Standard_C.pdf](http://lars- lab.jpl.nasa.gov/JPL_Coding_Standard_C.pdf)

</comment></comment></comment></comment></comment><comment><USER21> Any updates to this 6-year old post? I would hope that, with systems like Debian forcing a move to GnuTLS from OpenSSL (for licensing reasons), it would have since received more care.

</comment><comment><USER22> I really don't see the Point of GnuTLS. Sure, if you want to directly integrate OpenSSL with GPL code, you can't, but as it's a library, you should be using it normally anyway. OpenSSL is far more widely used, has a longer history, and I would say is better tested and understood.

</comment><comment><USER7> For the morbidly curious, ITS#5361 which triggered the above email: [http://www.openldap.org/its/index.cgi/Incoming?id=5361](http://www.openldap.org/its/index.cgi/Incoming?id=5361)

<comment><USER7> Other gems - ITS#5991 [http://www.openldap.org/its/index.cgi/Software%20Bugs?id=599...](http://www.openldap.org/its/index.cgi/Software%20Bugs?id=5991) which required us to hack up a workaround. It also triggered ITS #5992 [http://www.openldap.org/its/index.cgi/Software%20Bugs?id=599...](http://www.openldap.org/its/index.cgi/Software%20Bugs?id=5992)

Discussion of the GnuTLS bug is summarized here [https://www.debian- administration.org/users/dkg/weblog/42](https://www.debian- administration.org/users/dkg/weblog/42)

And people still wonder that GnuTLS certificate verification bugs continue to surface?

</comment></comment><comment><USER23> Fixing the strlen()s is easy but the binary stuff is harder. Assuming it hasn't already been done.

<comment><USER7> If you're focusing on the strlen() you're missing the forest for the trees. The problem is someone who knew nothing about security or good programming practices decided to write a security library and somehow convinced the community at large to trust his code. Everyone's a beginner at some point but no sane person trusts their system security to code written by someone so demonstrably incompetent, and no honest beginner would attempt such an undertaking and then advertise it as production-ready or secure.

The fact that there are still certificate validation bugs in GnuTLS today indicates that the GnuTLS developers still haven't learned the essentials of X.509 certificates. Even with a rapidly deployed fix for this most recent CVE, you'd be a fool to rely on GnuTLS for anything. The code and the developers have proven themselves not to be trustworthy. Multiple times.</comment></comment>


Signpost Raises $10M To Bring Online Marketing Tools To Small Businesses - <AUTHOR> http://techcrunch.com/2013/11/19/signpost-series-b/

<comment><USER2> Well they have over 10,000 customers, so they must be doing something right.</comment>


Globally, Almost Four Out of Ten Music Consumers Are Pirates - <AUTHOR> https://torrentfreak.com/globally-almost-four-out-of-ten-music-consumers-are-pirates-181010/ <comment><USER3> I'm another non-streamer and I get most of my music from Bandcamp. The appeal to me is a lot of smaller labels and artists are on a more level playing field, I know more money goes to the artists, and the merch selection is great.

I'm of an era that I remember CD albums would cost 15-20GBP sometimes, and I'm still very album-oriented in my listening. My 'thing' these days is buying digital copies of releases I like, and buying a vinyl copy of releases I _really_ like, so I have a memento. The shipping costs can be steep, especially trans-Atlantic, but the tangible collection of records in a flight case is the closest thing to a safe of valuables that I own.

Buy the vinyl, and typically there's an included copy of the digital version (either a code in the sleeve or a gratis copy in Bandcamp's case), so I can then download the FLAC and make whatever format I want from there. Total price typically ends up being more expensive than one of those 15-20GBP CDs from a bygone era, but I've got a digital copy I can play over and over, and a physical copy as a keepsake.

I've found a lot of new music from Bandcamp. Their articles are high quality, and have directed me toward all kinds of music I wouldn't usually listen to.

(Disclaimer: active customer of Bandcamp, not connected in any financial or professional sense, no other affiliation…though I do think about applying to work with them from time to time.)

Edit: I use the same username here as I do on Bandcamp if anyone wants to snoop on my collection and/or wantlist, or be internet friends etc.

<comment><USER4> Bandcamp is my preferred way of buying music these days. The only advantage of physival media is the record cover. But I am really pissed if I can't download the album or if I am just able to download a shitty MP3 of the music I've bought.

So Bandcamp works great for me. It offers all the options I want (FLAC) and I like that a band can set the price to 0$ so you can download it from Bandcamp for free but you can give them money if you want to. Awesome experience all around. And with the music I like most of the bands are on Bandcamp.

<comment><USER5> What do you find so shitty about MP3, are you morally opposed to it's origin/licensing?

Quality wise for listening you aren't going to tell the difference between a -v0 MP3 and FLAC even if you think otherwise. For anyone that wants to claim otherwise, unless you've had someone setup an A/B test with a significant amount of cases you're falling victim to placebo.

I say this as a professional audio engineer, who long ago would always seek out FLAC. Now, unless I need to edit or re-encode a file the MP3 is just as good, far from shitty.

<comment><USER6> "Placebo" describes the audio scene people pretty well in my experience.

I did that MP3/FLAC A/B/X test back in my audio engineer days after catching a ton of condescending comments due to my listening of 'terrible sounding' MP3s.

Either my ears are garbage, or the difference is so subtle that even with solid headphones in a dead quiet room, the absolute best you could hope to be able to detect is that one is "different." getting all the way to "shitty" sounds near impossible to me.

Also, to my surprise, if you burned someone a cd from an MP3 source, but told the person it was Flac, it'd still "sound really smooth". Hm.

<comment><USER7> I was of the same opinion - but I've recently noticed (because youtube-dl, I think, automatically downloads music at a fairly high quality) that I enjoy some music substantially more when it's not compressed to hell. Classical music especially seems much juicier with a high quality recording.

<comment><USER8> What do you mean by compressed? Classical music is usually cited with regards to "compression" in the context of dynamic range compression, not data compression.

</comment></comment></comment></comment></comment></comment><comment><USER9> ...and yet music industry revenues are on the up again.

If you can't get something legally - because you actually can't, or because you can't afford it, it's a 'victimless crime' and you desperately want it - you'll pirate it. But I think most people are happy to pay for the convenience of everything. £10 a month for Spotify is a no brainer for me. The problem happens when (label?) greed sinks in again and the streaming services fragment with 'exclusives' on each. At that point, people end up picking one to spend their cash on, and they'll pirate or stream a shitty version on YouTube the songs they can't get on their streaming service.

You want to get more people to pay? Licence everything to everything - <USER2> the only people that will pirate are the ones that would never pay anyway. And I bet they're a smaller subset than four in ten.

<comment><USER10> Taking advantage of something someone created on terms different than what they're willing to offer it to you is not a "victimless crime." (Just like jumping the turnstile in the subway is not a victimless crime even if there are free seats, or sneaking into a sports stadium.) At the margin it lowers the price everyone is willing to pay for the item.

As to music industry revenues--they're basically flat over the last 20 years: [https://www.bing.com/images/search?view=detailV2&ccid=9McmTl...](https://www.bing.com/images/search?view=detailV2&ccid=9McmTlgO&id=4FFA946CAF1E5956E231B9C6EDBD7BAE1AEAF226&thid=OIP.9McmTlgOBg- jerMtOi-41gHaD9&mediaurl=http%3a%2f%2fwww.digitalmusicnews.com%2fwp- content%2fuploads%2f2017%2f04%2fIFPI_global_full.jpg&exph=504&expw=943&q=music+industry+revenues&simid=608016356439820520&selectedIndex=3&ajaxhist=0). Which is crazy, because the number of new consumers that can afford their product is through the roof.

People treat piracy as a victimless crime because the marginal cost of each item is zero. Imagine extending similar logic to a handbag. If you steal an LV purse you can't afford, how do you measure damages? The $1,000 marginal cost to physically replicate the purse, or the $10,000 retail price? That basic logic doesn't change as the marginal cost goes to zero.

The moral rationalizations don't really hold water. It's not like the music industry is out there lobbying to prevent competing content. Their whole business model is creating content that's _so desirable_ that they are non- fungible--people won't settle for a slightly different clone. Advances in digital technology have made it so the cost to create content is lower than ever. But people don't want just any superhero movie, want to see Wonder Woman or the Avengers: Infinity War.

<comment><USER11> The music labels who decide the terms of sale didn't create the music. They're rent seeking corporations who seek to increase their profits in any way possible and bribe politicians to create artificial barriers through which they can create toll gates.

And their control is expanding. Older works that should (by historical precedent) be part of the commons remain copyrighted because of endless extensions. Practices that were once legal and common become illegal (like copying tapes vs copying CDs) or technically difficult (like recording music off the radio vs recording music off the Internet).

Fighting back and "lowering the price everyone is willing to pay" doesn't sound like a bad thing to me.

<comment><USER10> The legitimate way to lower prices in a market is to create a competing product and sell it for less money, not interfere with a creator's rights to sell their product on their terms. The music industry isn't "brib[ing] politicians" to "create artificial barriers" to people creating competing content. Indeed, it's easier than ever to compete with the record labels. Sites like YouTube offer vast opportunities for creating and distributing indie content. The only reason the record labels make any money at all is that they make content people _want more_ than the indie content they could get elsewhere for cheaper.

<comment><USER11> Copyright is itself an artificial barrier, as is copy protection and laws like the DMCA that make copy protection a legal as well as technical barrier.

I respect your right to your opinion that poor people should be prevented from hearing or seeing something entertaining because a corporation wants more money (it's rarely the creator who makes these decisions), but that's not the only legitimate opinion.

Copyright isn't a law handed down by God; it's a fairly new legal creation on the scale of human history and its constant expansion is a major factor behind increasing inequality in the world.

<comment><USER10> > Copyright is itself an artificial barrier, as is copy protection and laws > like the DMCA that make copy protection a legal as well as technical > barrier.

Yes, copyright is an artificial barrier, but a barrier to what? It's not a barrier to fair competition. It's a barrier to circumventing a creators right to bargain about the price of her creation.

Copyright itself isn't "handed down by God," but the idea that people should own the fruits of their own labor is an old one. That's all copyright is.

<comment><USER12> Copyright wasn't created to protect the fruits of the creators labor, though.

The origin of copyright was providing monopoly rights to the Stationers Guild in Britain to control printing of works under the Licensing of the Press Act 1662. So a right vested in the printers who wanted to be able to sell for much higher prices than the duplication itself justified, not the authors.

Of course this would also allow them to pay more to authors, because they would be able to amortise it over more copies, but the guild had a monopoly on printing, so it was not in any of their interests to substantially increase the proportion paid to authors - the main benefit of this monopoly was to themselves.

When parliament refused to renew it after protests because of the censorship it authorised, the Stationers Guild kept trying to push for it to be reintroduced, and first then started pushing the "authors rights" angle, leading to the Statue of Anne (Copyright Act 1710), which was the first "modern" copyright act in that it vested rights in authors.

But the idea of restricting the ability to copy to favour the _creators_ of a work was something the printers first started pushing for their own interest because their abuse of the copyrights previously granted to them directly made it unpalatable to re-authorise those rights.

<comment><USER11> And extending the copyright on works whose creators are long dead doesn't do anything for the creators.

If copyright law wasn't serving the interests of Disney, Sony, and other big corporations, they'd be pressuring politicians to change it, rather than expand it to other countries.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER13> I am not surprised, considering that pirating songs is still the most hassle free way to listen to music, especially down here in India. Spotify isn't available due to label issues and local streaming services don't have a good selection of non-bollywood music. Now that physical media cannot be used anywhere in laptops or mobiles and youtube cannot be minimized on mobiles, the best and easy way to get music, especially western music is to pirate mp3 files and share it on usb sticks and sd cards.

<comment><USER14> Just out of curiosity;

Why is it not possible to buy mp3s? Amazon, play store, iTunes etc. all use no DRM to my knowledge? Or is it just a question of price?

<comment><USER15> "Why is it not possible to buy mp3s? Amazon, play store, iTunes etc. all use no DRM to my knowledge? Or is it just a question of price?"

I was going to ask the same thing - specifically about Amazon, which sells non-DRM, standard mp3s - but it occurs to me this might only be in the United States.

What does mp3 purchasing from Amazon look like from other countries ? Just a vastly different catalog ? The same catalog but with DRM files ?

<comment><USER16> > What does mp3 purchasing from Amazon look like from other countries ? Just a > vastly different catalog ? The same catalog but with DRM files ?

For Finland and most other countries, it is not possible to purchase digital music (or movies/shows, for that matter) from Amazon.

If I try to purchase an MP3 from the US site (amazon.com), I get "We were unable to process your order with the current payment information. Please click 'Continue' to select a default payment method and 1-Click address."

Clicking "Continue" just gets me back to the item page, so even the error messaging is broken. OTOH Amazon Video has a proper error message about needing a US payment method.

Amazon does offer the Amazon Music Unlimited subscription service here, though, and I believe it has a catalog comparable to other services (but I'm not a user).

</comment></comment></comment></comment><comment><USER17> That's way down from when 10/10 music consumers were pirates, just trading songs with each other around campfires and town squares without deep thought paid to credit.

Seriously, exclusive rights to music creation and reproduction are a pretty new thing; I think humanity will survive this "recent" trend.

<comment><USER18> > Seriously, exclusive rights to music creation and reproduction are a pretty > new thing; I think humanity will survive this "recent" trend.

I mean, by that standard, the entire legal system, not to mention having state police departments vs random mob justice, are also pretty new things. Do you think that we can do away with those too cause they're new?

Do you give any credence to the idea that part of the reason the last few hundred years have been incredibly productive for humanity (both in terms of general economic welfare, but also art), is partly because of things like the patent/IP system? I'd be happy to know why not, if not.

<comment><USER17> Legal systems are basically as old as, depending on how you slice it, writing. If you mean a specific US-centric model of a legal system, it dates back about a thousand years or so.

Copyright dates back to about the invention of the printing press, so about 600 years old. Common law has a good 400 years on that (and law itself, a couple thousand years on common law). Copyright is a baby by comparison. And given that it was functionally co-birthed with the printing press (since before that time, every copy was a blessing---a work of hand-crafted art someone had bothered to invest substantive human toil into because they thought a thing deserved to be recorded in more than one place), I don't think I have the tools to divide the benefits to society of copyright law from the benefits to society of mass, cheap reproduction of writeable concepts. It may have helped. It probably helped more in some spaces than in others. But by- and-large, it provided a system for a person to go live the "life of the mind" and exchange art for money instead of something else, and it's unclear to me that copyright did more than, say, the patronage system to that end.

... all of which is divorceable from the concept of, God help us, exclusive rights to perform a work, which is the weird space music lives in. Because we don't even charge by the written copy there; we often charge (to the best of the ability of the copyright holder) for every instance of "reading" the record and re-broadcasting it into someone's ears.

Yes, I think one can build a case that the cost of upkeep, overhead, tracking, and maintenance to move money around in that system offsets the benefit to society. I think it's incumbent upon the rent-holders and copyright owners to explain how, absent their Byzantine system of moving money around, our public spaces would be silent and dead, devoid of creative works.

The history of humanity and our simple desire to sing makes that strike me as profoundly unlikely.

<comment><USER18> > But by-and-large, it provided a system for a person to go live the "life of > the mind" and exchange art for money instead of something else, and it's > unclear to me that copyright did more than, say, the patronage system to > that end. There are problems with the patronage system. For example, almost > all the people who could live the "life of the mind" were either the > privileged few, or the people who appealed the to the privileged. While this > certainly is one way to fund works, and I'm a huge fan of Patreon, as well > as a Patron of many people, it's also going to only hit a subset of the kind > of art we care about, and a very specific subset too (things that interest > rich first-worlders that are economically better to target.)

> I think it's incumbent upon the rent-holders and copyright owners to explain > how, absent their Byzantine system of moving money around, our public spaces > would be silent and dead, devoid of creative works.

The history of humanity and our simple desire to sing makes that strike me as profoundly unlikely.

I don't think anyone seriously makes that claim (or at least, I don't). I think my claims were:

1\. On a practical level, this is economics 101 - if we up the reward for creative works, we'll get more creative works.

2\. On a moral level, as long as we are in this capitalistic system, I think that one person creating value should have the same reward as another person creating value, and just because one happens to be easily copied and one doesn't, shouldn't make a difference. I can't find a moral reason to say to someone that, should they choose to become an author instead of building furniture, and should they happen to create works that please millions, they shouldn't get rewarded for that.

You make it seem like the rent-holders and copyright owners have never explained why they want the system - but these things have been discussed since the dawn of the IP system. For one thing, have you talked to authors/musicians/etc and asked their views?

I particularly remember reading a British parliament member talking a lot about this issue, including the problems with patronage and the problem with pirating - in the 1800s!

<comment><USER17> The musicians I've talked to find the current system really inconvenient and spend a lot more time arguing with the payment collection organizations then they would like to.

</comment></comment></comment></comment></comment><comment><USER19> I like owning my media. The idea that I can pay Amazon/Apple/Google for a piece of media and they can subsequently yank it out of my library down the line because _they_ lost their license to distribute it does not sit well with me. I imagine it doesn't sit well with alot of people, either.

Until the dominant form of distribution allows people to OWN their music, I believe that piracy will persist.

<comment><USER20> Why do you feel a strong desire for ownership?

I enjoy going to art museums and experiencing visual art, but I never experienced the inclination to purchase any of it. Music to me is a lot like that.

<comment><USER21> > Why do you feel a strong desire for ownership?

Because I don't trust the owners of the content to not destroy[1] or permanently alter[2] it in some way.

Mass distribution is necessary for preservation.

[1] 1937 Fox vault fire. 1965 MGM vault fire. BBC TV programs 1967-1978.

[2] The OCN of all three original Star Wars films.

<comment><USER22> Original Camera Negatives(OCN) - Google made that immensely difficult to look up due to it thinking it actually knew what I desired to search for.

</comment></comment></comment></comment><comment><USER23> I am of a strong opinion that piracy is about access rather than stealing.

Piracy for the most part is used by 2 types of people :

1\. Those who would never have bought the product because of lack of income to do so.

2\. Those who find the product to hard to access.

Steam is an excellent example of dealing with both. Steam sales and location specific prices solve problem 1. Everything one platform everywhere in the world solves 2.

<comment><USER24> Just thinking out loud here, but, how long until Steam starts offering a Music service?

Maybe not for big labels/artists, but if they did something like Greenlight for indie bands... I could see it working... Maybe.

Or am I way off here?

<comment><USER25> I'd just as soon use Bandcamp honestly. Steam's attempts at media sales have been awful. Videos are broken and often won't play, music is usually just a handful of MP3s buried deep in the Steam folders.

<comment><USER24> Good point.

It never even occurred to me that they would sell music so no wonder they are bad a it, at least for now.

</comment></comment></comment></comment><comment><USER26> Somehow I don't like the "rental model" for songs and books that one may enjoy multiple times in one's life (compared to movies that are usually more ephemeral, and there may not be many that one would want to watch multiple times). So "owning" — the rights to copy and play the music anywhere, anytime and on any device — seems like a better choice than supporting streaming services where you can't really say if you'd be able to listen to your favorite song tomorrow.

<comment><USER27> I feel similar for music I actually care about. That said, I'm coming from a place where I already had a large collection of music ripped from CDs I bought (plus from the early days of Napster mostly to replace music I had on vinyl). And TBH I mostly don't care that much about new music.

I still buy some music even though I subscribe to Apple Music.

But if I were coming from a place where I was starting out and owned no music, I might think differently.

</comment></comment><comment><USER28> I absolutely used to pirate all my music. Then Spotify came along.

Pandora first, but I can't remember if I had completely stopped using mp3 at that point. I maybe had an iPod full of music I didn't pay for. Can't really remember the timelines here.

Either way, just like with movie and TV, I'll happily pay for streaming if the selection is there.

<comment><USER29> _"Your typical architecture astronaut will take a fact like "Napster is a peer-to-peer service for downloading music" and ignore everything but the architecture, thinking it's interesting because it's peer to peer, completely missing the point that it's interesting because you can type the name of a song and listen to it right away._

...

 _"Talk about missing the point. If Napster wasn't peer-to-peer but it did let you type the name of a song and then listen to it, it would have been just as popular."_

—Joel Spolsky, "Don't Let Architecture Astronauts Scare You," 2001

[https://www.joelonsoftware.com/2001/04/21/dont-let- architect...](https://www.joelonsoftware.com/2001/04/21/dont-let-architecture- astronauts-scare-you/)

———

In the last 17 years, that quote keeps popping up because the companies that focus on letting you type the name of a song and listen to it _right away_ have made money, while those that introduce friction to support some label's business model? Not so much.

But they keep complaining about "piracy." 90% of piracy is eliminating friction.

This past weekend, I bought the new Doctor Who on iTunes. I paid because Apple gave me a lot of ways to type the name of the show and watch it right away. Same reason I've spent thousands on music with them.

It's not about the price, it's about the convenience.

<comment><USER30> It is also about price though. I'd "rent" a lot more movies online if the price were the same as when I rented them on DVD, like fifty cents per day. However it costs like four Euros to stream a movie from Prime Video.

<comment><USER31> Where were you renting DVDs for 50 cents a day? That seems really cheap.

<comment><USER32> There are places in the US where you can still rent DVDs for a dollar a day. Streaming _rental_ prices feel too high.

</comment></comment></comment></comment></comment><comment> mellow-lake-day I'm gonna go out on a limb here and say part of the problem is that streaming services are not available in all countries and if they are the price is not adjusted for the income level in that country.

For instance Spotify is not available in many countries including Ukraine and India. The latter having a population of 1.3 billion people. GPM and Apple Music are better in that regard but nevertheless.

<comment><USER33> As a "sane" person from a civilized country, I don't have an online payment account. I couldn't transmit my money to spotify even if I wanted to.

That being said, I also like owning my music. As files. On my own devices. Running "fair trade" operating systems that let me do that.

<comment><USER34> I don't see what's "fair trade" about enjoying the fruits of others' labour for free.

<comment><USER35> Indeed—but the labour we're talking about here, the kind regulated by copyright, is the _distribution_ of the files; and it's the labels and artists who are employing the force of the State to enjoy the fruits of that labour _performed by others_ for free, having given up on charging a fair rate _once_ and _up front_ for the actual labour of producing the content in favor of a more lucrative, albeit less moral, business model.

If you create something that can be copied endlessly at near-zero cost, and you don't want others enjoying it "for free", then you need to charge an appropriate price for the initial publication. You have every right to keep it to yourself, and to charge whatever price you deem fair in exchange for the service of revealing it to others, but once you've done that it's rightfully out of your hands.

<comment><USER33> Interesting writeup. Another aspect to the same thing is why I should pay for knowledge? It wants to be free, this way I don't need to commit self-torture wrt educational funding. I seriously doubt I could have paid for the expertise that made and is making my career much beyond food and rent at the time when I decided to base it on FLOSS...

</comment></comment></comment></comment></comment><comment><USER36> I for one, love to get drunk on rum and pillage coastvillages Arrrr gimme them shiny discs ye landscruffy or we will keelhaul ye arrrr

In all seriousness, i like to own my music and i love bandcamp. I'm pretty poor so yeah a large part of my collection is stolen from the shores of india. But just like books, when i have some extra money i will buy from artists who i love listening too. If i was rich i would buy everything, but i am not and i still want to listen too music.

</comment><comment><USER37> Right now I'm spending a week at Taizé, a retreat centre in France. There's access to Internet only from 9:30 am - 8 pm, for 15 minutes at a time, then a forced 10 minute break (unless I change MAC address).

I don't have a bank account here, so I can't pay for a 2 year subscription for 4G. I also don't have a job. I'm grateful for my offline music collection keeping me alive right now. Music is especially important when times are tough, and it's in those difficult times that money and subscription-level stability are hard to find.

<comment><USER38> Prepaid SIM card?

</comment></comment><comment><USER39> Streaming services are nice, but I haven't yet found one that contains the complete discography that is available through torrents and other means. What's worse, what's available changes often so songs that are available now may not be available next week. In other words, streaming services provide a service, but they are far from replacing other means. If a service popped up that provided streaming of all the music I wanted to listen to 100% of the time, then it might be worth paying for. Another use case is mixing songs which usually requires local copies. Basically, all streaming services are deficient in some way so it shouldn't be any surprise that piracy continues.

</comment><comment><USER40> I find it impossible to pay any RIAA affiliated artist or label for music after the battles we had in the late 90s/early 00s. I pirate some music, but basically listen to audiobooks (which I happily pay for; I probably spend $1k/yr on Audible) instead of music 95% of the time. I basically view it as supporting terrorism, even though all of the individual execs from back then are gone by now.

</comment><comment><USER41> i'd be wary of anything the _IFPI, the International Federation of the Phonographic Industry_ present as fact.

Similar organisations were until recently engaged in shakedowns of small businesses for even playing the radio. Even after this was ruled illegal in Europe we used to still get a letter every year demanding we pay up for the benefits music was bringing our business.

</comment><comment><USER42> Personally, I pirate unless I can buy the music directly from the artist and download it in a lossless, DRM free format, using only open source software (or websites like Bandcamp). Maybe about 10% of my collection is paid for.

<comment><USER43> what does the open source thing has to do with artists being able to earn a living or not?

<comment><USER42> It's about establishing a mutually respectful relationship between the artist and consumer.

<comment><USER44> I think you unconditionally dictating all the terms is not respectful of the artist.

<comment><USER42> These are simple terms that serve to preserve the music. It serves the interests of a third party, not the musician or consumer, if these terms are not met.

<comment><USER45> I think it serves the artist if you buy the music, however you buy it, and it doesn't serve the artist if you pirate it.

Apply your logic to any other purchase and it falls on it feet. Do you only buy food direct from farmers? Clothes from factories? Do you only use supermarkets that use open source payment kiosks?

<comment><USER46> For what it's worth, even Richard Stallman condones the use of proprietary software on a device you don't control, like an ATM or a supermarket payment kiosk. This is not the same thing as being forced to run proprietary software on your personal computer.

</comment></comment></comment></comment></comment></comment></comment><comment><USER47> Market fragmentation causes some of this. I pay for a couple of streaming services, but occasionally rip an mp3 from YouTube for things I can't find. If there was a "pay and download mp3" button on YouTube, I'd probably pay.

<comment><USER48> According to numbers in the article, a minimum of 24% of music consumers pay for streaming services and also pirate music.

</comment></comment><comment><USER49> There are two things in this world that I have no problem with anyone in need stealing - food and music. I will politely look away. When I was a kid I pirated music, as well as music production software. I grew up pretty poor and I wouldn't have had those things otherwise (the only reason we had a computer was because of oil dividends given to all Alaskan residents once per year). I don't feel like anyone really lost out because of me downloading those things when I was young. But I know that the music industry eventually gained a lifetime subscriber (currently Apple Music, for many years now - family plan), and don't even get me started on the money I drop on software synthesizers. The good fortune that drizzled on me as a kid came back to those people as a raging storm. Advertisers know exactly what they need to show me when they want more of my money (those sweet, shiny synths), and I'm not even mad at them. They're almost like books now, where I don't even need to use them, I just like having them and knowing they're mine. That being said, as a long time amateur electronic musician, I'd love for people to pirate my music. As it stands I can't seem to even pay them to take it (with music that is).

<comment><USER50> Stealing is the wrong word for digital music. Copying. It's just copying. And, in most cases, it's at an immeasurable cost to anyone. To use the terms "pirating" and "stealing" not only make it seem much worse than it actually is, it waters down the mental image of legitimate use of those words, making the actual acts seem less serious. "Copycats" would be a fairer term.

<comment><USER51> Stealing is the right word. You can spin it any way you like, but taking something that's for sale, without paying for it, is the definition of stealing.

To further my point: not every artist is a mega-millionaire. There are countless small bands/artists where every sale counts towards them actually earning a living off of music.

<comment><USER52> > Stealing is the right word. You can spin it any way you like, but taking > something that's for sale, without paying for it, is the definition of > stealing.

it's hardly as clear cut as you are making it. if I have an apple and you take it, I no longer have the apple. if I have five apples and you take one, I have four left. it's hard to imagine you taking something from me that I will still possess afterwards in the same quantity. I would argue that the sense in which most people use "take" does not include copying.

to further _my_ point: the law in the US, a bastion of copyright enforcement, clearly recognizes the difference between theft (a criminal offense) and copyright infringement (a civil offense). you can't go to jail for piracy.

<comment><USER51> I understand your point. But, I don't think that just because something like a digital album lacks the physical properties of an apple, it's not a product worth revenue.

Presumably infinite quantities of a something like an album shouldn't suggest that it's worthless. Resources have been invested into it's creation. Artists should be able to recoup some of their investment with album sales.

If it's okay to "copy" music, than the same argument can be made for every other digital product. Games, films, and essentially all software.

<comment><USER52> to be clear, my point is that it isn't "stealing". i'm not necessarily saying it isn't wrong.

when i was teenager / college student i never thought piracy was wrong, mainly because of the "well i wouldn't have paid for it anyway" argument. now that i'm a software dev, i have plenty of money for music and movies and i realize that my own livelihood depends on IP protection. i can't justify it so easily anymore.

</comment></comment></comment></comment></comment></comment><comment><USER53> I think we can at least reduce that number down to 2 out of 5 without much cost or intervention.

<comment><USER54> I disagree. Without diligence, that number could skyrocket as high as 8 out of 20. Where would we be then?

<comment><USER53> I hadn't considered this as deeply as I should have.

I actually recall something out of the Regan Administration where a similar scenario actually ended up with numbers of 20 out of 50 - however that was largely speculative and not officially confirmed.

</comment></comment></comment><comment><USER55> Six out of ten being legit is what surprises me here. That's pretty high.

<comment><USER17> The legit channels have a level of convenience now not seen in the piracy channels, because money pays for proper curation and surfacing of content.

I used Limewire back in the day. I couldn't tell you how many songs in my collection were artist credit "System of a Down." I think I had a System of a Down copy of the 1812 Overture in there somewhere.

(It is also possible that legit channels are over-counted in the data because they're easier to explicitly audit. If the error factor estimate is the same for legit and bootleg channels, the data will reach the wrong conclusions).

</comment></comment><comment><USER56> It's important for me to have a permanent digital copy of the music I pay for. The modern streaming services' subscription model doesn't allow for that. Worse still, rather than being a dumb pipe, which is literally what cyber lockers were, they now have to be a taste-making platform, a modern MTV trying to shape our preferences and stuffing ads anywhere they can.

I find the music I want by reading community based sources like Last.fm, RateYourMusic, genre-specialist website, reviews on personal blogs, and magazines/web publications I trust (e.g. the Quietus).

Thankfully sites like Bandcamp is still around, and offer a decent way to discover new artists and get DRM-free downloads, no questions asked.

</comment><comment><USER57> Back in the day, I used to listen to top-40 radio all day long. I bought _some_ of the tunes I liked. The radio stations paid DJs to sift through incoming tunes and air the good stuff.

Yeah, I got spoiled into thinking that you got to listen to stuff _before_ you forked out for _some_ of it. I liked that model a lot better than paying for a streaming service. My guess is that's still a fine model for most people.

<comment><USER58> This strikes me as unwarranted nostalgia. With Spotify, you can find a universe of playlist curated by all the people with the best taste in the world. I find this far more compelling than being stuck with a handful of gatekeepers for my city in the genres that I like.

<comment><USER57> Nostalgic for good music? yep, that's me.

Good DJ's prove their qualifications with every record they spin. I don't need an ISP and a subscription. The genre I like is music written by talented composers and performed by talented musicians. What's the name of that playlist?

</comment></comment></comment><comment><USER59> How many out of a 100 ppl "ARE REGULAR" music consumers now vs 20 years ago ?

</comment><comment><USER60> I believe a large part of these pirates are in the increasingly connected world outside of Europe and North America.

I consider myself a pirate, without shame. My first games on C64 were pirated and since then I've been involved in piratbyrån and the swedish pirate party.

But I make enough money now to use Google Play Music and rarely pirate music these days. Mostly movies, shows and audiobooks.

So since this article specifically mentions music I make the assumption that it's not talking about my world.

A vast majority of people around me use streaming services for music today.

But I have friends in Thailand and Vietnam and there it's quite common to see pirated movies playing on long bus rides with VIP bus lines for example.

I also have friends on Croatia and Bosnia and there it's also still very common to go to a neighborhood pirate who will provide you with CDs of your favorite artists.

So I would be much less surprised if they were still pirating music in these places rather than using streaming services.

So there's a big world out there with an ever growing connected population, Africa, Asia, South America, and I'd speculate that they're driving up those numbers.

</comment><comment><USER61> I still pirate music... When it's not available in a streaming service, and not available legally for a fair price!

I think the best way to address piracy is with strong copyright reform. Specifically, once content is sold for mass consumption, it needs to make its way into streaming services. Things like artificial scarcity need to be phased out.

</comment><comment><USER62> Analyzing data for illegal downloads has notoriously being very hard to do. Where are they getting those numbers?

</comment><comment><USER63> Why does four out of ten sound better than two out of five?

</comment><comment><USER64> Louis ck used a good solution. You just paid and downloaded the thing directly.

The problem is the intermediary. People don't want to give money to labels. It's a little like buying food to your local producer.

I guess even Bandcamp makes money.

Consumers would rather pirate than see a fraction of their money land on some accountant desk for copyright management. Content is easily copiable, and did someone to live on their content doesn't require a high price.

In the digital age i don't see how an album could cost more than $5, or even $1 or $2 if you're not a full time artist.

Louie CK made millions that way, I agree that he was already popular though.

Just let people set their price (Radiohead did that), and advertise that method on a clean torrent, I'm sure people would pay.

</comment><comment><USER65> Why are youtube to mp3 converters illegal? I mean, it's basically just recoding a signal; I don't see how that could be an illegal action. Might as well sue me for recoding WAV to mp3 so more music fits on my phone.

<comment><USER66> Copying, _any copying_ , is breaking copyright, if a work is copyrighted. There are some defenses you have if actually accused of copyright infringement, like fair use, but those are exceptions after you've been accused.

Is this absolutely crazy? Yes.

<comment><USER65> It's so ass-backwards. I mean, in the most technical sense, every ISP, routing point and whatnot upstream from me to youtube is breaking copyright by sending me the packets, since it is technically a copy of the work.

<comment><USER67> It's ass-backwards (any law that makes 40% or more of the population a potential target of financially-disruptive lawsuits is not a reasonable law), but let's not get hung up on technical aspects of copying. It's obvious that ISP routing copies, and similar types of copying, involve transient copies that are quickly discarded and not consumed by anyone. The case law actually recognizes this difference. Legally, "copying" a work means _meaningful_ copying, not merely copying data from one place in memory to another place in memory where it stays for a while until it's freed or garbage collected and then overwritten.

<comment><USER68> Note that we _are_ paying for this when buying equipment that can be used to copy!

</comment></comment></comment></comment></comment><comment><USER69> Anecdatum: I was a big music buyer because iTunes made it quite easy.

I like to "own" my music, so it was appealing- DRM free, album art and metadata formatted correctly.

But then they nerfed the ever loving shit out of the music app on my phone and force fed me Apple Music. Since I ideologically disagree with that model I went back to the old ways of CDs and luckily I have Plex which handles my music on my phone now.

It's not as nice as before but it's better than being forced into a subscription.

</comment><comment><USER70> I used to pirate music, tv and movies a lot. Every hit show, every interesting album. For me the downsides were tied to the hassle of finding good quality streams, there wasn't much friction but there was enough that when streaming came along and I had the disposable income to afford it I went all in. Streaming will probably never be 90%+ of consumption but as long as it's a frictionless experience that is portable it will serve many.

</comment><comment><USER71> I don't see any stats showing a trend over time. This YouGov report indicates piracy is actually dropping in one country over the past 5 years (from 18% of Britons to 10% of Britons).

[https://yougov.co.uk/news/2018/08/02/number-britons- illegall...](https://yougov.co.uk/news/2018/08/02/number-britons-illegally- downloading-music-falls/)

</comment><comment><USER72> Yeah - I can't easily buy losless recordings that I'd get as files that could reside on my NAS, so tough luck. Streaming services offer less than a third of what I listen to, and their UX is idiotic. I cancelled my Spotify after I found out that my downloaded songs are deleted from my phone for the fourth time for some unknown reason, that _really_ pisses you off on a 10-hour road trip.

</comment><comment><USER73> >Stream-ripping users are more likely to say that they rip music so they have music to listen to offline. This means they can avoid paying for a premium streaming subscription,

This doesn't make sense. A premium subscription service doesn't give you access offline, and usually won't help with cellular data caps.

<comment><USER74> Both Spotify[1] and Apple Music[2] offer offline downloads to premium users.

[1] [https://support.spotify.com/us/using_spotify/the_basics/list...](https://support.spotify.com/us/using_spotify/the_basics/listen- offline/)

[2] [https://support.apple.com/en-au/HT204839](https://support.apple.com/en- au/HT204839)

<comment><USER75> Which you cannot move to another device and need their broken media player to play. Thanks but no thanks.

Have a real DRM-free shop instead please. Without idiotic user unfriendly lawyer requiring license to use.

<comment><USER76> Customers have pretty overwhelmingly decided they don't want that, as a whole.

<comment><USER77> Did they? Or did they just bend down to what's out there?

</comment></comment></comment></comment></comment><comment><USER78> Not surprising. I was one of the pirates before streaming services came about. Now I am not.

Or maybe it was because I was younger and had a finite amount of pocket money to spend on an infinite amount of desires.

But streaming has definitely made it lots easier to access music.

</comment><comment><USER79> I simply don't listen to music as much as I used to.

Today a Youtube playlist is often enough for me.

</comment><comment> trey-jones I certainly did it in college and after (when I didn't have any money? sorry, I guess). Streaming services are all I need now. I don't need to own it, just listen to it.

</comment><comment><USER80> As an eastern european I've gotten so used to pirating everything in my childhood that even now (25 yo) I pirate ALL of my: books, movies, music, games.

</comment><comment><USER81> Could we please stop using the loaded term "pirate"? Attacking ships and killing people is way worse than "stealing" anyway!

<comment><USER82> The term is in my eyes not used to describe the act of violence in this sense but most likely for living out side of the law and ignoring most authorities.

<comment><USER83> Well then it is even more inappropriate because most music 'pirates' are pretty much indistinguishable from the general population and certainly do not live outside the law or ignore most authorities.

<comment><USER84> Do you expect to listen to sea-shanties on pirate radio?

<comment><USER85> I certainly do. After playing Black Flag, sea shanties started to grow on me.

</comment></comment></comment></comment></comment><comment><USER86> 4 out of 10? More like 9.9 out of 10 if you count playing unauthorized albums on YouTube, which I've seen everyone do at least once.

</comment><comment><USER87> That is actually lower than i expected - since globally only some people are able to afford music services like spotify, apple music etc.

</comment><comment><USER88> This argument about "violation of rights" which assumes some absolutist intellectual property right, I realised you don't even have to engage in it. If I could push a button and transfer a million pounds from Ed Sheeran's account to mine, I'd do it without hesitation. Even if you accept the argument that I really should pay him $10 per album he should count himself lucky that society has constrained my theft to those limits.

</comment><comment><USER89> From the pdf at the end of the article, this estimate is based on a study of 19000 consumers from Argentina, Australia, Brazil, Canada, France, Germany, Italy, Japan, Mexico, Netherlands, Poland, Russia, South Africa, South Korea, Spain, Sweden, UK, US. The population of all these countries is 1.5 billion, but there are more than 3 billion internet users. Also, a study based on 0.000001 of the 1.5 billion population?

</comment><comment><USER90> Conflating piracy with copying music is fragrantly disingenuous. Pirating is the theft of someone else's goods by force. Music "piracy" is the circumvention of artificial scarcity to duplicate information and it leaves the original property intact. It was a clever con getting us to use the same word.

<comment><USER91> Meaning changes over time. Most of us have accepted a new, alternate definition of "piracy" in regards to digital media. Whether or not you (or I, because I don't either) like it is irrelevant.

<comment><USER90> I'm for making language mean what we want it to mean and I oppose the use of the word piracy to mean copying. Is that not how language changes?

<comment><USER91> Well, yes, but a word means whatever the majority believes it to mean. You're in the minority, so...

I get that it's a tactic used by the business end of things, but it's where we're at now.

</comment></comment></comment></comment><comment><USER92> Of course, music companies see this as a problem instead of an opportunity.

More pawsuits it is!

</comment><comment><USER45> I'd say more like 2 out of 5

</comment><comment><USER93> This seems very low, in the days of tapes it would have been nearly 100%.

</comment><comment><USER94> I wonder how small Lars' pool is now.

(Man, can I hold a grudge for a long time)

</comment><comment><USER50> Correlation does not imply causation. It seems unlikely the music itself is driving people to hijack ships, kidnap, rape and murder on such a large scale. Maybe there's something in the water.

<comment><USER95> Are you thinking that "pirate" is a dysphemism dreamed up by industry propagandists? The first software pirates named _themselves_ that. The industry would rather call them "thieves" or "criminals," something with less of a quaint, romantic feel in the modern day.

<comment><USER50> Just a joke based on Stallman comments[1]. If that's the case, then it seems the founding fathers did everyone a disservice. Everyone would be laughing at the MPAA and RIAA if they were constantly campaigning against "copycats", maybe even Capitol Hill. It's not too late to change the term if we all join in.

[1][https://stallman.org/articles/end-war-on- sharing.html](https://stallman.org/articles/end-war-on-sharing.html)

<comment><USER95> They _wouldn 't_ be calling them "copycats." They'd be calling them "thieves." Even more so than they already do, I mean. "Pirate" is better. A pirate is a romantic antihero in the public eye; a thief is just a greedy thug.

</comment></comment></comment></comment><comment><USER96> I feel like one third would have been a better ratio.

</comment><comment><USER97> Are the other 6 just not consumers (100% piracy)? :)

</comment><comment><USER98> which one do i count in, if I participate legally (spotify, purchases, etc) but also pirate? am I counted in the 6 or the 4?

<comment><USER48> You'll be in the 84% who pay for music subscriptions and in the 38% who pirate.

</comment></comment><comment><USER99> The real "pirates" are the content editors who lobby for copyright extensions so that works of art never fall into the public domain.

Public domain should be the rule and copyright the exception.

<comment><USER10> > Public domain should be the rule and copyright the exception.

Why? In what other area does the public automaticallt get a right to something someone else created?

<comment><USER100> > Why? In what other area does the public automaticallt get a right to > something someone else created?

If you make a chair and I buy it from you, I can do whatever I want with that chair.

<comment><USER101> I don't think the analogy carries weight. It's true for chairs but not for all physical objects. The law steps in. Thus for example, in many countries what you do with a house is regulated by national and local laws as happens with some datasets - such as an audio/visual recording.

</comment></comment></comment></comment><comment><USER102> Then music is priced too high.

(And musicians don't get a big enough cut either.)

</comment><comment><USER103> Copyright is a scam from a previous world. Go get it bois:

NewPipe (A free lightweight YouTube frontend for Android.) - [https://f-droid.org/app/org.schabi.newpipe](https://f-droid.org/app/org.schabi.newpipe)</comment>


Join GitLab's March Issue Bash - <AUTHOR> https://about.gitlab.com/2017/02/10/gitlab-issue-bash-march-2017/ <comment><USER3> I'd love to know what the magic recipe that GitLab uses to be so prominently in-your-face at all times on HN.

<comment><USER4> It feels pretty obvious to me - it's a well managed, useful product that offers a hosted version for free for any use, and it's truly universal - <USER2> aren't many developers who don't want source code control.

There is also the 'FOSS version of a popular proprietary thing' angle and the openness of the project that means there is more news about it to post.

In general, it feels pretty natural to me it would get posted about a lot, and upvoted a lot.

<comment><USER5> Thanks, but I agree with the sentiment that it we're a lot of HN these days, I can see people getting tired of it.

Frankly, I didn't expect the issue bash to get upvoted. We have our postmortem coming in a few minutes. I'm sure that will be much discussed here. We considered postponing that post but we promised it for this week and feel like we owe it to our users.

I've instructed all our people not to submit articles to HN but we can't prevent others from posting.

</comment></comment></comment><comment><USER6> Off topic but I saw one of the prizes is something called PocketCHIP. Googled what that was and actually tried it out on the product detail page ([https://getchip.com/pages/pocketchip](https://getchip.com/pages/pocketchip)). I really like this thing and had never heard of it until now. It's a very cool gadget. I just might have to get this. In addition to helping squash some bugs of course.

<comment><USER7> I got one for Christmas; first thing I did was apt-get install ssh-client.

The built-in keyboard is hard on the thumbs (especially trying to play games?) but can't think of anything else wrong with it in my limited experience so far. You can use an external keyboard or game controller.

The built-in tutorial and help system has a uniquely appealing attitude, I don't really know how else to explain it - it _feels_ right. They've managed to hit their target market right on the bulls-eye! Here is a nice 3rd-party usability tips blog post: [http://www.stevencombs.com/chip/2016/06/28/ten- things-about-...](http://www.stevencombs.com/chip/2016/06/28/ten-things-about- pocket-chip.html)

</comment></comment><comment><USER8> Not using "How to git involved" was a missed opportunity.

Jokes aside anyone know what happened to their swag shop? The post reminded me that I was going to pickup a shirt awhile back but never did and now their shop is giving a 404.

<comment><USER9> We're in the process of migrating the swag store to another provider. Shoot me an email (see bio) and I'll see what I can do for you in the mean time.</comment></comment>


Ask HN: What tools do you use for Developer Portals / API Docs? - <AUTHOR> What tools have you found useful to quickly build developer portals, specifically API documentation? We have looked at SwaggerHub and Gelato. Any feedback on either or other tools you have found to be valuable? <comment><USER2> I've absolutely fallen in love with Spring Rest Docs [https://projects.spring.io/spring- restdocs/](https://projects.spring.io/spring-restdocs/) after a colleague introduced me to it.

Essentially you write tests that then generate your documentation, so you get a load of happy path integration tests and up to date documentation. It's a great way to ensure the documentation and code does what it says.

Our happy path integration tests produce markdown files detailing the route,payload, expected status codes etc and then we manually add these snippets to a menu markdown file. When we work on a feature branch with public API changes then our CI system detects documentation changes and when merged pushes to Jekyll.

</comment><comment><USER3> I found gelato too complex when dealing with 2-5 methods only but I understand that the tools are build for larger teams. It's great to get hosted documentation up and running fast and code snippets for various languages to get started.

Have a look at [https://apiblueprint.org/tools.html](https://apiblueprint.org/tools.html) which covers mocking APIs, converting to [https://www.getpostman.com/](https://www.getpostman.com/), validation inside IDEs and generating HTML for self-hosting.

[http://documentation.js.org/](http://documentation.js.org/) is relatively new and seems to target nodejs primarily.

</comment><comment><USER4> If you've a OpenAPI/Swagger spec, you can also use Swagger Codegen [1] (free & open source) to generate API documentations. If you need help using the generator, please open a a ticket via [https://github.com/swagger-api/swagger- codegen/issues/new](https://github.com/swagger-api/swagger-codegen/issues/new)

[1] [https://github.com/swagger-api/swagger- codegen](https://github.com/swagger-api/swagger-codegen)

</comment><comment><USER5> Swagger is pretty great for API docs. I've used it in the past and there are plenty of companies using it. [http://swagger.io/](http://swagger.io/)

</comment><comment><USER6> I'd recommend Slate [https://github.com/lord/slate](https://github.com/lord/slate)

</comment><comment><USER7> very satisfied with [https://readme.io](https://readme.io)

<comment><USER8> [https://readme.io](https://readme.io) is the very best!

<comment><AUTHOR> Great, thanks for the rec! Looks like they just got swagger support added in which is important to us. We'll give the trial a go.

</comment></comment></comment><comment><USER9> I don't have experience in either of the options you found, but readme.io is pretty good in my experience.</comment>


Peter Michaux: Living an xkcd Cartoon - <AUTHOR> http://peter.michaux.ca/articles/living-an-xkcd-cartoon <comment><USER2> The only meat in this post is the xkcd cartoon.

</comment><comment><USER3> It's very strange, but despite having the same name, being from the same place, being around the same age (I think), and programming in mostly the same languages, Peter Michaux isn't me. Just for the record.

<comment><USER4> Are you sure?

<comment><USER3> Quite sure, hah.

Peter and I had an e-mail exchange about 2 years ago when I first found his site. At first I was confused because I thought I had put up a site about javascript and then forgotten about it.

I doubt we look similar, but that would be a riot.

</comment></comment></comment><comment><USER5> Kudos for preserving the title text.</comment>