The iPad is the first Personal Computer-- what you have is a work computer. - <AUTHOR> http://spreadsong.com/the_ipad_is_the_first_personal_computer_what_you_already_have_is_a_work_computer <comment><USER3> The iPad isn't a computer. It has a cpu, but so does my toaster, it's a portable cableTV box. The point of a personal computer is that you are in charge, you create content, with an iPad you pay to download and watch other people's content. It's the difference between writing your own blog and reading the national enquirer

<comment><USER4> It has iWork. You can create documents, slideshows, emails, and plenty more with other apps (including blogging apps).

Not only is your definition of a computer narrow, it's not even accurate with regards to the iPad.

<comment><USER5> Did you notice when you posted that that you also fried the entire premise of the linked article? Work still beckons, email still beckons.

If it is left up to the user to not permit those things to beckon, well, gosh, I can do that right now on any machine I choose, there's nothing special about the iPad.

There is no such thing as "work machine" or "personal machine". There are only computers. Turing machines. A computer is what you make of it. In fact I'd fight anyone who tries to hide this fundamental mathematical truth, because they're probably trying to lock me in a trunk. Which in fact Apple is. (The metric works!)

[http://www.scripting.com/davenet/2001/08/01/bigBlankMachine....](http://www.scripting.com/davenet/2001/08/01/bigBlankMachine.html)

</comment></comment></comment><comment><USER6> 'The iPad's killer app is chilling out!' That's exactly what I think.

I can picture this thing being passed casually around the living room so that family members or friends can look at photos or check out something on a webpage ('look at this!'). You can't really do that with a laptop, and it's not very appealing with a smartphone. I can imagine it becoming a staple of the lounge just like TV&remote or newspaper.

Also I can see many workplaces adopting it to kit out their practices/garages/surgeries/kitchens like Star Trek... iPads bolted to the walls or mounted on stands etc.

</comment><comment><USER7> Actually I think it's going to change how we work just as much. Think about it. iPad 3G + HTML 5 business web apps? No more software to install, constant connectivity, dynamic touch driven interfaces,etc. If that's not some Jetsons shit, then I don't know what is.

<comment><USER8> Dunno about this. Most of the spreadsheets I look at on a regular basis don't even fit onto a 30" display. "Real work" does not happen on 10" tablets.

</comment></comment><comment><USER9> _You don't sit it down in your lap, the screen doesn't come up and block reality- it's something you pick up and hold. And, like a book, you can simply put it down._

A wonderfully concise way of putting the key difference.

 _It's the first Personal Computer- good for hanging out in the living room, terrible for 'real' work. That's why it's fantastic!_

However, this misses the mark. It's only a matter of time before we iron out the kinks and such interfaces are used for work.

<comment><USER10> I still don't see this (the iPad as something for work, I mean).

Does most people's version of "work" consist of setting something down on a table, and then never breathing on it?

This idea of a tablet as a work device has been solved many many many times already and is already extremely successful; it's called a toughbook and it is a wonderful machine. I have guys drop their toughbooks, use them in the rain, use them when their fingers are covered in grease, I've had toughbook get run over, and left in hot cars for a day. There is absolutely no possible way that the iPad could survive in these conditions.

Howabout doctors? Lots of people are claiming that doctors are going to be all over this...why? How is this different then the myriad of tablets that are already available? I've heard people praise the iPhone's interface as some marvel of modern design, but really? I've had mine for about a week and a half now and I cannot _TELL_ you how much I miss buttons that do things. The phone's interface feels like there was a lot of shoehorning to get it to work with only a few buttons. I really miss my blackberry.

My iPhone is great for updating my twitter status and making people laugh by having them sing into the "I am T-Pain" app, but it is absolutely not in any way something that is designed for work.

We'll see, but I think that the iPad is just going to be an iPhone SUPER, and I think that we've already seen why the iPhone doesn't work as a business tool (at least not for the people I've met). I replaced a few people at work's blackberries with iPhones because they begged and begged for them [I talked to their boss and had them set up the iPhone as a sales incentive for them, it worked really well, actually :)] and after about a week they started crying for the return of their blackberry.

My opinion is that the iPad will be the same story.

<comment><USER11> Yeah, toughbooks tablets are pretty neat. They're also about 3 pounds and are full blown PC's, which sounds great but most workplaces have to endure much higher costs from maintaining and administering full blown PC's than they'd endure from a more limited device.

<comment><USER9> I've had to do a _phenomenal_ amount of tinkering to get my tc1100 tablet to a lovable level of slickness. (A 3lb slate form factor PC.) We're talking about weeks of research, trying out software, buying components off of eBay and one afternoon of disassembling the thing.

The iPad is just about as useful to me after just one hour or so of App Store downloading. It's a bit faster to write posts with, even typing one handed. I haven't been able to sync the Bluetooth with my Plantronics 510 headset, though.

</comment></comment></comment></comment><comment><USER12> Find and replace all instances of "iPad" with "netbook" and the article describes my netbook usage.

<comment><USER13> The same is true for me and "laptop."

That doesn't mean either of our use cases are optimal.

<comment><USER12> Agreed, but a small form factor netbook shares many more similarities with the iPad than a full-fledged laptop. My 9" EeePC is light and comfortable to use on the couch, in bed or even standing in line at the DMV. The keyboard is too small to do a lot of typing, but it's fine for quick emails or chat. The screen is too small and the processor too slow for Photoshop. Granted the iPad surely has a nicer screen. And if a netbook keyboard isn't being used, it's "dead weight" so to speak. But I've also used my netbook for work in a pinch (ftp, notepad++, vnc). So I suppose my EeePC falls _between_ an iPad and a laptop, which is good enough for me.

</comment></comment></comment><comment><USER14> My mom wants one and that's how I know it's going to do well.

 _Sidenote: Anyone order 2 and are willing to let the other go? Or are going to pick up in store and could grab another? I'd really like to get it 3 weeks before the international launch :P

My friend tried to order 6 and Apple canceled all 3 of his orders :( If anyone can help me out @yurechko on twitter or m[]mikeyur[]com_

<comment><USER15> Could it just be the result of efficient advertising, though?

Arguably iPods are very useless things, too (except for the iPod Touch maybe), yet they sold like hot cakes. Again I suspect it's because of advertising. Marketing is something Apple is REALLY good at.

Also iPods were good for displaying status (maybe the only real use) - <USER2> same isn't true for an iPad you keep at home on your couch.

<comment><USER16> They sold well because of ADVERTISING? Please tell me you are kidding. They filled a niche and were stylish. That's kind of the point of a good product. Sure, Apple has good advertising, but contrary to what some geeks think advertising isn't brainwashing.

<comment><USER15> Um, did I hit a nerve?

<comment><USER17> I think you did. Around here, I think that many people see the iPod as the kind of success that they would love to emulate. The iPod did something simple, play music, but it wasn't useless. In dash vinyl record players did that as well, but the iPod did it really well. Apple created an elegant device that solved a simple, but very common task. They combined this with great design and brilliant advertising. For this they were rewarded with truckloads of money from satisfied customers. This is something to be studied and emulated, not derided by calling it useless.

</comment></comment></comment></comment></comment><comment><USER18> Yes, let's co-opt words so we can confuse consumers.

</comment><comment><USER19> The key phrase in this article is "when you pick it up".

Just think of how important it really is to be able to set your laptop down in front of you somewhere. Anywhere. What about holding a cup of coffee while browsing? Or writing?

Just because people "want" one doesn't mean they are going to get "used".

A lot will be purchased, sure, a lot of apps will be sold, but will it change personal computing forever? Nope. People will realize the laptop keyboard and form factor is a pretty sweet thing.

Imagine trying to type your comments on HN using that keyboard on the iPad? Hmm.

<comment><AUTHOR> I don't think the keyboard issue is really there- if you read the reviews thus far, most brand it as either good or acceptable.

Apple is lightyears beyond anyone else in virtual keyboards, which will be shown off big time with iPad.

<comment><USER20> Its interesting, i have been using swype beta on my droid for the last month or so, and it completely changed the way i type on the phone, i just had to type again on the iphone, and it struck me as almost anachronistic.

A Swype like feature on the ipad can have great potential.

</comment></comment></comment><comment><USER21> To the all the people whining here and else where on the inter-webs:

Is the iPad special?

Heck yes it is. Show me a tablet computer other than the iPad that is as polished, has as much of a vibrant app store and does most of the things you'd expect from a freaking 10 inch small slate, I'll join you side.

Is the iPad revolutionary and magical?

Of course its all a joke -- never heard about marketing before?

Bonus:

""" The iPad isn't a computer. It has a cpu, but so does my toaster, it's a portable cableTV box. The point of a personal computer is that you are in charge, you create content, with an iPad you pay to download and watch other people's content. It's the difference between writing your own blog and reading the national enquirer """

The iPad is a 10 inch slate. Even if it had full blown OSX on it, I doubt it could be used for full blown "content creation." For light editing / writing work, there are apps on the app store to help you do that.

If the iPad were to be a bigger slate, thats something different. But, for a 10 inch tablet..c'mon.

</comment><comment><USER22> Oh, jesus christ. Listen. Just because you can't do any actual work on an iPad doesn't mean I only have a "work computer." It's very rare I use my laptop for work. I use it for my personal tasks and entertainment and thus it is a personal computer. Now can we please stop with ridiculous comparisons like this?

<comment><USER13> That's not what the article is saying. The article is saying that the iPad is optimized for personal tasks. A personal computer is (implicitly) optimized for work-related tasks. While you certainly can use your laptop/desktop/netbook to perform the same functions as an iPad, it may not be as natural or as comfortable to do so.

I'm not sure I believe the author's analysis either. But the least we can do is represent it faithfully and not argue to straw men.

<comment><USER23> You're being way too kind to the author. He never tries to demonstrate any of the ways in which a personal computer is "optimized for work-related tasks." He just takes it as a given: _"you can't kick back and relax with a laptop."_ It's just bullshit, not an analysis.

<comment><USER13> I didn't say I agree with him. I just said I don't agree with making up a straw man argument and then burning it down.

</comment></comment></comment></comment><comment><USER24> It seems like the downsides of the "work computer" as he's characterizing it are the fact that it encourages multitasking behavior. On the other hand, with the iPad/iPhone/iTouch platform multitasking is severely restricted, applications appear full-screen and there's a small (time) penalty in switching from one application to another (it's not as easy as alt/cmd-tab).

It is ironically a good limitation for some situations. But, you can achieve the same thing by just doing one thing at a time. (And I think that's a lot better for a lot of work activities too.)

</comment><comment><USER15> I wonder how many people will bother to carry their iPad AND their notebook/netbook on the train or air plane. Maybe iPads will kill off netbooks, but at the moment I still doubt it somehow.

<comment><USER6> To be honest I'm amazed that anyone can be bothered carrying laptops or even netbooks about. To me they're good because you can move them easily from desk to desk, but the prospect of using a laptop 'out and about' and carrying it all day is singularly unappealing.

<comment><USER15> The iPad is actually heavier than my subnotebook from 4 years ago, and I suppose also heavier than most present day netbooks. It's also heavier than a MB Air.

I sometimes carry my notebook along when traveling. Not so much for just going to work at a cafe, but that might be because there are no really nice cafes around where I live.

<comment><USER6> Are you sure about those weights? I thought the iPad weighed 1.5 pounds, which is surely lighter than a MB Air and judging by a quick Google search lighter than the lightest netbooks ("just under 2 pounds").

</comment></comment></comment></comment><comment><USER25> I think "personal" was attached to let people know that it was a computer, but not the size of your living room. And not something you'd have to rent out by the hour.

But still, good points. I don't know if I'm ready to shell out 500 bucks to chill and read stuff, but I know there are tons of people who will be.

</comment><comment><USER26> Ok, after so many ppl explained why iPad is cool/suck, am i the only one who truly dont care at the moment and prefer to wait a bit to test how ppl will adopt it?

<comment><USER13> Sorry, but we probably can't.

Those of us waiting on Saturday orders are a little jumpy right now.

</comment></comment><comment><USER27> Nonsense, I have various everything-machines that can "transform" into either work computers or personal computers, depending on what I want them to do ;)

Still, I want one.

</comment><comment><USER28> I _really_ want to work on it, too, though.

<comment><USER7> Three words: Google Apps HTML5

</comment></comment><comment><USER29> > what you have is a work computer

The 20+hours/wk playing games would beg to differ.</comment>


HTML.next (W3C) - <AUTHOR> https://www.w3.org/wiki/HTML/next <comment><USER2> I prefer the [Web Platform Incubator Community Group forums]([https://discourse.wicg.io/](https://discourse.wicg.io/)) - doing this via Discourse lets people reply directly to the bad ideas, letting them sink to the bottom, unlike this page where they appear to be front-loaded.</comment>


A Note to Non-Technical Founders - <AUTHOR> http://austinclements.me/2011/12/a-note-to-non-technical-founders/

<comment><USER2> Or just write the spec, make the wireframes and hire someone to build it for you.</comment>


XLNet: Generalized Autoregressive Pretraining for Language Understanding - <AUTHOR> https://arxiv.org/abs/1906.08237 <comment><USER2> This is NOT "just throwing more compute" at the problem.

The authors have devised a clever dual-masking-plus-caching mechanism to induce an attention-based model to learn to predict tokens from _all possible permutations_ of the factorization order of all other tokens in the same input sequence. In expectation, the model learns to gather information from all positions on both sides of each token in order to predict the token.

For example, if the input sequence has four tokens, ["The", "cat", "is", "furry"], in one training step the model will try to predict "is" after seeing "The", then "cat", then "furry". In another training step, the model might see "furry" first, then "The", then "cat". Note that the original sequence order is always retained, e.g., the model always knows that "furry" is the fourth token.

The masking-and-caching algorithm that accomplishes this does not seem trivial to me.

The improvements to SOTA performance in a range of tasks are significant -- see tables 2, 3, 4, 5, and 6 in the paper.

<comment><USER3> They used more computer power than BERT and much more data for training. Also they still under-perform comparing to the best BERT-base model in SQuaD 2.0 benchmark.

The big value of BERT is that it is publicly available, and can be modified and improved.

<comment><USER4> An English pretrained model is available. Also, the SQuAD2.0 EM numbers are higher than the BERT results published in the BERT paper. Subsequent work has improved on these and no doubt XLNet will see similar activity.

</comment></comment></comment><comment><USER5> It's nice to see people managing to push BERT further and get SOTA on stuff, but I feel like a fair amount of this sort of thing is really just throwing more and more compute at a problem.

Given that we still don't fundamentally understand the properties of deep nets anywhere near as well as we might like to thing, it gives me the gnawing feeling that we're missing something.

<comment><USER6> This concern is vague, frequently raised, and not especially useful. What are you advocating, specifically? That the amount of compute being thrown at problems is excessive relative to the economic benefit that Google (or whoever) derives from training models as long as they do? This is an empirical question, and it's well understood how much compute is useful. Are you saying that advances in M.L. theory are coming too slowly because we focus too much on hardware? I spend maybe a third of my day job reading journal articles, and the rate of ideas coming out is blistering.

This isn't people banging GPUs together in desperation because nothing works. This is what happens when everything works better and better the more money you throw at it with no apparent end.

<comment><USER5> I accept all of what you're saying and also spend a lot of my day reading ML papers :)

To boil it down a little perhaps, the point I'm making is that the incremental gain from new ideas coming out seems to be slowly decreasing, in my view - which is perfectly natural! It obviously makes sense that that would happen.

Where that thought leads me though, is the idea that we may be slowly moving towards the exploitation half of the explore/exploit choice. I'm not saying greenfield ML research is gone by any means, only that I think a lot of stuff presented as such may in fact not be because in many cases it doesn't really fundamentally re-think the problem being addressed.

</comment></comment></comment><comment><USER7> What i am most impressed about this paper is that it is primarily from CMU with 5 authors and 1 from Google (with the legend Quoc from Google and Ruslan Salakhutdinov is also excellent). Even though the CMU team may have had the original ideas, I guess the golden age of ML adage still holds despite their contributions related to dual-masking-plus-caching - "it's a golden age so long as you have access to massive amounts of compute and storage".

</comment><comment><USER8> I don't the point they are trying to make about BERT not learning dependencies between masked words. Isn't the mask randomly chosen each time, so it has a chance to learn with all possible words unmasked?

<comment><USER9> Most of the statements they make regarding orderless autoregression, including statements about the "independence assumption" made by BERT, are misleading at best.

<comment><USER8> Thank you, it seemed that way to me, but I thought maybe there was something I wasn't understanding.</comment></comment></comment>


Retreating into solitude, I have given up on my career - <AUTHOR> Even though my technical and mathematical work has gained the interest of many great scientists, from Cambridge UK to Perimeter Institute of Theoretical Physics to Wolfram Physics Project to many other wonderful people, it's clear that my career is going absolutely nowhere. I consider universities to be mostly obsolete now, and I have written hundreds of emails criticising universities, to the point that I could no longer finish my mathematics degree and can't get a job or internship. Nevertheless, people tell me my work is important, and they say somehow someday I will be making money. but I don't believe it and I am officially giving up. My only plan is to retreat into solitude and continue my mathematical studies, and I have no idea how to proceed my career. <comment><USER2> Get mental health treatment. No matter what the reality is about your work, you are experiencing a dangerous level of despair.

</comment><comment><USER3> If you have attention from big players why are you finding it difficult to get a job? I have been thinking about manifold traversal for unsupervised object discovery, would you be willing to help me with that?

<comment><AUTHOR> Having a bit of attention does not automatically translate into a job.

If it's well paying, maybe. What makes you think I'm the right person for your job?</comment></comment>


Court refuses request to force alleged hacker to hand over passwords - <AUTHOR> https://www.theguardian.com/technology/2016/may/10/court-refuses-request-force-alleged-hacker-lauri-love-hand-over-passwords <comment><USER2> Background: [https://freelauri.com/arrest-and-uk- investigation/](https://freelauri.com/arrest-and-uk-investigation/)</comment>


Google doesn't hire losers - <AUTHOR> https://rpcrpcrpc.com/posts/2019/02/09/googlers-no-losers/ <comment><USER2> False, they hired me.

There is a huge element of randomness in google's hiring process. So much of it depends on whether you and your interviewers were having a bad day that day. I suppose being hired there means you're above some minimum bar of competence, but I don't think being rejected means anything other than you got unlucky.

<comment><AUTHOR> It's important to realize this post doesn't make _any_ assertions about the fundamental merits of people who are rejected by Google.

</comment></comment><comment><USER3> What a weird post.

> _The minor point I want to get across here is that if someone has Google (or > any other ${BigTechCo}) on their résumé then it's something to be interested > in but you should also be asking about what led to that_

I mean thats great a great goal for interviewers, but the idea that _because_ google was on your resume that what came before must have been interesting seems...self aggrandizing? I'm not sure exactly, but it definitely doesn't follow. New grad hires alone throw a wrench in the works, but so does the Google interview reputation for caring less about the resume than coding questions.

</comment><comment><USER4> What's the argument and point of this? Can someone clarify?

</comment><comment><USER5> I know plenty of losers that were hired by Google, Amazon, Facebook, Netflix, etc.

I don't actually know of one golden company that has never hired a dud.

Not one.

</comment><comment><USER6> What's the actual point of this post, other than a click-bait title?

</comment><comment><USER7> This article adds no signal to my world view except that there is an employee at google who thinks its professional to 'fail the fuck' out of me.

</comment><comment><USER8> He certainly sounds like a loser, while trying to say Google only hires winners.

There's a problem with society when children are blogging that they'll, "fail the fuck" out of you while working at Google. I think I'll pass on applying if I'll have to with him.

All he says his with poor communication and social skills is that people with unrelated but impressive backgrounds work alongside him. Pat yourself on the back. We now know it's possible to work at Google but have a brain the size of a pea.

</comment><comment><USER9> This article is surprisingly aggressive considering it doesn't really say anything other than "tests as interviews can cause you to hire non-traditional pedigrees."

Also, some of the worst people I ever worked with came from Google. The process seems to filter for test-taking rather than pragmatism or work ethic. But that's a whole other issue.

</comment><comment><USER10> This isn't a good article, but it's not off-topic, and flags aren't downvotes. I vouched it.

<comment><USER11> I flag when the article isn't of a quality worth discussing. This certainly meets that criteria.

<comment><USER7> That's subjective tho. Granted, i suppose flagging is democratizing, unironically.

<comment><USER11> It is, and I don't do it often but this was _really_ bad.

</comment></comment></comment></comment><comment><USER12> Not a fan of googles hiring process. I interviewed in 2015 and never got past the phone screen. I was given a contrived programming problem, which I solved and explained runtime complexity.

The interviewer called me for the screen about 15 minutes late and then he was upset with me because the google doc link I was given to write code was not the one he was opening. Miscommunication on his end.

He struggled to speak English, which I'm fine with, but his inability to communicate made him get more and more frustrated.

The recruiter never called back. Even if they weren't going to move forward, a simple courtesy call wouldn't have been so terrible.

This interview was for an entry level engineer. In less than 4 years, I'm a senior engineer now at another top tier tech company. I don't think my interviewing skills or coding skills were the problem.

Googles recruiting process is half assed.

<comment><USER13> This isn't really a relevant response to the content of the article, in my view, so I downvoted.</comment></comment>


AI chip company SambaNova Systems raises $56M - <AUTHOR> https://techcrunch.com/2018/03/15/the-red-hot-ai-chip-space-gets-even-hotter-with-56m-for-a-startup-called-sambanova/ <comment><USER2> Have any AI chip startups actually shipped?

<comment><USER3> Movidius kind of did, as a part of Intel. They sold dozens of their sticks, maybe even hundreds. By EOY "good enough" built in power efficient acceleration will be available on sub-$100 dev boards. So they have to raise while they still can.

<comment><USER4> Please correct me if I am wrong, but Movidius also supplied Vision Processing Unit to Tesla. They terminated their contract with Tesla over some tussle which I'm not aware of.

<comment><USER5> Mobileye, although both now Intel

</comment></comment></comment></comment><comment><USER6> I have no experience with AI, but is this application very different from ltc or eth fpga mining? Do I get it right, that AI chip needs plenty of memory to hold coefficients, manipulate data, get next set of coefficients, repeat this multiple times and the bottleneck is memory bandwidth? Or it can be parallelized with more FPGAs for different layers with corresponding storage for coefficients.

</comment><comment><USER7> But its still all von neumann architecture. We need a clean break at the hardware level to really get somewhere on this imho. I think reservoir computing is the way to go, with a specially designed substrate on silicon acting as the reservoir. Thats where i will be investing if I get the chance.

</comment><comment><USER8> Very cool company and one of the few in SV with a black founder

</comment><comment><USER9> Screw this, I just want to see AMD get their shit together and start putting a fight against NVIDIA</comment>


Worried About the Privacy of Your Messages? Download Signal - <AUTHOR> http://www.nytimes.com/2016/12/07/technology/personaltech/worried-about-the-privacy-of-your-messages-download-signal.html?em_pos=small&emc=edit_dk_20161208&nl=dealbook&nl_art=4&nlid=65508833&ref=headline&te=1 <comment><USER3> I'm worried about the freedom of dissenting opinion in civil society from surveillance, not the privacy of my messages. Privacy is something I would easily give up for such freedom.

Signal seems to me to one tool in a large profile to maintain freedom of information dissemination and information gathering activity.

It seems to me that speaking to a large number of people anonymously is not possible with any of the existing tools, Signal included, and it seems that this set of tools is the next set that is needed.

Candidates for this include implementations of "Dining Cryptographer Nets," though there exist scalability and DoSability concerns.

<comment><USER4> An incomplete sketch of a browser plugin/feature that would allow posts to be signed from an anonymous source. (hiding your IP isn't addressed; use something like Tor)

* Blocks of text that start and end with magic numbers are signed in-band in the style of "gpg --clearsign".

* The pubkey pair is automagically created on first use.

For legacy support with existing infrastructure (such as HN):

* When you submit a form with a <textarea>, the plugin provides a UI to sign the contents before submitting the form.

* When browsing a page that contains magic number wrapped text, the text is automagically verified and the key pinned.

* The structure of the signed text should allow the plugin to hide the magic numbers, signature, etc, so the text looks normal.

However, newer software would have other options:

* Define a mapping between the in-band data and a tag structure that holds the same data. This needs to be strictly defined, so it is possible to remove the tag structure and verify the original signed text. This gives full presentation control back to the website, while allowing individual posts on the page to be verified.

The big problem - as usual - is key distribution. In the latter case where it is easy to hide metadata with CSS, the public key can simply be included with the post. Unfortunately, in the legacy case I don't think there's a good way to include two pages of public key in each "\--clearsign"d post.

<comment><USER5> I have considered, and even worked on, a Chrome extension for this exact purpose. Some hurdles I discovered:

* Websites do weird things with textareas. If it's a plain-ol HTML form, it's pretty easy to intercept and do what you want. It seems most websites intercept button clicks then pass your text around to twenty different JS functions and libraries before doing something useful with it. You wind up writing code to handle edge-cases more than anything else.

* To address your final comment, embedding the pubkey inside the text would defeat the entire purpose. A malicious actor (see recent Reddit controversy) can just create their own pubkey, sign the modified comment with it, and noone would be the wiser.

Some things I discovered, and found worked well:

* Keybase has a fantastic library for generating PGP keypairs in-browser. It really added that extra bit of "magic" to the extension.

* Chrome extensions can get CORS exemptions on a per-website basis, and uploading to a standard SKS keyserver is just a POST request that can be done by Javascript.

* Expanding on the last bullet point, verifying other user's comments was tricky. During development, I just downloaded all keys on the keyserver that were uploaded by my extension on a scheduled interval and stored them in localstorage. Unfortunately, I don't think this would scale.

If anyone is interested in picking up where I left off, I could upload the source to Github.

<comment><USER6> Could you commit to github? Im working on something similar and would like to check out what you got/maybe pick it up. Feel free to send me an email (in my HN profile)

</comment></comment></comment></comment><comment><USER7> I continue to be disappointed by headlines like, "Worried About the Privacy of Your Messages? Download Signal" which implies that only some people should be worried about privacy.

You'd think that the revelations about the NSA, things like the UK law that requires ISPs to collect and store your Internet browsing history would have more people "worried" but yet it's still pretty much a lost cause to try to explain to smart friends why this stuff matters.

<comment><USER8> That the NSA is able to spy on you is an existence proof that criminals can also spy on you.

The downside of becoming known to the NSA is that you can get caught up as an "associate" in someone's drug, criminal or terrorism investigation, and you had no idea that the person was doing anything like that. You might even have no idea that the person exists, since the NSA is "allowed" to go out some number of degrees of freedom from the supposed suspect.

The downside of becoming known to criminals is that you can fall victim to criminal schemes. You don't even have to be known by name or association, your device just has to be discovered; owning it is the all too easy next step. You can be known by installing malware (see the articles on phone downloaded apps), _or by criminals seeing your communication on the open internet and becoming aware of you_.

That's what I'd tell my friends, if any of them were still listening.

</comment></comment><comment><USER9> All the privacy solutions on the market are varying degrees of bad (from a privacy/security/freedom perspective), by which I mean they're all flawed in their own ways.

Signal requires Google Play Services on Android. That means it's put simply not a privacy messenger. Yes there's crypto, but it's also tied into Whisper Systems' infrastructure, there's no federation. I use Signal reluctantly, and only on IOS.

Threema, which is popular in parts of Europe (and is what I use to an extent) is well established, but not open source, doesn't do voice chat or federation.

Wire is moving in the right direction with respect to being open source and having lots of good features, but is still not open source.

It's 2016 and our best crypto messenger options are worse than what we had 10 years ago when Skype was peer to peer, or Jabber with federation.

I can understand the reasons for not supporting federation, but I disagree. The Internet was built to be decentralised, literally to withstand nuclear war. A walled garden does not provide us with the redundancy or control the Internet offers.

There are other metadata related issues that pretty much every messenger suffers from but I'll leave this out of the scope of this comment.

What Open Whisper Systems and Wire need to do is open source the server components of their solutions, and try to remove the reliance on servers as much as possible. Only then will we have proper message privacy.

<comment><USER10> Chaps.

I think it's time we just admitted that everything we type/tap/say into _any_ device, regardless of how it's being wrapped up in transit, is absolutely and irrepairably insecure and we're not going to be able to fix that anytime soon.

Even with really smart crypto or some slick app; what makes you think that your messages aren't just being read by your os? Would you really notice? Why would you assume that the api this app talks to is trustworthy? There's no way to even tell if the code for the client on your device is the same as what's in that repo, as if it would make any kind of difference anyway since we can just load code from anywhere at runtime and you'd probably not even notice.

This whole thing is a fucking stageshow, I can only assume we're here to create an illusion that we still have any kind of security. Why? Is it to get some low hanging fruit/tech amateurs who will trust it and expose themselves? I don't know. But, HN, I don't know why WE aren't admitting this to ourselves or why we defend such obvious ruses.

Well, maybe some of you have signal stock I guess.

It's over, we lost, we have no security, we will probably never be able to reverse that situation, things are getting worse rapidly, we can't even know what any of our devices are really doing anymore (even the switches in your dc, the firmware on the UPS's, whatever), and apps like signal are obviously, to me, impossible to trust and I don't know why that's not obvious to anyone who has spent a moment looking at our situation..

Argh.

<comment><USER11> > I think it's time we just admitted that everything we type/tap/say into any > device, regardless of how it's being wrapped up in transit, is absolutely > and irrepairably insecure and we're not going to be able to fix that anytime > soon.

We dont have to set the bar that high. Just lower it slightly and we can achieve great success.

Can we make the job of NSA and CIA harder? Not necessarily impossible, just to increase the costs they have to spend on whatever it is they are doing, much higher than it is now.

That would be nice.

We can do that with bitmessage, avoid Signal, use Telegram which means outsource to Russia/KGB - so NSA will for sure need to spend more resources if they want to access your "secure chat" on Telegram.

EDIT: but of course, as you say, the problem is socio systematic - <USER2> technical system which can or would be used to subvert the state is a threat to the state and will be neutrialized, by takeover, sabotage, lack of funding, the means the state has are enormous. The list we have of secure or safe systems are still zero. Only another state can go against the state.

For example, it was mandated that GSM had backdoors. Any system used for communication, especially mass/group communication, is not free and not allowed to exist. So simple is that. They even tried to go after the __creators __of secure systems, wasnt the PGP guy scrutinized?

<comment><USER10> I'm not sure there are many ways to make things harder when the complexity of the systems we have even in our pockets make them so very hard/impossible to even observe let alone protect.

There are too many places, even on a phone, where anything at all can be hiding and we don't really have any way of ever knowing what's there without stepping through the binaries.. That's even more difficult when we've got dalvik and VM's involved. How many people alive do you think could work out exactly what your mobile does in any one second within say, 6 months? ..

For all we know the thompson compiler backdoor really happens, and so how can you even trust the binaries you're producing?

Do you know anyone who built, for instance the openssl.so on their phone personally? Did that person build it on a machine they trust? How can they trust that machine? A single lib with a nefarious function on the few GB of binaries which ship with your phone is enough to completely negate any 'security' these sorts of apps could provide; even if they were trustworthy to begin with which they're obviously not.

It's a charade, assume everything you do is completely observed, regardless of crypto/apps you use.

Even if you have a fully audited and trustworthy (in your view) OS -- then what about IME? Who says that the CA that issued the certs you trust and talk to isn't also feeding them out to the gov or whatever? Who says your HDD isn't talking to the zigbee thermostat in your house and sending your rsa keys to the pentagon? Who says yo home wifi point isn't acting as a decrypting proxy?

We cant tell, and that's the point. There is no way to ever observe these levels complexity and verify security and we don't admit it.

We will never know if the code we are running on our various devices is doing anything extra or not, and so rationally, we should never trust it at all.

Not to say all sec is pointless, you don't want to be low hanging fruit, but above 'insta-pwn' levels of stupid there isn't much more available, even if you're told there is and we keep pretending like we have any control over what's going on anymore...

<comment><USER12> You're right, anything _can_ be monitored, but we shouldn't take that as a reason that we should lay down and accept it. You should assume that any sufficiently motivated person/organization/state can get access to your information. But what we should absolutely do is make sure that state actors and companies have to demonstrate that they are motivated to take that information. That they have to devote resources to getting it. We shouldn't hand them broad access to everyone's information just because any one person's information is possible to obtain.

But regardless of that point, your other argument feels to me like a discussion against the problems of mono-culture: we should all endeavor to have diversity of implementation, if possible. The more we can work towards federated standards and the ability to quickly pivot when someone loses our trust, the more capable we are of defeating attempts to undermine that trust. If we only have 1 implementation of signal and everyone uses it, then all an "evil" party has to do is find flaws in that 1 implementation. If we have 2 implementations, then some users are protected. If we have 1,000 implementations, and they all inter-communicate, then we have some hope that only some users are affected by each compromise. I'm digging matrix.org as a federated protocol, and I'm hoping that it takes root because it has many clients; an open, federated protocol; and the ability for me to run my own server.

I would advocate that even though we're relatively mono-culture on linux, supporting it at least gives linux access to the source code which would allow other implementations (anyone else keeping a close eye on Redox [1]? I know I am!). Support open protocols! Support federated protocols! I'll advocate that signal is a great, easy-to-use system for secure communication, and that the ideas of Signal are percolating elsewhere (see "olm" [2] the implementation of Signal's crypto protocol for matrix). But I would like to see stabilization in Signal leading to federation.

[1] [http://www.redox-os.org/](http://www.redox-os.org/)

[2] [https://matrix.org/git/olm/tree/](https://matrix.org/git/olm/tree/)

<comment><USER11> Indeed, another cost-increase on NSA and other evil enterprises invoice, is to misinform/disinform, let them monitor what is useless, waste resources finding the needle in the haystack.

Basically we are in Intelligence vs Counter Intelligence game with the state.

You suspect your phone or device is listening? I know that Facebook is listening/monitoring, so I let it hear. Yes, I did go to school in Zimbabwe and have my Zimbabwian friends confirm it, and I did visit it look the GPS data in the pictures show it.

The data that facebook has about me is worthless shit in disguise as marvelous worthy data, but they do sell it well, if everyone did this, it would be obvious their data is not worth the ads they sell, facebook would crumble like a stomped on paper plane.

</comment></comment></comment></comment></comment></comment><comment><USER13> There are a lot of people on this thread crapping on Signal for its various flaws and downsides. It's nice to be smarter and more informed than everyone, but for the rest of us we really need advice about what we SHOULD do if we want a baseline amount of privacy from mass surveillance.

I'm honestly asking here--I don't have the knowledge that many in this community do about the exact risk of Signal requiring Google Play Services for example. If Signal isn't the answer, what should I and others use who require a usable, reasonably accessible to non-tech-professionals solution?

<comment><USER14> The Tox project is specifically designed to meet your usability requirements.

There were also forks of Signal which fixed the privacy issues, however Moxie Marlinspike (the founder of Open Whisper Systems) ordered them to cease and desist.

<comment><USER15> _however Moxie Marlinspike (the founder of Open Whisper Systems) ordered them to cease and desist_

Would you be kind enough to provide links? I can't find any information about this claim via Google, and Signal is distributed under the GPLv3, which grants rights to fork and modify it: [https://github.com/WhisperSystems/Signal- Android](https://github.com/WhisperSystems/Signal-Android)

<comment><USER14> [https://github.com/LibreSignal/LibreSignal](https://github.com/LibreSignal/LibreSignal)

<comment><USER15> Thank you!

tl;dr: You can fork the Signal code if you want, but if you do, Moxie Marlinspike asks you to change the app name and run your own servers. The server source code appears to be available at [https://github.com/WhisperSystems/Signal- Server](https://github.com/WhisperSystems/Signal-Server), but I've heard it doesn't include the voice component.

So, for example, if you think that Signal ought to support a feature like iMessage's "Invisible Ink" ([https://mic.com/articles/146347/i-os-10-s-invisible-ink- feat...](https://mic.com/articles/146347/i-os-10-s-invisible-ink-feature-is- stealthy-af-here-s-how-to-send-a-hidden-message)), which Moxie has specifically refused to support ([https://github.com/WhisperSystems/Signal- Android/issues/5103](https://github.com/WhisperSystems/Signal- Android/issues/5103)), then you can't just fork the client, implement it yourself, and use the new client normally, because you'd no longer be able to talk to regular Signal client if I understand correctly. I mean, even if you figured out a way for two clients to tell each other whether or not the feature was available.

So Signal is open source, but not in a way that's useful if you want to change something.

I don't want to discourage people from using Signal. It's a great app. But I thought this was worth pointing out, assuming the LibreSignal is representative of what will happen if people want to make changes to their client.

<comment><USER16> I didn't realize that open source licenses required the maintainers to run infrastructure for you.

<comment><USER17> Open source requires the ability to fork and Signal isn't forkable.

<comment><USER18> The client and the server (sans voice) are forkable. They don't need to grant a license to use their infra. You can run your own, it just won't federate.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER19> WhatsApp integrated Signal's end-to-end encryption¹ into their communications platform.

Nearly everyone I know uses WhatsApp. This change made the platform much more secure for everyone. It's on by default and works transparently. Since then, at least one government was unable to compel WhatsApp to produce messages² from users under investigation.

I also have Signal installed but nobody I know uses it so its utility is diminished. I told some friends about Signal; they installed the app but won't use it because they can't message anyone except me. The only times people talked to me via Signal was during the temporary WhatsApp blocks ordered by my country's government.

¹ [https://whispersystems.org/blog/whatsapp- complete/](https://whispersystems.org/blog/whatsapp-complete/) ² [http://www.forbes.com/sites/parmyolson/2016/05/03/whatsapp-f...](http://www.forbes.com/sites/parmyolson/2016/05/03/whatsapp- founder-brazil-shut-down-facebook)

</comment><comment><USER20> Or you could download [https://wire.com/](https://wire.com/) which allows developers to build their own clients and still use their infrastructure. Also, it doesn't force you to use a phone number for registration. It supports audio/video calls. Also, if you're really privacy minded, it doesn't need Google Play Services. That way it can be used in CopperheadOS.

<comment><USER21> Do you know how Wire makes money to sustain what they are doing?

Don't want to invest my time into something that will eventually sell out and do that opposite of what they stand for today.

<comment><USER22> Last time i checked they have no revenue possibility. So I decided to skip, I am curious on this too

<comment><USER20> There's quite an interesting discussion here:

[https://www.reddit.com/r/privacytoolsIO/comments/57n8ee/inst...](https://www.reddit.com/r/privacytoolsIO/comments/57n8ee/instant_messaging_comparison_table/d8uj3bn/)

As I see it, there's some sort of trade off for all solutions for private instant messaging right now. Wire comes close to a good solution. The biggest problem for me is that the official Android client is quite buggy, UI wise...

<comment><USER23> Fair enough critique on Android bugs, we're fixing them at a steady pace. But if you know any good Scala developers in Berlin / interested in moving to Berlin then we're hiring [https://wire.com/jobs](https://wire.com/jobs)

</comment></comment></comment></comment></comment><comment><USER24> A problem for some people with Signal is that it requires you to use a phone number, and they may not want to disclose theirs.

You can set up an SMS gateway number just for this purpose, but you shouldn't need such workarounds.

<comment><USER25> > A problem for some people with Signal is that it requires you to use a phone > number, and they may not want to disclose theirs.

That's true, although those of us with unlocked phones can purchase "throwaway" SIM cards with distinct phone-numbers fairly easily with cash, use the number for secure communications only, throw the card away, and then go back to our public lives.

<comment><USER26> That will expose your IMEI and not really protect you from people that would be tracking you based on metadata.

You gotta burn the phone.

<comment><USER25> Ah, ok, fair enough.

So other than full-on burner smartphones (ie: throw away $600 every time you need to do something privately), what's a reasonable heuristic for conducting private business? Maybe collectively owned or rented burner phones so that the metadata collector only ever knows, "Someone rented this device for encrypted communications" rather than _who in specific_ is communicating with whom?

<comment><USER27> > what's a reasonable heuristic for conducting private business?

You need to do a threat analysis.

I did not immediately find any good introductory resources via a quick Google search, but try it yourself. Very very briefly, it involves identifying the threats and their possible consequences, then working on either removing the former or minimising the latter.

Be aware that this is not merely a technological process. It is primarily a social one.

</comment></comment></comment></comment></comment><comment><USER28> My friends and I have used GroupMe (which is owned by Skype) for a few years now and some of us wanted to migrate due to privacy. We tried out Signal, but there were some major usability problems in you intend to use it as a "group chat" replacement. My biggest issue with it is that there is no mute feature for iOS. Yes you can turn off notifications at the iOS level, but I want the ability to only have @-mentions to have access to notifications.

I made us switch to WhatsApp instead as I think the usability/privacy balance was better (for our use case).

<comment><USER29> I recently switched from Android to iPhone and was pretty surprised by how much lower quality the Signal app is for iPhone than Android.

Signal for Android was really amazing, and the switch made me think this could be one reason why so many people seem to speak both highly and poorly of Signal. The iPhone app just unfortunately seems to be way behind the Android app.

Not sure why they have prioritized development in that way.

<comment><USER30> I think it's because moxie uses Android.

<comment><USER18> This is the correct answer. Moxie dominates signal-android commits. He doesn't work on the iOS version.

The programmer working on the iOS version left early this year. If you look it was pretty stagnant for awhile with him, only really getting bugfixes. Now they have a new maintainer that's been playing catchup and things really only started to get rolling in the past couple months.

See: [https://github.com/WhisperSystems/Signal- iOS/graphs/contribu...](https://github.com/WhisperSystems/Signal- iOS/graphs/contributors)

</comment></comment></comment></comment><comment><USER31> I found a weird issue on a friends phone when I suggested they download it for iOS. It says "This item is no longer available". They were able to download other apps from the store. When emailing Signal support they said nothing was wrong on their end.

Still havent figured out why my friend cant download Signal from Apple App Store.

<comment><USER32> Maybe device management or policy?

<comment><USER31> No device management policy. :/

</comment></comment></comment><comment><USER33> I'm glad that infosec has broken out of the era of endlessly debating the imperfections and faults of every solution but instead can clearly recommend practical advice for everyday users that is easy to understand.

Having the NYTimes advocate for crypto so clearly and to such a large audience will make a real and tangible difference to users - more than can be said for the years of online nitpicking by experts.

</comment><comment><USER34> _That said, Signal is not perfect. It lacks some features of other messaging apps, like the ability to send stickers._

That this is a deficiency worthy of mention reveals just how different the average person's values about what a messaging app should do are from mine.

<comment><USER35> I know multiple people who stay on Telegram because it has stickers and Signal doesn't. It's a real thing, to the point where I've considered diving into Signal's code and implementing them on top of the existing support for sending photos.

Missing feature #2: only the Android app can be paired with Signal Desktop; the iOS app is left out. What's up with that?

<comment><USER36> #2 has been implemented since September: [https://whispersystems.org/blog/signal-desktop- ios/](https://whispersystems.org/blog/signal-desktop-ios/)

<comment><USER35> Thanks for the update, I missed that!

</comment></comment></comment></comment><comment><USER37> I'm disappointed that this article doesn't mention iMessage. From what I understand, it's end-to-end encrypted and Apple doesn't have a key.

<comment><USER38> But we can't audit it because the source code is not available, which makes it a no-go for people that actually care about their privacy.

<comment><USER39> Except a pair-locked iPhone running iMessage is possibly the most secure and private device around - people that do care about their privacy (e.g. the grugq) recommend it.

</comment></comment></comment><comment><USER40> Using signal myself I think it has the best trade offs for security and user friendlyness since I have been able to convince my friends to use it .

</comment><comment><USER41> > Open Whisper Systems said it planned to add these features, noting that GIFs > are already supported in the Android version of Signal.

And iOS for a while now! [https://github.com/WhisperSystems/Signal- iOS/pull/886](https://github.com/WhisperSystems/Signal-iOS/pull/886)

</comment><comment><USER42> Why isn't anyone talking about Wire? [https://wire.com/](https://wire.com/)

The little I've used it, I found it pleasant and effective. But it almost seems like there is a campaign to ignore Wire; nearly every article written about Signal and alternatives fails to even mention Wire.

<comment><USER29> That's like saying there's a targeted campaign to ignore Skype because these articles don't mention it. You might like Wire, but it's not an app that people concerned with privacy should be using.

They have done a bunch of shady things:

1\. They lied about having end-to-end encryption in their app: [http://www.pcworld.com/article/2855745/new-communications- ap...](http://www.pcworld.com/article/2855745/new-communications-app-wire- tones-down-encryption-claims.html)

2\. They lied about being open source for years.

3\. They lied about being based in switzerland.

They also have serious problems with their app:

1\. The "encrypted" calls leak enough information to be able to reconstruct the audio.

2\. Many features in the app, like GIF search, transmit plaintext directly back to Wire.

3\. They rolled their own crypto, and experts disapprove of the choices they made.

Journalists who write articles like this and don't mention Wire are doing their job. They've consulted with experts and aren't spreading misinformation.

<comment><USER43> You can't list a bunch of serious claims like the audio can be reconstructed with no additional information. There was a feud between the Signal people and Wire, so there is a lot of false info trying to smear Wire.

GIF searches are obviously going to use a 3rd party service, and nobody should expect some kind of anonymous encrypted channel for GIF searches. That's ridiculous.

I've not seen any lying about being open source. They haven't released every piece of code, but I don't recall them ever claiming they did. [https://github.com/wireapp](https://github.com/wireapp)

I've never seen any crypto experts who have audited Wire and said there's anything wrong with their choices, and you supplied no links.

Between all the options, including Signal, I personally think Wire is best, and nothing you've provided has any reason to change that.

<comment><USER29> > GIF searches are obviously going to use a 3rd party service, and nobody > should expect some kind of anonymous encrypted channel for GIF searches. > That's ridiculous.

GIF searches aren't being transmitted to a third party service, they're being transmitted directly to Wire in plaintext: [https://github.com/wireapp/wire- android-sync-engine/blob/4d5...](https://github.com/wireapp/wire-android-sync- engine/blob/4d53351e8a60fb30d933068a25cfafc0cc2f0f8c/zmessaging/src/main/scala/com/waz/sync/client/GiphyClient.scala#L69)

There's tons of stuff like that which leaks in the app. They store your entire contact list server-side, your plaintext group membership, group info like plaintext group name and plaintext group avatar, etc etc.

> I've not seen any lying about being open source. They haven't released every > piece of code, but I don't recall them ever claiming they did.

Since their launch several years ago, they've had a "feature" matrix on their website that lists Wire as being open source (and their competitors as not being open source). That was long before their recent "open source" announcement (which still isn't even fully open source). When pressed, they said it was because they used some open source libraries. That's really shady.

> I've never seen any crypto experts who have audited Wire and said there's > anything wrong with their choices, and you supplied no links.

Here's one example I saw recently:

[https://www.cs.jhu.edu/~cwright/oakland08.pdf](https://www.cs.jhu.edu/~cwright/oakland08.pdf)

They're vulnerable:

[https://github.com/wireapp/wire-audio-video- signaling/blob/c...](https://github.com/wireapp/wire-audio-video- signaling/blob/ca718494c3091a82ebbb2d4e401f550b268dacec/src/flowmgr/userflow.c#L229)

Even worse, they also apparently include plaintext RTP headers with audio level information in them.

<comment><USER44> > They store your entire contact list server-side, your plaintext group > membership, group info like plaintext group name and plaintext group avatar, > etc etc.

One has to remember that Signal also stores some social graph data, which is equally problematic.

I can't reocmmend either.

<comment><USER29> I don't think that's true: [https://whispersystems.org/bigbrother/eastern- virginia-grand...](https://whispersystems.org/bigbrother/eastern-virginia- grand-jury/)

</comment></comment></comment></comment></comment></comment><comment><USER27> Now gents, a number of you in the comments have wondered about what other alternatives are out there. You may have seen that I specifically advise against Signal, and other users have also expressed concerns about a number other applications, amongst which Wire and Telegram.

One that, to my knowledge has not been mentioned yet, but which would _appear_ to meet some common measure of functionality versus convenience expressed here, is XMPP messaging application Conversations ([https://conversations.im/](https://conversations.im/)).

I am not going to give it my personal recommendation because having tested it, I did not like a number of design decisions the developers have made, and I did not like their overall vision for the app. With that said, it's horses for courses.

On the end to end encryption front (all the rage these days, eh?), it appears that the Conversations devs have taken Signal's protocol and _done it right_. That means, they actually specced it ([https://conversations.im/omemo/](https://conversations.im/omemo/)) and had it audited ([https://conversations.im/omemo/audit.pdf](https://conversations.im/omemo/audit.pdf)), along with a couple important improvements such as eliminating the requirement for a trusted server or Google Play, which greatly reduces the attack surface.

Again, I personally do not like Conversations and I'm not going to use it myself--that's a personal preference thing, but kudos to the devs for doing a professional job, especially while everyone else are busy selling snake oil.

I say, go give Conversations a try, it may be the thing you were looking for.

</comment><comment><USER45> One thing I'm very worried about with Signal is the high levels of permissions the app requires when you first install it.

It seems very counter intuitive,. Worried about privacy & security of your messages? Oh firstly you need to trust all your personal contact info to us. Yes they say they don't use it off of the phone, but it's asked for and that's based on trust.

On iPhone it requires access to your contact list. Surely it could run without this? Snapchat for example makes it easy to add friends in person, by scanning a code on one phone from another. How is sending unencrypted text messages announcing your social graph the only way to use the app.

Why is the app asking for so much permissions trust itself?

</comment><comment><USER46> I ditched Signal in favour of WhatsApp given I believe the tech behind it was the same and the fact that a lot of my contacts are already on WhatsApp. The NYT article indicates that WhatsApp is still able to collect more information than Signal does collect.

<comment><USER47> The difference is you never know when Whatsapp may switch off that end-to-end encryption.

Second, Signal only stores account creation date and I believe account deletion, or some other super-basic info like that. But that's it. Meanwhile, not only does Whatsapp collect much more metadata, including the groups of which you're part, but it has also started sharing that data with Facebook recently.

I'm not saying you should stop using Whatsapp, though. I still think it's a better alternative to iMessage/Hangouts/Skype/Telegram. But at the same time you should slowly transition your most important contacts to Signal, too. One nice extra feature Signal has over Whatsapp now is Snapchat-like disappearing messages, so at least you may be able to convince some friends with that.

</comment></comment><comment><USER48> For anyone wondering - this is an example of an ad posing as an article.

<comment><USER49> The mere act of using Signal is suspicious. But if usage is universal then that suspicion can not be acted on.

The suggestion that the motivation for this article is profit for the NYT or Moxie is quite destructive.

<comment><USER27> > The suggestion that the motivation for this article is profit for the NYT or > Moxie is quite destructive.

No, that's literally how it works. Media need to sell copy (clicks these days) and companies need to get coverage. And that's perfectly OK _if_ companies are acting ethically and journalists and editors are doing due diligence.

The person that you mention has good connections in the media and uses them to self-promote and promote the tat he sells.

<comment><USER49> >...tat he sells...

It's free.

And normally one would associate such vehement and repetitive insistence on counter-factuals with trolling

<comment><USER27> > It's free.

You misunderstand. He is running a company, what do you think their exit strategy is? You may want to look at his previous company and "red phone", I think was his product called.

> And normally one would associate such vehement and repetitive insistence on > counter-factuals with trolling

I am sorry that you do not like to hear this.

</comment></comment></comment></comment></comment><comment><USER50> I still haven't been able to register to Signal. It always fails with "error establishing connection with server". Does anyone want to suggest how I could get this working?

<comment><USER51> I had this issue as well until I cleared the data/cache for my Google Play services app.

<comment><USER50> Yes, I've seen people mention this. Unfortunately that didn't work for me.

</comment></comment></comment><comment><USER52> Not until this basic usability scrolling bug is fixed. Almost a year and people rarely complain about it I started to wonder if people actually use it heavily.

[https://github.com/WhisperSystems/Signal- iOS/issues/769](https://github.com/WhisperSystems/Signal-iOS/issues/769)

</comment><comment><USER53> I wish I had friends/family that were worried enough about their privacy to use an end-to-end service with me lol

</comment><comment><USER54> zkc, zero knowledge communications, was released today. It is just the first release, and a minimal tool with minimal features, but its exactly the solid foundation I have been waiting for.

[https://blog.decred.org/2016/12/07/zkc-Secure- Communications...](https://blog.decred.org/2016/12/07/zkc-Secure- Communications/)

"zkc is a blending of what we consider to be the best parts of both of these projects, Signal and Pond" "The UI is text-based and emulates the appearance of irssi, in order to keep UI-related complexity low and avoid large GUI toolkits as a dependency." "intended to provide the highest level of communications security balanced with minimal complexity in its code, configuration and usage."

</comment><comment><USER55> But downloading Signal after news like these will tag people as trying to hide something from the state.

<comment><USER11> Not only tag, but also get their identity and possibly use backdoors, because Signal is only on Google Play, which in order to access it requires a gazillion identifying data.

Signal is a joke if your adversary is NSA and its likes. You cant run Signal unless you give up who you are, and that you are using it, and its not very difficult to analyze _when_ you receiveor send a message due to the Signal requiring google messaging system.

Signal should just really rename itself to "Google Signal, no really we are not evil for certain."

<comment><USER13> Most people only have the NSA as an adversary in the minimal sense that they're caught up in a very broad mass surveillance net. It's true that if you're a whistleblower with sensitive government information Signal is not a complete solution for you. But who cares? Almost nobody is in that situation, and people in that situation have access to other tools that actually do help.

Your last sentence is extremely unfair to Signal and dramatically underrates the privacy it provides to ordinary people. It's dangerous to suggest that because it requires a phone number and lives on an app store it provides no useful protection at all, because that implies it's no better than e.g. WhatsApp when in fact it has a much better featureset.

<comment><USER4> > Almost nobody is in that situation

Almost everybody _might_ be in that situation, because the NSA is not the only group that has access to the data they collect. They call it "parallel construction", where the NSA's "customers" like the DEA simply have to fill out a form[1] to get surveillance data, and promise to lie about the source in court.

[1] [https://www.techdirt.com/articles/20140203/11143926078/paral...](https://www.techdirt.com/articles/20140203/11143926078/parallel- construction-revealed-how-dea-is-trained-to-launder-classified-surveillance- info.shtml)

</comment></comment></comment></comment><comment><USER56> How can I use Signal (on iOS) without giving it access to all of my contacts?

</comment><comment><USER27> Download Signal? No, thank you.

The fact that the guy behind it is hyping it via the New York Times, a generalist publication, instead of validating the thing through professional cryptographers (which he isn't) and recognised privacy champions such as the EFF is very telling.

The thing has not been properly validated or verified (for a start, because there is no design document to validate against, and no published goals to verify against), it uses an ad-hoc encryption scheme from a non-cryptographer, it is not open source (see F-Droid discussion why it's not there), it uses hardwired servers controlled by a party or parties which are not known to be trustworthy, and apparently it requires Google Play services, which nobody who is truly concerned about their privacy is going to use in the first place (and definitely one should not).

From the way this is going, it is becoming clearer by the day that this is just another start-up, their target market are unsophisticated but paranoid users and hipsters with no real need for privacy but who think they should make some kind of statement. Their plan is to hype it up (e.g., via the NYT), get enough users, then get bought by one of the so-called "social media" players. It is more attractive to them than Telegram because the latter is run by a Russian, which to the American public sounds sinister (Mr Brin and countless other great scientists and innovators notwithstanding), and their servers are probably based in Germany, which is a bit more of a problem since there are (still) some proper privacy laws over there, and which would cause some headaches to the acquiring party. Besides which, there is a good chance that their current investors come from those "social media", or are the usual Silicon Valley VC crowd, so things stay between friends, as it were.

So, in brief:

* If you want a new Skype, go for it.

* If you care about the privacy of your communications, you should avoid it.

* If you _need_ to keep your comms private, you _must_ avoid it.

Anyone disagrees? Feel free to reply and tell me why!

<comment><USER57> I'm probably just inviting myself to get trolled by replying to this, but this comment is just ridiculously wrong on so many levels.

> The fact that the guy behind it is hyping it via the New York Times, a > generalist publication, instead of validating the thing through professional > cryptographers (which he isn't) and recognised privacy champions such as the > EFF is very telling.

Cryptographer Matthew Green on Signal's crypto and code quality (it was called RedPhone/TextSecure at the time of this writing): [https://blog.cryptographyengineering.com/2013/03/09/here- com...](https://blog.cryptographyengineering.com/2013/03/09/here-come- encryption-apps/)

Version 1.0 of EFF's Secure Messaging Scorecard gave Signal 7/7: [https://www.eff.org/node/82654](https://www.eff.org/node/82654).

> The thing has not been properly validated or verified (for a start, because > there is no design document to validate against, and no published goals to > verify against)

Signal has been analyzed, with favorable results, by academic researchers at least twice:

\- [https://eprint.iacr.org/2014/904.pdf](https://eprint.iacr.org/2014/904.pdf) \- [https://eprint.iacr.org/2016/1013.pdf](https://eprint.iacr.org/2016/1013.pdf)

> it uses an ad-hoc encryption scheme from a non-cryptographer

Moxie Marlinspike and Trevor Perrin probably wouldn't call themselves "cryptographers," but almost anybody in the field would agree that they are experts on applied cryptography.

<comment><USER27> > I'm probably just inviting myself to get trolled by replying to this

I'm sorry that you get that impression, but I do appreciate your input.

> Cryptographer Matthew Green on Signal's crypto and code quality (it was > called RedPhone/TextSecure at the time of this writing)

That's the application that they sold to Twitter, not the one being talked about here. I do not know how different the code bases are.

It is also around that time that the app had a gaping, amateurish hole in that it was simply leaking everything via logcat. And what does the guy do? Instead of addressing the issue like a professional, he goes on a complete tangent rubbishing F-Droid ([https://github.com/WhisperSystems/Signal- Android/issues/53](https://github.com/WhisperSystems/Signal- Android/issues/53)) and then making rather poor excuses as to why you should get your application from the Google store and not from anywhere else.

Excuses which by the way, have been evolving over time. I think he eventually admitted that he wants to keep track of how many users are using it (handy to show to your potential buyers).

He also has a history of lying, such as when he used fake WHOIS details to run his "Google anonymiser" thing. And of course, when he was shut down by the registrar, as you do when someone has given you false details, what did he do? He went to the press to whine about the registrar! After he entered a contract in bad faith, something which happens to be a prosecutable offence. That's the sort of person we are talking about here. I hope you will understand if his word does not exactly fill me with confidence.

> [https://www.eff.org/node/82654](https://www.eff.org/node/82654).

That page starts with: "This is version 1.0 of our scorecard; it is out of date, and is preserved here for purely historical reasons."

And continues with: "the results in the scorecard below should not be read as endorsements of individual tools or guarantees of their security"

> Signal has been analyzed, with favorable results, by academic researchers at > least twice:

Yes, I am aware of those. And that is not what validation and verification is which, as I said, in the absence of publicly available design documents, is impossible to do independently. The guy is trying to make it look like he's selling a "secure" communication platform, but if you presented that to a defence contractor (which I have some experience with) you would be laughed out of the building. Proper security is not done like this at all. For a start, you actually define your goals, i.e., what you intend to secure, against what threats, etc., etc. If you can show me a paper with that information I would be grateful.

Notably, you may have noticed that those papers, like Green's, are a protocol analysis, not an analysis of the entire solution. In that respect, you're back to the previous situation: the protocol might be ultra-secure, but if you're still leaking your plaintext on a different channel...

> Moxie Marlinspike and [...] probably wouldn't call themselves > "cryptographers,"

At the risk of sounding elitist, what is his academic background? (I elided the other person because I do not know who he is).

> but almost anybody in the field would agree that they are experts on applied > cryptography.

What do you base that conjecture on?

<comment><USER58> >He also has a history of lying, such as when he used fake WHOIS details to run his "Google anonymiser" thing. And of course, when he was shut down by the registrar, as you do when someone has given you false details, what did he do? He went to the press to whine about the registrar! After he entered a contract in bad faith, something which happens to be a prosecutable offence. That's the sort of person we are talking about here. I hope you will understand if his word does not exactly fill me with confidence.

I really don't see why someone should be on my shitlist for lying to godaddy dot com or whatever giant registrar unless you consider fudging identifying details about something that really doesn't matter, especially considering he was very openly associated with the project, some sort of horrible moral offense. I especially find your taking massive umbridge with fudging personal information baffling given how privacy-minded you otherwise seem.

>At the risk of sounding elitist, what is his academic background? (I elided the other person because I do not know who he is).

Combined with the above, the way you're hand-waving away the other of the two original developers of the protocol really just makes it seem like the position you've taken against Signal is mostly predicated on some sort of grudge against Marlinspike himself. Yes, trashing F-Droid was not a great thing to do and you might see him as someone with a strong penchant for self- promotion, but the way you keep on tying your criticisms to Marlinspike personally really muddles your case. For example, you object to him promoting Signal in a New York Times piece saying it is a generalist publication and posit he's just trying to drum up attention so he can find a buyer, which may or may not be true, but isn't one of the most important goals of a secure messaging application to get people to actually use it and to achieve widespread adoption? The main lesson I've learned from GPG mail is that a perfectly private means of communication is worth very little if I can't actually convince anyone to use it with me.

<comment><USER27> > I really don't see why someone should be on my shitlist for lying to godaddy > dot com or whatever giant registrar unless you consider fudging identifying > details about something that really doesn't matter,

I think I can see where you are coming from. You seem to compare this with, say, opening a GMail account under an alias, if I understand correctly.

However, holding domain names and, at the time, SSL certificates requires a different sort of accountability. I can elaborate on that if you wish, but I trust it won't be necessary.

> especially considering he was very openly associated with the project,

In the same way that Mr platinumrad or Ms at612 are associated with this discussion? By the use of an alias?

> some sort of horrible moral offense.

Yes. And please note he did not just lie to the registrar. When he got caught, he went and whined to some journo who published a piece criticising the registrar without bothering to contrast the information first. It all being presented as if it was the registrar in the wrong, when they were following the rules, which are there to protect the public in the first place. This coming from some bloke who was saying "don't trust Google, trust me. Because."

> I especially find your taking massive umbridge with fudging personal > information baffling given how privacy-minded you otherwise seem.

I value my privacy. At the same time, when I enter a contract, I do so in good faith and of course part of it is letting the other party know who I am.

> really just makes it seem like the position you've taken against Signal is > mostly predicated on some sort of grudge against Marlinspike himself.

Yes, you are correct. My apologies if that wasn't clear. I question the ethics, motivation, and competence of this one individual, who happens to be closely associated with said project.

> Yes, trashing F-Droid was not a great thing to do

To put it mildly. On an incidental note and more generally, have you ever seen him do a mea culpa?

> [but] isn't one of the most important goals of a secure messaging > application to get people to actually use it and to achieve widespread > adoption?

I do not know. I would guess not (based on defence experience). But the main point is that him saying "oh sure, it's secure" does not make it secure. He seems to be taking advantage of the public's inherent credulity and lack of awareness of what "security" actually means and involves. We have gone through this discussion already, so for an example of what I consider a better developed and correctly presented security solution, please see the Conversations IM application.

> The main lesson I've learned from GPG mail is that a perfectly private means > of communication is worth very little if I can't actually convince anyone to > use it with me.

This is a different, and long discussion, but it is probable that the reason why you are seeing that is the other party having mentally (or formally) done a cost/benefit analysis and deciding that their information is not of such value to justify the extra effort to protect it. Rightly or wrongly.

</comment></comment></comment></comment></comment><comment><USER59> Any communication tool that runs on a closed-source OS like Windows or iOS can certainly not be trusted.

</comment><comment><USER60> _It lacks some features of other messaging apps, like the ability to send stickers_

That sounds like a feature more than a deficiency.

</comment><comment><USER61> Signal crashed on me day in day out. That app is junk.

<comment><USER62> They take pull requests [https://github.com/whispersystems](https://github.com/whispersystems)

There are better ways to give feedback than just saying a free app is "crap"

</comment></comment><comment><USER63> I am really interested why Signal. Why not Telegram? I prefer Telegram over Signal because of much more better UI and rich functionalities i.e. bots. Signal app seems clunky and buggy. That's my 2 cents.

<comment><USER26> Signal never shares message content with the server.

Telegram does so by default, you have to opt in to keep messages private from the server.

You also see a lot of people criticizing the design of the secure Telegram protocol and praising the Signal protocol. There were some stories about governments actively compromising Telegram's security. There haven't been any about Signal.

So if you are worried about privacy more than UI and rich functionality, the choice seems clear enough.

<comment><USER63> Yes I'm seeing a lot of people criticizing Telegram on Twitter and in media. But after doing some research I couldn't find any proof of their claims that Telegram have a broken crypto.

You can use secret chats, those messages are not stored on the company server.

<comment><USER64> It seems to be official now that Telegram has been hacked over and over again (article in German): [https://netzpolitik.org/2016/bundeskriminalamt- knackt-44-tel...](https://netzpolitik.org/2016/bundeskriminalamt- knackt-44-telegram-accounts-in-zwei-jahren/)

<comment><USER65> That's not the e2e encryption protocol that they hacked, but the SMS-based authentication and unencrypted chats that are stored on the server in the plain. The state has control of SMS, so it can impersonate you. This would seem to be a potential problem for any service that's backing itself into SMS, but here the attack would not be possible as messages aren't shared across devices on e.g. Signal and WhatsApp.

</comment></comment></comment></comment></comment><comment><USER21> Use Signal and give them access to all your contacts who may or may not be using Signal. Use their proprietary client and trust them on their pinky promise that they "can't" look at your messages. The deceptive pretense of privacy is worse than no privacy at all.

[Edit] - "Use their proprietary client and trust them on their pinky promise" was factually wrong.

But, they still expect me to trust the signed binary they send through the App store right? How is that anyway non-proprietary just because there is a Git repo somewhere that may or may not be the same code running on your phone? Can I run a client from the Git repo and still use all of their infrastructure?

<comment><USER66> It's an open source client[0]. It's not a "pinky promise".

There are valid criticisms of Signal (primarily around the use of the Google Play Services Framework), but your comment seems to be jumping to a lot of conclusions without any research.

[https://github.com/whispersystems](https://github.com/whispersystems)

<comment><USER21> But, they still expect me to trust the signed binary they send through the App store right? How is that anyway non-proprietary just because there is a Git repo somewhere that may or may not be the same code running on your phone? Can I run a client from the Git repo and still use all of their infrastructure?

Until I'm able to do that, it is still their "pinky promise".

<comment><USER67> [https://github.com/WhisperSystems/Signal- Android/wiki/Reprod...](https://github.com/WhisperSystems/Signal- Android/wiki/Reproducible-Builds)

<comment><USER21> Thanks for that link. I'll go through the build process and play with the apk.

But even if I wanted to build my own apk, and run it on my custom Android build, it would'nt work right? Because of the need for Google Play store?

Verifiable builds are atleast a step in the right direction.

<comment><USER68> Why do you need the play store? You can install apk files without it just fine, if you have the appropriate dev options enabled in your phone.

<comment><USER44> Signal requires the Google Play Services to work, and includes several proprietary libraries from Google in their app, too.</comment></comment></comment></comment></comment></comment></comment>


W3C uses invalid XHTML - <AUTHOR> https://validator.w3.org/check?uri=www.w3.org&charset=%28detect+automatically%29&doctype=Inline&group=0&No200=1 <comment><USER2> It seems that this particular mistake (a 'target' attribute in strict mode) is so common that it's the example the validator uses:

> This error is often caused by incorrect use of the "Strict" document type > with a document that uses frames (e.g. you must use the "Transitional" > document type to get the "target" attribute)</comment>


Adobe and Google enhancing WebKit for better typography - <AUTHOR> http://blogs.adobe.com/jnack/2010/11/adobes-enhancing-webkit-for-better-typography.html

<comment><USER2> :( No hyphenation, kerning or leading. Knuth and Liang solved this problem decades ago. I dislike like having to hack it with Javascript. That lack is what makes web typography ugly, even in this demo.

<comment><USER3> Yes, they solved it alright.

In an entirely different context.

<comment><USER4> Can you point out some reasons the algorithms in TeX cannot apply to reflowing text in a browser, rather than a static page? It seems like a very similar context to me.

<comment><USER5> My understanding is that the reason WebKit does not use the TeX layout algorithm is performance. WebKit has a zero-tolerance policy on performance regressions; the only way the TeX layout algorithm will make it in is if it can do so without sacrificing rendering speed.

<comment><USER2> You tempt me to try submitting a patch. I suspect it's a bikeshed problem, but I could be wrong. There is no technical reason why you couldn't enable it only on elements with a "-webkit-hyphenation" CSS rule. Then it's not a regression, it's an optional feature.

You are right that there are real perf concerns. A web page reflows multiple (sometimes hundreds) of times during pageload, unlike a print document.

<comment><USER4> TeX was designed to work on computers of the late 1970's. It seems pretty reasonable to think that algorithms that were practical to execute then can be carried out more or less instantaneously on machines available today. If you think you can pull off a port, by all means try.

</comment></comment></comment></comment></comment></comment><comment><USER6> This is an interesting demo, but it seems to focus more on "whizzy" things, instead of fixing more basic problem.

Now, in their defense, I thought the baseline alignment idea was pretty good. But if you look at their first demo of the "callout" text, you'll note that there are horrible rivers (open spaces) running through the type, making it look all clunky.

What's really needed is a straightforward wysiwig layout tool (like Quark or Illustrator, for example) that can generate clean CSS layouts.

</comment><comment><USER7> Interesting response in the comments section

[http://bureau.tsailly.net/2010/11/wow-adobe-is-really- cool.h...](http://bureau.tsailly.net/2010/11/wow-adobe-is-really-cool.html)

<comment><USER8> That article would have been a lot more useful if they reduced the snark. Thank you for linking it though.

<comment><USER9> Snark indeed. All of paragraph 5 could have been left out.

 _As for the communication part, there is a name which, because it is omitted with so much efforts, can only be noticed: Apple. They are working with Google to enhance Webkit, not Google and Apple, the originator of Webkit._

Apple was, apparently, so slighted by this ommission that we have to forget that Apple derived the WebKit code from KHTML. "Originated" is kind of a strong word.

<http://en.wikipedia.org/wiki/WebKit#Origins>

<comment><USER10> Snark indeed.

</comment></comment></comment></comment><comment><USER11> The least they could do is have the q tag render with smart quotes. This is already handled in Firefox properly.

<comment><USER12> > The least they could do is have the q tag render with smart quotes

Fuck no. I will decide on the fucking quotes I want around my quotes, unless you decide to cleanly and perfectly support all international quote style guides[0], you do not touch the content I create and you do not start changing my quotes.

[0] [http://en.wikipedia.org/wiki/Quotation_mark,_non- English_usa...](http://en.wikipedia.org/wiki/Quotation_mark,_non- English_usage)

</comment></comment><comment><USER13> Web kit is a fail that has a tiny percentage of the browser use. Safari has too small of a % to be relevant (except mobile obv), and Chrome just screws up too many small things (despite being an otherwise overwhelmingly better browser than the alternatives).

<comment><USER12> > Web kit is a fail

How?

> that has a tiny percentage of the browser use

Yeah, on the desktop, now consider the fast-growing mobilespace.

iOS? Webkit. Android? Webkit. WebOS? Webkit. Blackberry 6? Webkit. Bada? Webkit.

And they're making deep inroads in libraries (QtWebkit, which means all of Nokia's future is likely linked to webkit as well) and embedded in software (Steam switched fully to webkit a while ago).

Webkit definitely isn't "a fail". Not in the long run (it will keep growing in importance) but not right now either, it's given a good kick to the 'nads to the Mozilla team, it iterates and develops fast (and is a standard driver), it's where innovation now happens in the OSS browserspace (the other source of innovation being mostly Opera) and the sole reason we have mobile browsers worth using these days is webkit. Webkit is a resounding success considering the first public release was 7 years ago and pretty dreadful.

<comment><USER13> I guess you ignored the part where I said except mobile obv.

My biggest issue with webkit is that there was a perfectly fine rendering engine to begin with that both Safari and Chrome could've simply built a new UI around. Instead they gave us yet another OS to support.

Web developers complain all the time about supporting multiple browsers, yet support web kit?

And for the record, steam is a great example of what I'm talking about: completely mediocre rendering performance for really simple tasks (essentially a web browser). It's shocking how bad web content looks in steam, I'm kind of surprised you even brought it up.

Yes - Webkit long term will be good, it can't not (even IE9 is looking alright at this point). Right now though (ruling out IE6), > 50% of my web dev cross browser issues are dealing with web kit, not IE7+, and for a much less significant audience (ie: expensive).

So you're right, it's not a "fail," but I think how great the response is to it is really disproportional. I REALLY want to love chrome etc but I just can't - it's not ready yet.

<comment><USER14> > My biggest issue with webkit is that there was a perfectly fine rendering > engine to begin with that both Safari and Chrome could've simply built a new > UI around.

You're right, there was. It was called KHTML, and they did.

<comment><USER13> <http://en.wikipedia.org/wiki/Gecko_%28layout_engine%29>

Not that it really matters for the sake of the argument, because my point was that gecko was widely used already whereas KHTML was not and so they should've used it instead, but gecko was also around before KHTML.

<comment><USER15> When Apple announced that they were going to use KHTML in Safari (when they announced Safari) they stated that it was due to the library's small footprint. I assume that they didn't want to spend the time to reign in the Gecko engine to do what they wanted it to do (or hack/optimize it down to size).

Just because something exists and seems to be 'good enough' doesn't necessarily mean that it would be a good fit. Unless you develop for WebKit, Safari, Firefox and/or Gecko, I'm not sure any of us are really qualified to make those kinds of statements. Also remember that you can't compare the current state of the two codebases. You have to compare the state of the codebases at the time that Apple created Safari/WebKit.

<comment><USER13> Agree to disagree, but I hope you don't complain about browser fragmentation.</comment></comment></comment></comment></comment></comment></comment>


How to install Sublime Text 2 on Ubuntu 12.04 (Unity) - <AUTHOR> http://www.technoreply.com/how-to-install-sublime-text-2-on-ubuntu-12-04-unity/

<comment><USER2> Great; now please submit this to the Sublime Text folks so they can work on creating an actual installer, if that's possible.

There's something permanently frustrating about the time involved in setting up anything other than the core software, every time I try to migrate over to Linux from Windows. And so I keep getting bounced back. Sublime Text doesn't look too bad; but multiply that by 20 and throw in a few real doozies, and I simply don't have the spare time to dedicate to setting up a Linux desktop that does what I need.

<comment><AUTHOR> As far as I know, Sublime Text is made by one person. And it's totally understandable that he's putting all his time into Sublime Text's features.

With all the distros out there, having an installer for each would be quite intense.</comment></comment>


RIP OG Pixel: Google ends support after three years - <AUTHOR> https://arstechnica.com/gadgets/2019/11/rip-og-pixel-google-ends-support-after-just-three-years/ <comment><AUTHOR> What security options are there for people whose Pixel hardware is doing just fine?</comment>


MongoHub - MongoDB GUI administration tool for mac - <AUTHOR> http://mongohub.todayclose.com/ <comment><USER2> Just tried it out and it seems pretty smooth. Anybody know what kind of testing it's gone through?

apparent windows version: <http://api.appcelerator.net/p/pages/app_page?token=p4jmAb33>

<comment><USER3> It's smooth till you try start typing JSON queries, and has parse errors and won't tell you what the problem is, etc. Fairly annoying if you do inserts/updates of any sort of complexity (nesting, etc).

</comment></comment><comment><USER4> Any recent updates? This thing was pretty terrible last time i tried.

RockMongo is the best tool I've found. It's webbased but its simple, fast, and works. I'd welcome a decent native app admin tool though if it worked.

<comment><USER5> <https://github.com/fotonauts/MongoHub-Mac>

This version is based on the original MongoHub and it's supposed to be more solid. Done by one of my coworkers. He is quite active on the tools, so feel free to make feedback here.

However, no binary here, you have to build the tool...</comment></comment>


The Fake 'Asian' Who Fooled 18th-Century London - <AUTHOR> http://www.theatlantic.com/international/archive/2014/04/london-forgotten-aryan-asian-fraudster/361035/?single_page=true

<comment><USER2> I wrote an academic journal article about this guy! It's interesting how often his story bubbles back up into popular consciousness in different contexts. In fact that continual repackaging of his narrative is in part what the article is about, along with the transmission of his invented language which is sort of like a Borges story before Borges:

[https://www.academia.edu/4042982/No_Man_Is_an_Island_Early_M...](https://www.academia.edu/4042982/No_Man_Is_an_Island_Early_Modern_Globalization_Knowledge_Networks_and_George_Psalmanazar_s_Formosa)

There's also this is a popularization of it that I wrote in 2013. His drawings of supposed "Formosan" (Taiwanese) townsfolk are worth checking out:

[http://theappendix.net/issues/2013/10/made-in-taiwan-an- eigh...](http://theappendix.net/issues/2013/10/made-in-taiwan-an-eighteenth- century-frenchmans-fictional-formosa)

</comment><comment><USER3> Here's all of the foreshadowing sentences. Now you can read them three times. Enjoy:

Nobles and rich merchants invited him to their dinner tables, where he spoke gibberish while inhaling mouthfuls of bloody food. There was simply no conceptual framework in place to ask the question, "Aren't you Caucasian?" The book contained illustrations of Formosan clothing, architecture, and a grill used to roast the hearts of little boys. He wrote 12 hours each day and sustained himself with 10 to 12 drops of opium mixed with a pint of punch.

</comment><comment><USER4> It must have been both exciting and frustrating to have lived in a time when there was so much unknown waiting to be discovered and yet, such limited knowledge of the world.

<comment><USER5> you've just described 2015.

</comment></comment><comment><USER6> Chung Ling Soo took this to the next level. He was an American magician who performed, and lived his life, as Chung Ling Soo for several decades. He died when he failed to catch a bullet.

[http://en.wikipedia.org/wiki/Chung_Ling_Soo](http://en.wikipedia.org/wiki/Chung_Ling_Soo)

</comment><comment><USER7> This and many other interesting stories can be found in cartoon form in "The Big Book of Hoaxes: True Tales of the Greatest Lies Ever Told!" (Factoid Books)

</comment><comment><USER8> > Although some ethnic distinctions existed during this period—such as the > difference between light-skinned northern Europeans and sub-Saharan > blacks—modern categories of race didn't yet exist. There was simply no > conceptual framework in place to ask the question, "Aren't you Caucasian?"

This sounds a little silly to me. From the way European and Arab chroniclers describe the Mongols and their appearance, it seems that people back then had a more than robust enough system of racial categorization to separately classify East Asians. More likely Taiwan was simply such a remote, alien place to Europeans that almost none of them had sufficient first- or second-hand knowledge to call Psalmanazar's bluff.

In fact, I suspect that the quoted sentence expresses the author's primary motive for even writing this piece in the first place; namely, to argue - contrary to the entire field of population genetics - that categories like "white" and "Asian" are wholly arbitrary social constructs and that races (or at least white people) don't really exist.

<comment><USER9> I suspect the author's primary motive for writing this piece is further down the page:

> This post is adapted from Kembrew McLeod's new book, Pranksters: Making > Mischief in the Modern World, published by NYU Press on April 1.</comment></comment>