Opera's $1.2B sale: Shocking underdog victory or cruel twist of fate? - <AUTHOR> http://venturebeat.com/2016/03/17/operas-1-2b-sale-shocking-underdog-victory-or-cruel-twist-of-fate-21-years-in-the-making/ <comment><USER2> The way Qihoo 360 operates should give anyone pause: [https://www.techinasia.com/360-safe-browser- malware](https://www.techinasia.com/360-safe-browser-malware)

Stolen recolored IE icon, sneaky installs, difficult/impossible uninstalls, fake "security" ratings, etc.

<comment><USER3> Stated in another thread on Opera's sale, but to restate and reaffirm: anything that involves Qihoo|360 in a name should be instantly removed from your system. It is self-spreading malware. Source: Dealing with this malware on a daily basis. It replicates itself from USB stick to plugged in phone.

360/Qihoo is, in every sense of corporations or individuals seeking any semblance of control of their device, a heathen.

Edit: Live in China. Work for privately held Chinese company. Enforced removal of this 360 entity from company.

</comment></comment><comment><USER4> I used Opera from ~2000, way back when it was still ad-supported. It always amazed me that they managed to provide a top-notch web browser, a passable BitTorrent client, newsgroup client, FTP client, IRC client, and email client... all inside one 4 MiB installer package. I stopped using it the moment they switched to Chromium and blew away all the features that made it unique.

Vivaldi aside, hopefully any remaining talent that still works at Opera will now finally be free to go create more kickass software.

<comment><USER5> Which is a testament to the industry's ability to fill any and all hardware improvement with more overhead unfortunately. If you compare what 1990s demo mags did on floppy disks vs the resources it takes to render a 2016 web page, it's hard not to feel like we're failing as software developers. All the dynamic features and scriptability can be had with a system that fits on a floppy disk if only we valued it but we don't. These things do and did exist but didn't have the marketing department like, say, Sun Java. And one of Niklaus Wirth's peers made a Java (with applet plugin) alternative in the 90s as a direct competitor that was a huge improvement and got no traction. Instead of using faster internet connections for richer content we fill it up with different (i.e. less efficient) ways of doing the same thing. When I see that the most trivial mobile app package is larger than 50MB, it's impossible to respect what the industry as a whole views to be good software. Take Qt5's 30MB base memory overhead for a simplest of simple Qt windows. How is that acceptable?

<comment><USER6> Web Pages themselves are far heavier and more complex than they were in the 90's

<comment><USER5> Isn't it a failure of HTML+CSS+WebFoo when the supporting assets are 10 or 20 times larger than the content to be consumed? Pages loading megabytes of JavaScript, fonts, and large images and videos just on the landing page. I think we lost it completely when we started to fetch JSON and render it locally via JavaScript. The whole concept of HTTP GET was nullified that way.

<comment><USER7> CSS basically turned the whole thing into a crappy apps UI, though the appification of the web honestly started back when Microsoft and Netscape was battling for control over the intranet (and likely why anything and everything is layered on top of TCP/IP these days, for better or worse).

In a way we have come full circle. The personal computer came to be because accountants was fed up begging sysadmins for time on the mainframes. And with CSS and JS "powered" web sites we have returned to the era of the graphical terminal.

<comment><USER5> It's even worse than TCP/IP only, it's mostly HTTP only these days. Things like SCTP got pushed into niche use and we're reinventing SCTP on top of HTPP(2) on top of TCP on top of IP.

I'm hopeful to see the trend go back though, if it's really a circle :).

<comment><USER7> Yeah i know. We seem to have turned HTTP into TCP, and use it to carry various ad-hoc "protocols" encoded in JSON.

Part of that i think we can blame firewalls, as most often they block everything but HTTP(S) by default.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> Would be sad if it goes through. I recently found my receipt for an Opera licence (which I must have bought some time in the 90s). It was amazing back then just to have an alternative to IE. All today's browsers are indebted to Opera. E.g., they were the first to use tabbed browsing.

<comment><USER9> > E.g., they were the first to use tabbed browsing.

That's open for discussion They had MDI at first, not proper tabs. Other early browsers with tabs include NetCaptor (1997?), and iBrowse2 (Amiga; 1999). Phoenix (what became Firefox) also had what we'd consider tabs today in September 2002, while Opera first got that in November 2002.

So it boils down to whether or not you consider an MDI based interface equivalent to tabs. Personally, I don't - MDI was one of the things that kept me away from Opera back then..

<comment><USER7> Opera used MDI until the last days of version 12.

The tab bar was basically added as a means of easing switching (though control tab was always an option).

</comment></comment></comment><comment><USER10> I've been using Opera on a Macbook for about a year, and have been generally happy with it's configurability although it has worse battery life than I'd like. I switched to it when Chrome mucked up the "click-to-play" function: [https://productforums.google.com/forum/#!topic/chrome/xPcpRB...](https://productforums.google.com/forum/#!topic/chrome/xPcpRBzyPcc)

But like many others, I'm thinking this acquisition might be a good reason to switch again. I've been trying out Safari today. I appreciate how "snappy" it feel, and it seems more processor-efficient as well. Scrolling on Reddit (among other sites) quickly caused the fans to roar for Chrome and Opera, but Safari doesn't seem to break a sweat.

So far, the thing that bothers me most is that my fingers are currently hard wired to shift-click links when I want to open them in a new window. And every time I do this, Safari silently "lobs" the link into the hidden reading list rather than opening it. Is there any way to configure Safari to have shift- click open a new window, or do I have no choice but to retrain my fingers?

ps. I was excited to see that the HckrNews extension works well on Safari: [http://hckrnews.com/about.html#extensions](http://hckrnews.com/about.html#extensions)

<comment><USER11> On Safari, you use Cmd+click to open a link in a new tab. I don't think there's an easy way to change that.

<comment><USER10> Yes, by default. I tend to remember that immediately after I unintentionally add another link to the Reading List. I'm sure I can change, but it seems like I only just got comfortable with shift-click after switching from ctrl-click a decade ago.

I was very happy, though, to see that on the Preferences/Tabs settings I can set Command-Click to open in a new window rather than in a new tab. I was hoping there might be a hidden "non-easy" way to reconfigure this too.

</comment></comment></comment><comment><USER12> Opera was my favorite web browser back when they used Presto and they had a social network (My Opera). Now Opera is more or less just a Chromium skin.

R.I.P. Opera

<comment><USER13> I felt the same until I realized that all I really wanted was Chrome without all that Google-goo all over it. That's Opera in a nutshell.

<comment><USER14> Just out of curiosity what are you referring to when you say "Google-goo?" Does chromium not fit the need?

<comment><USER15> Not the OP, but when you're required to create a google account just to install an extension, I would say 'no'.

<comment><USER16> I just opened [https://chrome.google.com/webstore/category/extensions](https://chrome.google.com/webstore/category/extensions) on Chromium, signed out of my google account, and didn't have a problem installing an extension.

<comment><USER15> You're right! I just fired it up and was able to install Advanced REST Client (the only thing I regularly use Chromium for) without logging in.

When I first installed it - less than a year ago - that wasn't possible.

</comment></comment></comment></comment></comment></comment><comment> Digit-Al Firstly a disclaimer: I'm not a user of Opera myself - I tried it back in the day but found some parts of the interface a bit unfriendly to my conditioned ways (can't remember what now).

I'm a bit surprised by those saying they are now going to uninstall it because it is owned by a Chinese ad company. Firstly: did you actually read the article? The sale hasn't actually happened yet. The article clearly states > the executives noted (several times in our interview) that it must still win shareholder approval and likely won't close for several months.

Secondly: It seems to me that the Opera developers have earned a certain amount of 'benefit of the doubt'. Surely, if you support the browser and the developers then the best course is to keep using it and then when the deal goes through keep a close eye out for any evidence of the new owners trying to coerce the developers into abusing their users. It seems to me that the devs would be highly resistant to such proposals and that any attempt to force the matter could lead to one or more high level defections. I could be wrong though - but as users of the software: what do you think?

<comment><USER17> It's not open-source, so you're essentially trusting a binary install with auto-updates. I was fine with it until now, not sure I will be if the sale goes through.

<comment><USER6> From what I've seen Opera seems pretty confident that they will remain an independent company operating out of Norway (and therefore subject to Norwegian privacy laws which are pretty strict). I probably wouldn't be too worried unless they move the actual development of the browser from Norway to China

<comment><USER18> > I probably wouldn't be too worried unless they move the actual development > of the browser from Norway to China

It's already mostly in Poland.

</comment></comment></comment></comment><comment><USER19> For people looking at alternatives check Vivaldi. [https://vivaldi.com/](https://vivaldi.com/)

It's made by some of the original team.

I will probably miss Opera Mini the most though, Vivaldi does not have a similar product.

<comment><USER7> sadly yet another Chrome clone for speed of development.

<comment><USER19> Yes, resources seem low on their end, but fingers crossed.

</comment></comment></comment><comment><USER7> I get the feeling this was in the cards when the remaining founder left the company a few years back. Soon after they ditched the Presto driven browser that had been with Opera since the founding, and replaced it with a reskinned Chrome.

Frankly i would use the release of their Coast concept demo as the turning point of the company. From that point on designers and MBAs ran the place, not engineers.

Its is really jarring to see Lie claim that going Chrome helped the standardization effort. At this point in time i no longer trust his judgment on things web tech.

</comment><comment><USER20> Opera is still the best mobile browser. Period. Cannot trust to use it now though.

<comment><USER21> I noticed that there "traffic-saving" proxy started to redirect direct links to images on [https://i.imgur.com](https://i.imgur.com) to the full-ad-crap pages [https://www.imgur.com](https://www.imgur.com). Has anyone noticed the same? It does not always happen, might be referrer based.

<comment><USER22> Imgur does that, based on referrer: [http://minimaxir.com/2014/02/moved- temporarily/](http://minimaxir.com/2014/02/moved-temporarily/)

<comment><USER21> I noticed it at least on Reddit. Surely that would be their death note if Imgur did it?

</comment></comment></comment></comment><comment><USER23> Opera should have open sourced their old Presto code (browser and email client). The Opera 15 browser is based on Chromium. Now the sold to a Chinese company known for adware/malware, that chance is gone. The old Opera was pretty good for its time, and a community could have formed around it.

Some former Opera devs are working on Vivaldi, a promising Chromium based browser that has an HTML5 based UI. Though, it's not open source.

<comment><USER24> As far as I remember they had too many dependencies that weren't open source friendly for that move. At least I think that was the reason given back then.

<comment><USER23> I doubt that is true.

They ported the Opera browser to very exotic platforms, like Nintendo DS, Wii, and many other devices I never even heard of: [https://en.wikipedia.org/wiki/Presto_(layout_engine)](https://en.wikipedia.org/wiki/Presto_\(layout_engine\))

With multiplatform codebase, you try to keep the dependencies to a minimum or even rely on just C++ and the platform sdk.

<comment><USER25> It might have included a large amount of licensed code. They could edit and port it, but not relicense it.

</comment></comment></comment></comment><comment><USER26> Just before the sale (a couple months before), Opera acquired SurfEasy .. a Canadian VPN service. I wonder what the SurfEasy folks think of this deal?

[https://www.surfeasy.com/en/](https://www.surfeasy.com/en/)

</comment><comment><USER27> Now owned by Chinese ad company delete delete delete

<comment><USER28> Does it really matter?

USA and its 3-letter-organizations got much more power on spying on users worldwide.

<comment><USER5> It's probably safer to use software from Russia, China and the USA at the same time. Why trust any entity more than the other unless you're affiliated with one's government body in some way.</comment></comment></comment>


Watch demos all day [video] - <AUTHOR> http://tv.pouet.net/ <comment><USER2> Can you offer a separate work-safe stream? I have a monitor with this fullscreen in my open office and I had to shut the screen off temporarily when one demo had a very pornographic image for a scene. Whichever one was on before 'Magic Show' that's running right now. I think it was 'Revenge'

<comment><USER3> Thanks for the warning! If this is the case the link should have a (NFSW) tag.

</comment></comment><comment><USER4> What was missing for us "old skoolers" so as to get back in touch with all those great demos in the demoscene.

<nostalgia>

I remember when I was downloading the Hornet archive (now at [https://hornet.org/](https://hornet.org/)) or demos from The Scene ([http://scene.org](http://scene.org)) using the university connection back in the 56K modem days.

I still remember my first time, Second Reality by Future Crew :-)

Unfortunately due to lack of time my last contact with the demoscene was with Iconoclast by Andromeda Software Development ([http://www.asd.gr](http://www.asd.gr))

</nostalgia>

<comment><AUTHOR> You might even remember when the hornet archive was hosted out of a random ftp server at the University of Florida.

I access it for a couple years via a gopher client installed on the 20-minute free dial-up internet account I tricked my local school district into giving to me.

hornet.eng.ufl.edu

</comment></comment><comment><USER5> Ah the nostalgia :)

Another modern kinda "demo scene" is [http://www.shadertoy.com](http://www.shadertoy.com) \- and a lot of the same people :). Enjoy :D

<comment><USER6> I'd like to see some kind of shader demo category, like 1k GLSL or something :D!

</comment></comment><comment><USER7> If you're new to the scene take heed of the warning, the video's cannot do the best of these justice, codecs just cannot convey the fluid high resolution impact of the real deal. If you get the chance install and run a few :)

<comment><AUTHOR> To this point, here's a recent production that's been nick named "the Codec Destroyer" due to the way its visuals seem to exploit weaknesses in a great many video codecs

[https://www.youtube.com/watch?v=fFs4d7npoyM](https://www.youtube.com/watch?v=fFs4d7npoyM)

</comment></comment><comment><USER8> If you're a fan of demoscene music, see Nectarine Demoscene Radio at [https://www.scenemusic.net/](https://www.scenemusic.net/).

</comment><comment><USER9> Don't worry, I've been failing to release new stuff since 2002 but I still enjoy keeping up with the latest releases.

<comment><USER10> I released something in 2015, after not having released anything since 2002. Hardest part was trying to figure out what groups to greet :)

<comment><USER9> Haha, I can imagine. Although the scene is definitely a bit less lively than it used to be, there are still a lot of nice things being released.

</comment></comment></comment><comment><USER6> If you are interested in today's* state of the demo scene, check out the documentary "Moleman 2 - The Art Of The Algorithms (2012)":

[https://www.youtube.com/watch?v=iRkZcTg1JWU](https://www.youtube.com/watch?v=iRkZcTg1JWU)

*Granted, it's 5 years old, but still awesome :D!

</comment><comment><USER11> The scene is not dead. On the contrary.

</comment><comment><USER12> A full screen of something from "demoscene 2017" with an HD filter then autoplay, muted with a mix on for audio, can work great for parties.

</comment><comment><USER13> Nice!! ..if one watches long enough Phalanx/Atari ST demos should appear.

Made a number of screens in that group around 1990 :-)

</comment><comment><USER14> I have no idea what the hell I'm watching. But it's interesting.

<comment><AUTHOR> The demoscene is (in my opinion at least) one of the first true global digital art movements and what I believe is the 3rd great software movement of the computer revolution (after commercial, and open source). As an art movement it's now nearing half-a-century old, has multiple sub-movements, produces visual, audio and in some cases physical art. It started in the piracy scene, computing's version of graffiti, but a bit like how some graffiti is turning into a serious art form, the demoscene broke away from piracy and is slowly moving towards high art legitimacy.

It's virtually unknown due to it being almost impossible to monetize in the way traditional art movements have been (where a single instance is made by an artist and you can purchase and own that one "true" instance, all other versions are just copies). It doesn't seem to have strong political or philosophical aims like many art movements do. Most "demos" are produced by small teams operating almost entirely under pseudonyms so single authorship and artist identification is also very hard to pin down.

The art is usually highly abstract, or plays with familiar forms in abstract ways. If there's a statement to be made it's usually in terms of create productions that push what we think computing can do, and to do it in a way that's not of any particular use to purely commercial or utilitarian interests.

Demoscene music has a variety of identifiable subgenres, often based in non- scene genres, but with several identifiable themes that don't generally exist in non-demoscene music.

It has some loose "rules" for what is and isn't a demoscene production, but it's kind of like pornography, you know it when you see it (or hear it). There are literally hundreds of thousands of productions.

[https://en.wikipedia.org/wiki/Demoscene](https://en.wikipedia.org/wiki/Demoscene)

[https://www.scenemusic.net](https://www.scenemusic.net)

[http://www.scene.org/](http://www.scene.org/)

[http://www.pouet.net/](http://www.pouet.net/)

</comment></comment><comment><USER15> Great. I love these, and there are so many. This is a nice treat.

</comment><comment><USER16> Awesome!</comment>


Basics of launching a successful ICO and avoiding major mistakes - <AUTHOR> https://www.devteam.space/b…/how-to-launch-a-successful-ico/ <comment><USER2> * use anonymous or fake team.

* promise big.

* have unfortunate accident "losng" all funds and dissolving venture.

* girls, cars, clubs, cocaine.</comment>


Bitcoin is the Linux of payments. And its killer apps will be for US dollars. - <AUTHOR> http://blog.streeteye.com/blog/2013/12/bitcoin-is-the-linux-of-payments-and-its-killer-app-is-the-us-dollar/

<comment><USER2> Op should read more about btc protocol. They are talking nonsense. Mining is required to verify transactions, new coins are a secondary effect to incentivize it.</comment>


JQuery Blueprint - a js templating framework in just 30 lines of code. - <AUTHOR> http://github.com/bunchesofdonald/jquery-blueprint

<comment><USER2> Have you seen <http://beebole.com/pure/> before?

<comment><AUTHOR> I hadn't... but it still looks like it does far more than I want. But it does look like it might be one step up in functionality, for those who want just a little more control over the rendering process.

<comment><USER3> PURE had ~50 lines when starting, but then the real life came with its clunky browsers, various libs and functionality needs.

</comment></comment></comment><comment><USER4> Have you seen <http://code.google.com/p/trimpath/wiki/JavaScriptTemplates>?

</comment><comment><USER5> care to elaborate how it compares to other js templating frameworks? (ie. features, speed)

<comment><AUTHOR> As far as features, there aren't many. I'd looked at all the other js templaters and they all seemed to do too much, IMO. I just wanted one that would take an html template, let me give it a data object, and have it render it into an element on the page.

Speed wise, I haven't benchmarked it, but it uses regex (admittedly not the best way) and jquery.append() to do the heavy-lifting, that combined with the fact it's doing very little, it should be very fast.

I'm working on making it parse the template first that way I can get rid of the regex, or at least minimize it's usage.

</comment></comment><comment><USER6> But why?

<comment><USER6> Sorry I don't mean to be cheeky, I seriously want to know what the application of this might be, can't see a real-world example.

<comment><USER7> Templating systems are pretty useful and used in quite a few frameworks. Alot of the controls in ASP.NET basically work as templates where you define the markup and bind a list of data to the control the markup (template) is repeated for each piece of data. This is relatively easy on the server side, but on the client side it's a bit more difficult.

If you wanted to create a realtime twitter client, for example, done all on the client you'd need to fetch a collection of new tweets periodically and render them in JavaScript. Without a templating framework, you'd have to loop through the new tweets and construct the presentation using something like "innerHTML" or "document.createElement()". A templating system allows you to construct the layout of a single tweet in standard HTML, mix in a bit of the template's JS syntax, and then essentially "bind" the list of new tweets to the template and the markup is repeated for each new tweet.

Given that example, there are plenty of uses that follow the idea of replicating content over and over using the same template: Email clients, chat clients, news readers, blogs, photo galleries, classified listings, etc, etc.

<comment><USER6> Ah, very useful :) Thanks.

</comment></comment></comment></comment><comment><USER8> gist: replace</comment>


Ask HN: Has anyone created a useful Facebook Bot? - <AUTHOR> I'm just curious if anyone here has created a useful Facebook Bot for your organization or business?  Right now, I am making one for my church to send out automated notifications for what is happening in the week.  We have an app, but it turns out nobody really looks at it so hopefully the Facebook Bot would have greater engagement.  Just curious how others are faring out there. <comment><USER2> Hello,

I will try a bot as a/this weekend project.

However my first chat with Poncho was not too great : [http://imgur.com/S4iJsw3](http://imgur.com/S4iJsw3)

<comment><AUTHOR> Interesting. I'm guessing some of these bots aren't built on natural language processing, but instead keyword parsing?

</comment></comment><comment><USER3> I had a genius idea for a Facebook bot: customer relationship management for lifestyle service companies (think hairdressers, photographers, even Realtors). These businesses don't want to use extra software, and the overhead of entering customer information into yet another website/app is too much. However, they are probably already on Facebook because that's where their customers are. If a bot could push them notifications about their customers, and be properly tied in to open graph, I think it would be revolutionary.

I'm not in the crm space, and i don't use Facebook, so I'm not going to build one. My two cents.

<comment><USER4> you'd run into the problem of building on top of fb's platform and they can kill it any second

<comment><USER5> That's true for all bots though, isn't it?

</comment></comment></comment><comment><USER6> I have made a Facebook bot that gets you HN stories (TOP/SHOW/ASK). Facebook didn't accept it.

<comment><USER7> Did they give you a reason as to why it was rejected?

<comment><USER6> They said that the interaction's quality dosn't meet their requirements.</comment></comment></comment>


Good engineering managers aren't just hard to find – they don't exist - <AUTHOR> http://venturebeat.com/2014/02/13/good-engineering-managers-arent-just-hard-to-find-they-dont-exit/

<comment><USER2> A lot of managers have become managers because they had "enough" with keeping up with all the technologies and writing code.

Most organizations actually favors this model where you had a good productive engineer who is now either burned out or has reached limit for growing and updating skills. The only way to move forward in their career is switch to being manager where they don't have to show great chops at coding anymore.

Consequently, the secret to finding great managers is just this: Ask them what code they wrote in past year, what feature they shipped on their own, how much code they expect to write in their new job and so on.

</comment><comment><USER3> [On good engineers]

> _Taking on the role of a manager means giving up time doing what they love — > solving challenging technical problems — in exchange for what they see as > taking out the trash every night._

I can't help but feel that there is more than just a kernel of truth in this otherwise cynical statement. I feel that I fall at least in part to this group - while I try to manage engineers, I constantly have this nagging feeling that I am not doing enough. After all, there are things to be done in the code world that require attention and nobody has the bandwidth.

It's a terrible feeling.</comment>


McKinsey Faces Criminal Inquiry over Bankruptcy Case Conduct - <AUTHOR> https://www.nytimes.com/2019/11/08/business/mckinsey-criminal-investigation-bankruptcy.html <comment><USER2> McKinsey's practices are becoming more and more worrying as the company is coming under the limelight.

I can't forget their shady practices in South Africa which they tries to hide and NY Times aired them out and then they started complaining that the paper was targeting them.

Here is the piece: [https://www.nytimes.com/2018/06/26/world/africa/mckinsey- sou...](https://www.nytimes.com/2018/06/26/world/africa/mckinsey-south-africa- eskom.html)

</comment><comment><USER3> Knew some people worked with them. IIRC they're one of the outfits that refuses to hire anyone but ivy league grads and as a result, every time you go into a conference room with them they immediately initiate a dick measuring contest in one form or another.

They were not well liked...

<comment><USER4> Had a similar experience with some people I studied with (full disclosure: i went to one of the top b schools) who ended up going there. I was sitting and having dinner with them about their internship and how they liked the job etc, and they seem to be fascinated with how consultants wore 4k+ suits and had platinum memberships on airlines...

<comment><USER3> The airline status is just because they spend their lives flying every week. More of a curse than a blessing...

</comment></comment></comment><comment><USER5> The big consulting firms provide all of the same services as big law firms and big accounting firms and to some degree the services of big investment firms. The only difference is they operate without any minimum standards of ethics or oversight whatsoever.

<comment><USER6> > The only difference is they operate without any minimum standards of ethics > or oversight whatsoever.

The real question is whether they make more money doing it this way. And I suspect they do.

</comment></comment><comment><USER7> It's amazing the amount of criminality that seems to originate in this once august institution. Repeated insider trading scandals and now this. And the malfeasance usually stems from the top. I'm surprised they still have much of a reputation at this point.

<comment><USER8> Well their reputation is mainly among those who also feel rules need not apply to them.</comment></comment>


Ask HN: The worst cost reduction initiative you've seen/been part of? - <AUTHOR> For context - I'm an engineer turned sales turned corporate finance guy. As I am grinding through another annual budget and planning season, I realize I am out of ideas to tighten our budgets more.
I'd like to think it's not because I have so much empathy for the teams I used to work for, that I find all of their asks reasonable. I have cut what I considered wasteful and unnecessary. So I think it's just a lack of imagination and force on my part to cut more.
I'd like to source some ideas from you smart bunch here, there must be something I haven't thought of yet. Either high-level ideas (e.g., training programs) or specific examples ("team building" happy hours) are really appreciated...
And as the title suggests, more importantly, I'd like to learn about your experience with cost-cutting gone wrong, so I can avoid paying more in the end.
Thanks very much in advance. <comment><USER2> AmEx removed paper cups from their office "for the environment." Yet they incentivize travel with points and airline miles. So we know it's really not about the environment.</comment>


Ask HN: Who has turned a side project to full time gig? And at what revenue? - <AUTHOR> Side projects seem to remain side projects as long as they don't make a lot of money.  But I think just asking about side project is not really useful if you really want to know what's the chance that a side project could find something bigger.<p>I'm curious to know who here has had a side project transitioned to a full-time business, and at what revenue numbers, if you're willing to share, the transition occurred. <comment><USER2> When you say "Full time gig" are you referring to full-time revenue to live on or full-time such as 40 hours a week? I turned my micro SaaS (B2B) company into a full-time gig (After about 12-15 months), it generates around 45K per year of revenue and requires little time to maintain (around 5 hours a month), albeit it took me 750-1,000 hours to build it and another 100-150 hours of customer dev before I could reall dial in the business problem. My other more truly full time gig is a SaaS company (B2B) that generates around 100K and that takes up nearly all of my time (30+ hours a week). They both started as ideas, then on-to side-projects, and finally to full-time gigs. It did take some time and I had to keep coding away until I say enough traction to really know it would evolve though. Does that answer your question?

<comment><USER3> Inspiring!

</comment></comment><comment><USER4> Hey, This is a really good site for your question. [https://www.indiehackers.com/businesses](https://www.indiehackers.com/businesses)

As a follow up question: I'm pretty curious as to if you are working on a sideproject should you create a business and than products for that business or just label it as products. For instance Microsoft has Bing, Azure, and other products.

</comment><comment><USER5> [https://blog.kowalczyk.info/article/wjRD/solo-founders- with-...](https://blog.kowalczyk.info/article/wjRD/solo-founders-with- profitable-businesses-collected-stories.html)

</comment><comment><USER6> I'm currently in the process of deciding whether to sell my most recent side- project($400 recurring profit in 1.5 months), transfer it to a friend from business school and keep a large percent of profits, or to hire some part time digital assistants to run the support. Its a tough decision but I realized that the weekly support emails and upkeep was keeping me form developing my other ideas.

<comment><USER7> Maybe you can contact me and tell me what the project is about, I might be interested. Check my bio for email.

<comment><USER6> Sent you an email.

</comment></comment></comment><comment><USER8> Check Indie hackers [https://www.indiehackers.com/](https://www.indiehackers.com/)</comment>


People who've never lived in poverty should stop telling poor people what to do - <AUTHOR> https://theestablishment.co/people-whove-never-lived-in-poverty-stop-telling-poor-people-what-to-do-a40cecd18c58 <comment><USER2> I think this is probably fine advice. People often underestimate the difficulty others face in making changes that they themselves find easy. Some seem to want to believe that those that stumble in life do so due to a failure of morals or effort. This seems like a horrifically Darwinian perspective to me.

I think we easily have the capability of providing the basics of life for all at minimal cost. Why not save ourselves the cost of administering welfare and policing the crime that goes along with poverty? I would even advocate providing a free daily alcohol/narcotics ration to those that want it (along with encouraging better choices).

I was talking with some guys when I worked in the Netherlands about a rash of burglaries that was being attributed to Bulgarian gangs. I remarked that it would probably be easier all round for the Dutch to build a massive warehouse on the border, fill it full of flat screen TVs, and let the burglars come and get what they wanted at their leisure!</comment>


BMW M5 generates fake engine noise using stereo - <AUTHOR> http://reviews.cnet.com/8301-13746_7-20111031-48/bmw-m5-generates-fake-engine-noise-using-stereo/ <comment><USER2> ferrari has been doing it for a couple years...</comment>


Palette Image Generation – Technology to the Rescue - <AUTHOR> http://tech-blog.flipkart.net/2014/05/palette-image-generation-technology-to-the-rescue/

<comment><AUTHOR> TL;DR

Flipkart has automated the palette image generation using image processing, bayesian probability, existing product information and some assumptions that seemed to work. This will save massive amount of man-hours, reduce image sizes, ensure consistent palette images across website and enable faster product launches.</comment>


Show HN: Deep Learning] Easily import large files without API integration - <AUTHOR> https://youtu.be/w7yiW5wpnMg <comment><AUTHOR> Try it live: [https://diffgram.com/user/new](https://diffgram.com/user/new)

Docs: [https://diffgram.readme.io/docs/importing-files-using- connec...](https://diffgram.readme.io/docs/importing-files-using-connections)</comment>


Why I can't convince executives to invest in UX (and neither can you) - <AUTHOR> http://www.uie.com/brainsparks/2011/06/08/why-i-cant-convince-executives-to-invest-in-ux-and-neither-can-you/ <comment><USER2> The reason why Jared Spool and the other UX peeps can't convince people to invest in UX is because clients don't invest in abstractions. And UX is an abstract term.

It's a descriptor not a skill.

Clients invest in IA, Wireframes, visual design, animation, illustration, photography, front-end development, back-end development, php, java, RoR, Flash, Servers, copywriting, SEO, project management (and the supporting process, whatever you might call that)

All those things make up the UX field and those are what clients buy. If you know how to do any of them then you are in the business of UX.

Only UX people invest in UX.

<comment><USER3> Brilliant. However, I'd argue that SEO, project management, and development are fairly abstract to many.

Thinking about it more, I think UX has a lot in common with project management. They're both positions that are about overseeing components. I mean, it's easy to theoretically overlook why you even need managers period. It seems like you wouldn't NEED them because all of the component pieces could do the job, until you realize you do. I just think we've learned over time that project management is needed. We haven't yet decided if UX (as in, someone overseeing and synthesizing IA, graphic design, dev) is needed in the chain of command.

<comment><USER4> Except that those have definable effects, or at the least can be based in definable problems.

"By using $SEO_technique, we were able to move up to $position in searches for 'blah blah blah'"

"Our projects currently run over budget by $ugly_number and blow past their deadlines by $uglier_number. We need better project management to fix this."

What's a similar "here's how UX/lack thereof is making your life easier/harder" story? It doesn't _have_ to be abstract, it's just commonly being presented this way. Breaking it down into something like "an A/B test showed that people hit the download/purchase button $magic_unicorn_percentage more times after this kind of design change" can easily put the importance in terms that anyone at any level of management can understand.

</comment></comment></comment><comment><USER5> This is one of the toughest things I've learned in the last year or so while interning (in IT) for a fairly large insurance company. It's especially hard to affect UX when developers are typically given requirments from someone who has a specific (bad) design in mind.

Anecdote: Just the other day we had a request come through to have a flash video (with music) automatically play on the splash page for one of our bigger applications. We ended up taking it down the very next morning after the original requestor was getting bombarded with emails and phone calls about it. I hoped they might have learned from it, but their initial response was to just move the video to another page and continue to let it play automatically. We didn't let them make the same mistake twice, though.

<comment><USER6> "It's especially hard to affect UX when developers are typically given requirments from someone who has a specific (bad) design in mind."

I agree, but that's because I think it's hard to write good software when developers are typically _given_ requirements but aren't a part of creating those requirements. The best scenario is when developers are engaged with the users and actively participating in design. While this approach has gained a lot of credibility over the last few years, especially with the advent of the "developer-driven culture", there are still plenty of projects and groups that want to treat development as the "construction" phase of a project, something that happens after design and, perhaps these days, "UX".

As a developer, this has been my big worry about "UX" so far. It seems like it could turn out to be another version of "coders know how to code - but _UX designers_ know what software really ought to be, so we'll design it, and when we're done we'll let you know what to code up in your cubicle. Oh, and could we have some work estimates? Thanks!"

I want to be sure I recognize that developers have their own version of this. "I'll write up the software, but it'll have a crappy UI. Here, designer, pretty this up for me would ya? Should take you about a day, right?"

I liked the 37signals notion of the "three musketeers" ([http://gettingreal.37signals.com/ch03_The_Three_Musketeers.p...](http://gettingreal.37signals.com/ch03_The_Three_Musketeers.php)), a developer, designer, and "sweeper" who can play both roles. All three work very closely together in a project.

I think UX is a great idea and could be an important park of a development project, but I'd recommend UX advocates start thinking about how it would fit into a small team (no more than three people). You really don't have room on these teams for people who don't contribute directly to the working software application. As ThomPete pointed out, this means you can't afford staff who work in abstractions.

I'd see this as a skill set that people in design or development roles should strive to obtain. If you mainly do design, wireframes, or front end work, see what you can learn from UX. Same for back end development - sometimes projects do start with very simple UI and focus on application functionality, so it could be hugely helpful to consider the context of UX.

As others have pointed out, this is also something you can invest in, because you get a tangible product.

<comment><USER5> >sometimes projects do start with very simple UI and focus on application functionality, so it could be hugely helpful to consider the context of UX.

I've found this is one of the more powerful and easy ways to prevent feature creep, at least for the smaller/shorter projects I have worked on. When I start with a UI, I find it's easier to ask what the bare minimum of a) inputs and b) feedback/guidance for the user that needs to exist. In the projects where I've started with a backend first, I often end up having to create more noise on the UI side to complete it.

I think this just goes back to your first point, how developers are more effective when we're involved in creating the requirements. Practicing good design is going to be more effective when you choose to focus on it up front, instead of relegating it to something to check off a list when the application has been developed.

</comment></comment></comment><comment><USER7> There was a post here a while back that showed one of the anti-virus s/w companies investing in UX and re-designing their UI, support load dropped 30-90%.

In my own application I've had problems with users not understanding the meaning of things and what steps to perform.

I design to solve my own problems mostly but do keep the novice in mind, but even so its difficult with reaching some type of a balance between the levels.

Screenshots...

[http://www.devside.net/images/screenshots/large/local-dns- re...](http://www.devside.net/images/screenshots/large/local-dns-resolve.png)

[http://www.devside.net/images/screenshots/large/webapps- inst...](http://www.devside.net/images/screenshots/large/webapps-install- list.png)

[http://www.devside.net/images/screenshots/large/websites- add...](http://www.devside.net/images/screenshots/large/websites-add.png)

</comment><comment><USER8> Convincing isn't every a matter of giving a silver-bullet presentation. It's always a long process. What you need is resilience, and an idea of what the ultimate goal is.

Nobody quit smoking because of a single ad. But governments still pay for anti-smoking ads, because they gradually shift people's opinions.

<comment><USER2> But the reason why smoking ads work is because they are supported by data.

There are plenty of examples of campaigns that the government is running that will never work because there is no data to support the ads.

<comment><USER9> That's a very naive view of advertising. Many ad campaigns are successful _despite_ hard data, not because of it.

<comment><USER2> I have worked in advertising so I wouldn't think I am naive about it.

The difference is what kind of claims you are making and what you are trying to make people do.

Public campaigns is often about discouraging people from no buying certain things. Advertising in general is about getting people to buy things.

It's easier to get people to go to mcDonalds than it is to make them drop mcDonalds.

</comment></comment></comment></comment><comment><USER10> Nice piece. The title is an instance of the more general case, "Why _nobody_ can convince _anybody_ to invest in _anything_."

Good executives are primarily concerned about the performance of their organization (whatever that means).

Bad executives are primarily concerned about protecting their jobs (whatever that means).

Neither one gives a shit about what you're selling.

Find a way to incorporate whatever you're selling into the solution to their problem. In order to do that, you need 2 things:

1\. Get them to define their problem.

2\. Have something of value to offer as part of the demonstratable solution.

Many of us hackers are pretty good at #2, but in the B2B world, still need to get better at #1.

</comment><comment><USER11> So many places hire an office manager before they hire a permanent designer. It's a twisted perpective for businesses that should be focused on customers.

</comment><comment><USER12> I think it's quite easy to convince executives in an UX investment, you simply need to show previous results. _"We did this UX thing for company X and it improved their bottomline with 20%"_

If an executive doesn't think that's interesting he's incompetent.

<comment><USER13> It does sound a bit "pitchy" though, especially if the comparison isn't direct. If you're telling Coke about what you did for Pepsi that's one thing. If you're telling Unilever about your work for Proctor and Gamble that's another.

Also, most people with financial experience will realize that a bottom line (net income) is an easily manipulated number. I don't think your generalization is appropriate.

<comment><USER14> I agree. If you're an executive, you get pitched every day with stuff that will "improve your bottom line by 20%". Most of those numbers are smoke and mirrors. It's hard to decipher fiction from reality, which requires often a detailed understanding of how the number was calculated, what other effects may have been present, whether there was an impact with other customers as well (to prevent cherrypicking randomly favorable results), etc.

Execs are busy and it's a lot of work to understand whether that number is legit or not. In response, they will be jaded to your claims of bottom line improvement.</comment></comment></comment>


Ask HN: Will doors start slamming shut for Australia around the world? - <AUTHOR> Australia's new encryption laws make it probably more of a security risk than Huawei.<p>Will the world start closing its doors to Australia? <comment><USER2> If I was working at Atlassian in the Australian office, I would be very worried about Atlassian pulling out of Australia. A lot of companies use Bitbucket. Atlassian could be compelled to sneak backdoors into other conpanies' code. There would be issues around incorrect hashes, but most devs would put it down to a mistake on their part and just re-clone the repo. Some backdoors will go indetected and some won't.

If you're using Bitbucket, consider migrating to your own Gitlab instance, hosted in a country whose government values privacy.

<comment><AUTHOR> What about the AWS Sydney region, and for that matter Google and Microsoft Australia?

<comment><USER3> Amazon Google and Microsoft all definitely have enough business interests in Australia to have become untrustworthy due to these laws.

I wonder how long it'll be until someone like Digital Ocean starts advertising "we have no Australian office, and we've let go all our Australian staff!"?

(Having said that, DO are at least as susceptible to NSLs. I wonder who the most reliable non five eyes cloud hosting provider is?)

</comment></comment></comment><comment><USER4> Governments have been trying to thwart crypto for a long time, with limited impact on people who seriously care about security.

In the mid-90s, it was illegal to export strong crypto developed in the US outside. So for quite a while programs would come with dummy crypto, and before building you'd download the actual crypto libraries from Finland and link them in instead.

Also for a time, RSA had a patent on public key cryptography and enforced it against companies using it (say, for running a secure webserver) unless they used their closed-source library.

So using crypto in the US was made difficult, and yet the internet was fine and most people got the crypto they wanted (except, ironically, defense contractors.)

Although the new law sucks, everything will probably be fine there too. The Internet is pretty resistant to the sort of damage this law could create.

<comment><USER5> Export regulation had a lasting impact on everyone's security, because the mechanisms used to support it, even for people who had strong crypto available to them, were themselves vulnerable. See for instance FREAK.

</comment></comment><comment><USER6> When the Clipper fiasco happened in the States about 30 years ago, it didn't take long before the US started being left behind in crypto work by the rest of the world, especially by open-source crypto like PGP.

[https://en.wikipedia.org/wiki/Clipper_chip](https://en.wikipedia.org/wiki/Clipper_chip)

</comment><comment><USER7> Needs an "ask HN" in the title...

<comment><USER4> Added</comment></comment>


Beautycheck - Human Facial Attractiveness - <AUTHOR> http://www.uni-regensburg.de/Fakultaeten/phil_Fak_II/Psychologie/Psy_II/beautycheck/english/zusammen/zusammen1.htm How we judge the attractiveness of human faces and what are the social consequences? <comment><USER2> The authors talk of determining attractive human faces, and present the startling conclusion that virtual faces far outshine their human counterparts.

In reality, what they've found is that _static images_ of virtual, averaged human faces are perceived as more beautiful than photographs of humans. But images are just that, _images_. In my experience, faces are defined not so much by their static features, but by their animation. The face of a person is a window into their feelings, and expressions tell so much more about someone's personality that a static, neutral image can convey.

Were it possible, I'd love to see the same study attempt to capture gestures and expressions. One might find very different conclusions.</comment>


Ask HN: How can GPT-3 help humanity fight Covid-19? - <AUTHOR> After watching all those amazing videos of GPT-3 I couldn't stop wondering if it can help in any way with covid-19! <comment><USER2> > After watching all those amazing videos of GPT-3

Those 'amazing' GPT-3 videos only gloss over the good side of what GPT-3 can do given an input. They'll never tell you the number of times they cherry picked and edited the output or the mistakes it makes nor can GPT-3 itself reason of why it has generated that output or chosen those words in the sentences it generates.

If a black box neural network like GPT-3 still can't explain itself, then it cannot possibly safely help "humanity fight COVID-19" or any disease if you show the generated results to a medical professional.

So beware the hype brigade.

</comment><comment><USER3> GPT-3 is just a language model. You have to give it some information to work with. Maybe it could convert statistics or study results into layman's terms?

</comment><comment><USER4> It was trained on data prior to October 2019, so it _can 't_ help with COVID-19.

<comment><USER5> I guess it can keep some people indoors and occupied...

</comment></comment><comment><USER6> Help as in keep people entertained, or help as in solve some medical research question?

</comment><comment><USER7> It can't. Get a life.</comment>


Ask HN: Someone Is Phishing for PHPUnit in Sites - <AUTHOR> Someone keeps phishing for phpunit presence on sites by doing post and get requests for wordpress, laravel, and other typical php project paths, including a CloudFlare plugin. This is the path they are asking for from our logs:<p>"vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"<p>Is there a vulnerability people need to watch out for? <comment><USER2> [https://www.cvedetails.com/cve/CVE-2017-9841/](https://www.cvedetails.com/cve/CVE-2017-9841/) probably.</comment>


Dude, you married a whore - <AUTHOR> http://www.lostland.com/post/77437824788/dude-you-married-a-whore

<comment><USER2> Gross. If you analyze ideas for a living, perhaps reconsider how you've phrased and presented this one.

</comment><comment><USER3> Poorly thought out concept and title. You really should have thought this through a bit more before posting. I like to think we live in an era where even in an echo chamber, software junkies, hackers and our kin no longer consider this acceptable.

</comment><comment><USER4> I agree with the concept - people cling to bad ideas like they cling to a safety blanket as a kid - BUT - bad ideas can be turned into good ideas if the right parameters are changed. Most ideas aren't "bad" their just poorly executed.

Same thing with the women / man whore wording. A whore of a man(idea) (and I'll use man as I'm a man) can be turned into a good man if the right women (parameters / resources) presents itself. I know a few man whores and once they met the right women, they cleaned up nicely...

</comment><comment><USER5> Extremely linkbaity title, and apologising for it in the beginning doesn't give you an excuse to use it. Nice concept, but poor execution.</comment>


Show HN: I created a lightweight Covid-19 (Coronavirus) Chrome Extension - <AUTHOR> https://chrome.google.com/webstore/detail/covid-19-infections-and-d/kkhnnclkhhljbdclockahcediecmeepa <comment><USER2> Would you maybe consider open sourcing the code? My apologies, but I am hesitant to trust closed code running in an extension of my browser.

<comment><AUTHOR> It uses the following data: [https://github.com/pomber/covid19](https://github.com/pomber/covid19)

<comment><USER2> I don't need the datasource, but I miss seeing the actual script that runs in my browser. I mean, browser is one of the most important parts of your system... Pardon my paranoia :)</comment></comment></comment>


Haskell running on top of Apache Spark - <AUTHOR> http://www.tweag.io/blog/haskell-meets-large-scale-distributed-analytics <comment><AUTHOR> This is a very interesting use case of the new static pointer feature in GHC:

They first generate JVM bytecode from the Haskell source using their own code generator. This code is then shipped to the Spark cluster which executes the bytecode until it hits a static closure, the JVM will then call back into Haskell using a static pointer to execute the closure and will then continue with the bytecode.

<comment><USER2> Yup, pretty close. Just to be clear though we don't generate any JVM bytecode for any of the Haskell code - we compile that to native code using GHC as per usual but then we dynamically load the resulting shared objects into the JVM.

The static pointer thing is what allows us to share (practically) arbitrary Haskell closures with Scala/Java. And more than that - to get Spark's Scala code to ship these Haskell closures between machines across a cluster.

<comment><AUTHOR> Ah, thanks for the clarification!

So just for my understanding: the interop with the JVM works via JNI then?

The native code makes calls against the JNI and the Java bytecode calls back into the Haskell native code using the static pointers?

<comment><USER2> That's right!</comment></comment></comment></comment>


Is Success Luck or Hard Work? - <AUTHOR> https://youtu.be/3LopI4YeC4I <comment><USER2> For certain values of "success", neither...it is an internal psychological/spiritual state. For other values of "success", it is by definition arrived at only by hard work. For still others, a little of both. "Success" is a quintessentially ill-defined specification and since we don't need to design to that specification, it should be ignored as a general rule. Most wise people deprecated the term a long time ago.

</comment><comment><USER3> As someone that has endured a significant amount of bad luck, is there any advice on improving luck?

<comment><USER4> [http://nautil.us/issue/44/luck/how-to-be- lucky](http://nautil.us/issue/44/luck/how-to-be-lucky)

</comment></comment><comment><USER5> Little from column A, little from column B.</comment>


Five Years of BookStack - <AUTHOR> https://www.bookstackapp.com/blog/5-years-of-bookstack/ <comment><USER2> Thanks for sharing on HN! I'm always tempted to share the releases or posts here but I always back out as I never feel the project is refined enough.</comment>


How we know Obama will ignore his NSA review group: He already has - <AUTHOR> http://www.washingtonpost.com/blogs/the-switch/wp/2013/12/19/how-we-know-obama-will-ignore-his-nsa-review-group-he-already-has/ <comment><USER2> Linkbait. The article says outright that the President had to decide on a new head of NSA before the report came out; that means he wasn't 'ignoring his NSA review group' because it hadn't said anything yet.

I don't defend the President in this NSA debacle; but I tire of threadbare attempts to run down a person to score points.</comment>


"It's been great to see Wireguard mature over the years" - <AUTHOR> https://plus.google.com/+gregkroahhartman/posts/jD6N4BzToa3 <comment><AUTHOR> Greg KH, some others, and I had a great session stepping through every line of the codebase yesterday. Even though the codebase is quite small -- under 4k LoC -- studying some of the related topics is kind of like a fractal...

Happy to answer any questions you all might have about WireGuard. We're in #wireguard on Freenode, too, if you need help with things in real-ish time. I'm also mailing out free stickers to anybody who wants some: [https://lists.zx2c4.com/pipermail/wireguard/2017-May/001338....](https://lists.zx2c4.com/pipermail/wireguard/2017-May/001338.html) \-- just email firstname.lastname@example.com and I'll throw them in an envelope.

<comment><USER2> Hi Jason, thanks for your work on Wireguard! I evaluated it just a few weeks ago for my own usecase, but couldn't get it to work yet. Maybe you can tell me what I'm missing.

My usecase is as follows: I have a number of systems without publicly-routable IPs (i.e. behind NAT in different private networks) and two servers with public IPs (let's call these "head1" and "head2"). I want to build an overlay network between all of these servers, so that they can all reach each other. Since any of the two head servers may be down for whatever reason and I may not always have time to immediately investigate the problem, I want to have a highly-available setup where, upon failure of one head node, traffic goes over to the other head node without long disruption. I tried to give the clients a configuration like this:

      [Interface]
      PrivateKey = ...
      ListenPort = 12345

      [Peer]
      PublicKey = ...
      Endpoint = head1:12345
      AllowedIPs = 0.0.0.0/0

      [Peer]
      PublicKey = ...
      Endpoint = head2:12345
      AllowedIPs = 0.0.0.0/0

But when I set up the wg0 interface with that configuration, it would discard the AllowedIPs setting for head1 upon finding the head2 peer with the same AllowedIPs value (at least according to `wg`). Am I doing something wrong, or is this an inherent limitation of Wireguard? (The fineprint: I did this two weeks or so ago and am recalling this from memory right now, so I may be wrong in the details.)

<comment><AUTHOR> WireGuard enforces a very strict mapping between public keys and IP addresses, so you can't have two public keys with the same internal tunnelled IP address ("AllowedIPs"). This way you can have rules like "if it comes from the WireGuard interface and it's from 10.8.3.9, then it must be from public key ABCD," which make firewalling and ACLs and the general security posture a lot more straightforward.

In your case, it sounds like you want to change the AllowedIPs from one peer to the other based on some kind of metric you have for determining disruption. In this case, you can do that switch at runtime:

        $ wg set wg0 peer ABCD allowed-ips 0.0.0.0/0

or

        $ wg set wg0 peer EFG9 allowed-ips 0.0.0.0/0

Alternatively, if you wish to determine this disruption situation using traditional routing daemons, that set actual routes, as opposed to WireGuard AllowedIPs, then you could just have two separate WireGuard interfaces, and leave it to your routing daemon to decide which one to use.

<comment><USER2> The latter suggestion of using two wg interfaces sounds reasonable. I'll give it a shot, thanks!

</comment></comment></comment></comment><comment><USER3> Seems more similar to tinc[1] than to OpenVPN. How well does it overcome firewalls?

I've gotten used to just setup tinc on all my machines automatically with puppet and it's really nice to have an overlay VPN over the internet that is peer-to-peer instead of having to route everything through a central server. The only thing I miss is better firewall piercing. The easiest way is to just move tinc to 443 but that won't work for servers where I actually want to serve HTTPS.

[1] [http://www.tinc-vpn.org/](http://www.tinc-vpn.org/)

<comment><USER2> I looked at tinc yesterday, but it seems there are two options:

1\. the stable release which only supports RSA-2048 keys (giving it RSA-4096 keys resulted in really bizarre errors like "read public key file failed: Operation now in progress"), and

2\. the unstable release which does not compile on my system because of broken dependencies (and even if I got it to work, I have huge reservations about using unstable releases of cryptographic systems).

Am I missing something?

<comment><USER3> It's a small open source project that works very well for a lot of people. If you need stronger keys for your use case you'll have to wait for 1.1 to be stable. For me VPNs are not about security they're about getting connectivity working between my machines in a uniform way on top of networks that have restrictions. For security I always assume the network is hostile, even if it is my own LAN or VPN.

</comment></comment></comment><comment><USER4> Ive been using Wireguard on Ubiquiti routers recently - its simplicity and perf make it very attractive. Well done to the WG team.

</comment><comment><USER5> I did a vuejs/html5 web interface for wireguard recently and found it delightful to work with.

There was a few pain points on the way, if anyone is interested in learning from my mistakes.

\- there is no option to specify listener ip+port tuples

\- logical sub-interfaces work fine, unless they happen to emit a vlan tag, then wireguard drops the traffic:

ping: sendmsg: Protocol not supported

\- almost every virtual ethernet device in the kernel calls eth_hw_addr_random(dev); to ensure a proper link-layer address, seems to be missing in wg

\- "allowed-ips" cannot be turned off; when a routing table entry with a gateway address is used to specify exactly which peer some subnet should be routed to, then one has to also manually maintain an "allowed-ips" setting that contains a duplicate of the information in the routing table

\- when one "allowed-ips" setting is added to a peer, wg may silently remove "allowed-ips" on another, unrelated peer. this caught me by surprise while trying to connect 2 VRFs from site A to site B and C over a common tunnel infrastructure, which may have been stretching things a bit

Enjoy wireguard!

<comment><AUTHOR> > I did a vuejs/html5 web interface for wireguard recently and found it > delightful to work with.

Sounds cool. Care to share? I'd love to see people's usage.

> \- there is no option to specify listener ip+port tuples

WireGuard listens on all interfaces, because packets themselves are authenticated cryptographically. If a packet makes it to your system and the authtag is validated, it doesn't matter through what interface it arrived; it's legit. WireGuard also is able to reply using the destination address and interface of the incoming packet as the source address and interface of the outgoing packet, which is the other common usage of binding to particular IP addresses.

> \- logical sub-interfaces work fine, unless they happen to emit a vlan tag

WireGuard is layer 3 -- IP -- not Ethernet, which is how I believe tunnels should be made. Instead of vlans, just add more tunnels if you need.

> \- almost every virtual ethernet device in the kernel calls > eth_hw_addr_random(dev);

WireGuard isn't Ethernet; it's IP. It doesn't use MAC addresses. It has public keys instead.

> \- "allowed-ips" cannot be turned off;

Yes: the crypto key routing is the central idea of WireGuard. You establish a strong binding between public key and internal tunneled IP address, and then all your rules and policies on top of that suddenly become quite simple.

> \- when one "allowed-ips" setting is added to a peer, wg may silently remove > "allowed-ips" on another, unrelated peer

Peers can't share internal tunneled IP addresses; otherwise, there wouldn't be strong binding to public keys, nor efficiency of sending outbound packets. So if you assign an already assigned one to another peer, the presumption is that you want to _move_ the allowed IP. By always going with the newer future demand, and not erroring and staying with the old one, we ensure forward progress on your overall changes to policy. IOW, if you're changing things, we want the state to look like what you're changing it to.

If you have any additional questions at this level (a great level, thanks for those), a better place to discuss is probably #wireguard on Freenode, or the mailing list -- [https://lists.zx2c4.com/mailman/listinfo/wireguard](https://lists.zx2c4.com/mailman/listinfo/wireguard)

<comment><USER5> Yeah for sure. Here are some screenshots:

[https://imgur.com/a/aT8TU](https://imgur.com/a/aT8TU)

There are additional settings on the various detail screens (not shown), such as wg peers.

Vuejs turned out to be quite cool. If you plug in a new linecard (like an USB Ethernet adapter for example), it pops up in the GUI immediately and is ready to be named, configured, used etc. ;-)

 _> WireGuard listens on all interfaces [...]_ _> If a packet makes it to your system and the authtag is validated, it doesn't matter through what interface it arrived; it's legit._

Yeah but you try telling the person administering the combined firewall/vpn/router box that his/her firewall rules are no longer in control of what traffic is allowed in or not. If it happens to be destined to the wireguard port, the rules are for naught.

I should probably explain that there's a small firewall in there too. It uses nftables to compile user rules via eBPF to machine code. The way these things normally work, as I understand it, is that forwarding is disabled during boot, and only when the firewall policy has been successfully loaded is forwarding enabled via a sysctl flag.

The firewall handles simple stuff like masquerading and destination NAT. Advanced functionality happens by handing off datagrams from the firewall to userspace or kernelspace daemons like wireguard.

Long story short (too late, sorry), you can't have stuff listening on 0.0.0.0/0 and ::/0 because it is unaffected by the forwarding flag and hence the firewall rules are violated during boot (and potentially for an unbounded time period if the policy fails to load for some reason).

Anyway, turned out it was really easy to fix by patching the wireguard source code.

 _> WireGuard is layer 3 -- IP -- not Ethernet, which is how I believe tunnels should be made._

That's a completely fair point.

I'm just talking from a user's perspective, where what pops up on one's box after installation is in fact a virtual ethernet device, in kernel-speak.

When the device then drops L2 frames, it can be a bit unexpected to someone unfamiliar with that specific philosophy.

Is there any recommended workaround if one wants routers to see each other on the link layer? Some kind of encapsulation maybe?

 _> WireGuard isn't Ethernet; it's IP. It doesn't use MAC addresses. It has public keys instead._

Yeah I guess the public key sort of is the link layer address in this case.

 _> a better place to discuss is probably #wireguard on Freenode, or the mailing list_

I was tempted to ask why the wg device shows up with the POINTOPOINT flag, when it is clearly a multipoint device, but I'll save it for the IRC channel. ;-)

<comment><AUTHOR> > Yeah for sure. Here are some screenshots:

Looks real nice. Any plans to open source that?

> Yeah but you try telling the person administering the combined > firewall/vpn/router box that his/her firewall rules are no longer in control > of what traffic is allowed in or not.

No, this is not correct. All iptables/nftables/netfilter rules apply. My comment was strictly related to the fact that it listens on 0.0.0.0, but you're still in full control of all firewalling in every way.

> stuff listening on 0.0.0.0/0 and ::/0 is unaffected by the forwarding flag

Either I don't understand what you've written, or this is complete nonsense. This doesn't correspond with anything real I can fathom. Probably it'd be easiest to just poke us in #wireguard on Freenode, and we can try to figure out together whatever behavior you're seeing. In addition to me being in there to discuss WireGuard-related things, there are some nftables experts there too, who will probably have insights into your firewall configuration.

> is in fact a virtual ethernet device, in kernel-speak.

It's actually not an ethernet device. In "kernel-speak" it's a net_device with hard_header_len = addr_len = 0, instantiable via rtnl.

> When the device then drops L2 frames

All L3 devices reject L2 frames. There are quite a few L3 devices, in fact, not just WireGuard.

<comment><USER5> _> Looks real nice._

Thanks!

 _> Any plans to open source that?_

Not opposed to it, but on the other hand I have no idea how to package it?

I ended up implementing daemons for eg. setting up all the interfaces and routing on the box, because I ran into so many bugs in systemd-networkd that in the end it was impossible to work around them all and I just implemented it from scratch.

So installing the software pretty much takes over your system and turns it into a vpn+firewall unit. ;-)

Not something most users would expect if they find an open source project and install a .deb or something. So I'm not sure if it is advisable to open source it.

 _> All iptables/nftables/netfilter rules apply._

Rules haven't loaded yet, as per previous reply.

 _> Either I don't understand what you've written, > or this is complete nonsense._

The former, I'm sure ;-).

 _> Probably it'd be easiest to just poke us in #wireguard_

Yeah maybe.

 _> In "kernel-speak" it's a net_device with hard_header_len = addr_len = 0, instantiable via rtnl._

OK.

I actually have an alternative implementation of the GUI lying around where it does handle wg devices like a special device that you can only do IP on.

But it turned out to be a lot of reimplementation of everything (handling IP addresses, routing, configuring interfaces, generating anti-spoofing rules, applying policy, ...) that in the end it turned out to be an unworkable mess.

So right now the code handles wg interfaces like any other "bearer" interface, in other words a bit-bucket you can pour stuff into and it turns up at a peer port on some other box. Obviously that is a bit wrong as it cannot forward L2, so that means there are some features that are unusable (in particular VLAN tagging and VRFs).

(It's also possible that I have just been too eager when selecting wireguard and should have found an L2-compatible VPN system instead. Not sure which one fits the bill though.)

By the way, is there a video available of the talk/session you and GKH and others had recently?

I'd love to learn about wireguard internals by following along a recording of the session.

<comment><USER5> Quick follow-up.

If the premise "the peer public key is sort of the peer's lladdr" is correct, here's an idea off my chest. (Beware that I am blissfully unaware of wireguard internals, just brainstorming.)

If the peer pubkey identifies the port on the other end, just like a MAC address would identify the NIC on the other end of a switched network;

Then would it be possible to give the kernel the peer pubkey as the lladdr when it asks for a next-hop's lladdr?

If so, all the IP routing stuff could be moved out of wireguard and taken care of by the kernel's IP router.

Without the internal IP routing function, L2 traffic could possibly be forwarded.

If the lladdr field is not large enough, maybe allow the user to give to wg a mapping between fx. a 6-byte locally assigned peer lladdr, and the 32-byte peer pubkey. Or ask Linus to extend the field. ;-)

Could be hidden behind an "l2-mode" flag or something.

In my opinion, being able to forward L2 would help a lot towards building a GUI in a sensible way, but yeah, just an idea.

I'll find an IRC client soon, promise.

<comment><USER5> Or maybe a sub-interface per peer:

       # ip link add dev wg0 type wireguard
       # wg set wg0 listen 0.0.0.0:51820 listen ::/0:51820 private-key /path/to/private-key

       # ip link add dev wg0-peer1 type wireguard-peer
       # wg set wg0-peer1 local-endpoint wg0 remote-endpoint 220.127.116.11:8172 public-key ABCDEF

Then routing via kernel:

       # ip route add 192.0.2.0/24 dev wg0-peer1

And/or layer something else on top:

       # ip link add link wg0-peer1 name peer1-vlan100 type vlan id 100

Perhaps enslave that to a VRF:

       # ip link set peer1-vlan100 vrf blue

The peering interfaces could also be assigned an MTU that matches the path to each peer, if known:

       # ip link set wg0-peer1 mtu 1328

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> What are the pros/cons comparing Wireguard and ZeroTier?

Wireguard was recently mentioned as supported by the Mullvad and IVPN VPN providers. [https://news.ycombinator.com/item?id=15588040](https://news.ycombinator.com/item?id=15588040)

ZeroTier was part of a discussion migrating between cloud providers. [https://news.ycombinator.com/item?id=15548642](https://news.ycombinator.com/item?id=15548642)

Choice is great but when would either option be best? My personal use is just as a connect-back-through home VPN; I have to support mobile devices so will probably also have to use something else.

Both tools seem to be finding new life as they simplify container networking setups.

</comment><comment><USER7> Either I'm dumb or the guide on [https://www.wireguard.com](https://www.wireguard.com) is awful.

I have a VPS with StrongSwan installed, through which I connect when I need to access the internet with my server's IP. Basically, a poor sysadmin's VPN. I've heard of WireGuard, why not try it out?

Now, the installation page seems pretty easy to follow, and I guess (though it's implied) WireGuard has to be installed on the server.

Then the Quick Start page shows a list of routing commands, where am I supposed to run them? On the client or the server?

Or, quote:

        wg set wg0 listen-port 51820 private-key /path/to/private-key peer ABCDEF... allowed-ips 192.168.88.0/24 endpoint 184.108.40.206:8172

What are those IPs? What's that private key file?

How the heck do I install and use it?

Also, the side-by-side demo doesn't load on my Safari.

I'm fine RTFM and man pages, but I don't see the point of a quick start guide if it's totally cryptic for anyone that has never used WireGuard. Just tell me to RTFM and I won't bother with this guide.

I guess I'll keep my StrongSwan installation, has been working without a hitch for a while now.

<comment><AUTHOR> Thanks for the feedback. Indeed there are the wg(8) and wg-quick(8) man pages, and probably you should read the whole _front page_ of wireguard.com, namely this part -- [https://www.wireguard.com/#conceptual- overview](https://www.wireguard.com/#conceptual-overview) \-- which gives some important conceptual overviews to learn what's going on. Probably if you don't have the conceptual overview in mind, the quickstart won't make much sense; this may indeed be a fault in the writing presumptions of the quickstart.

The side-by-side video puts this -- [https://www.wireguard.com/talks/talk- demo-screencast.mp4](https://www.wireguard.com/talks/talk-demo-screencast.mp4) \-- in a <video> tag. I'm a kernel developer, not a web developer, so if you have a suggestion on how to fix it in your browser, I'm all ears.

With all that said, we probably should rewrite the quickstart page to be a little more intuitive and "quicker", so that people can get an idea of what to do without having to understand or think about anything... Maybe a better approach for that might be: "Here's what you do on one side. Here's what you do on the other side."

In any case, I guarantee that learning WireGuard is faster and simpler than learning StrongSwan or any IPsec things.

After the Netdev conference, which is next week, I'll allocate some time to improving documentation. Thanks for the feedback here, and sorry for the frustration.

<comment><USER7> BTW, Firefox says the video is corrupt, Safari doesn't play it, only Chrome does. Probably a couple bits rotted since you've recorded it :)

<comment><AUTHOR> Jeepers creepers. I'll try to fix it. Probably a yuv444p issue.

Update: fixed now. I had to re-encode it to change the colorspace, as suspected, and now things should be working fine in Firefox (though I haven't a Mac to test Safari).

<comment><USER8> It works on Safari 11.0 as well(source: me). Thanks for fixing it!

</comment></comment></comment></comment></comment><comment><USER9> Mixed feelings, some of them maybe unpopular:

1\. Careful with anything that Greg KH prizes.

2\. Written by zx2c4 who is very high on my 'who I can trust' list.

Since #2 greatly over-weights #1 can't wait to try WireGuard.

<comment><USER10> Can you elaborate on #1?

<comment><USER9> Exactly as other post says, kdbus and the way he tried to push it raised a few warning flags. Kernel is all about trust and I just don't trust Greg after that episode.

It is all off topic since I really admire zx2c4 and this is about his product.

Edit: since Greg KH got removed from the thread title any mention of him is off topic...

<comment><USER6> FWIW, it is his Google+ account in the URL. Definitely no longer obvious.

Hacker News Transparency: [https://hn.0x2237.club/post/15596963](https://hn.0x2237.club/post/15596963)

</comment></comment></comment></comment><comment><USER11> Context?

For those of us who have never heard of Wireguard, I can click on the linked Wireguard image to at least see what it is. Cool, I guess? If it was a standalone link on HN ("hey, look what we made!") it would make a lot more sense, but since it's a G+ post, it's more about the blog-type content. I guess the main point is the discussion of merging it into the (Linux?) kernel tree, but... yeah.

<comment><USER2> Wireguard by itself has been on HN for a few times now. The newsworthy part is that one of the top kernel developers is expressing interest in bringing it into mainline, so it is appropriate to submit that post instead of the Wireguard homepage.

<comment><USER11> Thanks! I didn't realize who Greg was either, so I was missing the 2 pieces of context necessary for the post to make any sense.</comment></comment></comment>