Google announces uProxy - <AUTHOR> http://www.engadget.com/2013/10/21/google-ideas-uproxy/ <comment><USER2> > _" If someone from a country with limited internet access installs uProxy, > they can get a friend from the US to authorize them to surf the open web > using their connection. "_

In effect, they would also be sending all their sensitive, potentially illegal traffic to be read and copied by the american NSA agency. [http://en.wikipedia.org/wiki/PRISM_%28surveillance_program%2...](http://en.wikipedia.org/wiki/PRISM_%28surveillance_program%29)

People proxying illegal traffic through the USA would immediately be "on file" in the US registered as dissidents, criminals, and potential spies vulnerable to blackmail from US agencies.

I can see CIA looking at how their propaganda are affecting foreign nations by seeing who reads it from where. Foreign nations could even see proxying subversive traffic through the USA as being a worse crime than the subversive traffic itself.

Think twice about using this.

<comment><USER3> Why would somebody who lives outside of USA care about US agencies? All I want is to bypass my own country's censorship.

<comment><USER4> Because non-Americans still have to worry about being abducted off the street and tortured by American agents: [https://en.wikipedia.org/wiki/Khaled_El- Masri](https://en.wikipedia.org/wiki/Khaled_El-Masri)

<comment><USER5> It's a valid issue, in that it's vile the way the US Government sometimes behaves, but _that_ is not a realistic concern for 99.999999% of the world population.

<comment><USER6> I think it's a valid concern for more than 70 people.

<comment><USER7> Shouldn't that be 7000 people?

<comment> mike-cardwell No

EDIT: Apparently factually correct statements are worth downvotes.

<comment><USER7> Yes, you're right. I made the schoolboy mistake of confusing 0.000001 and 0.000001%

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> From a cursory reading, 70% of the comments in here are people who came straight to this page to say "I don't trust Google/why wouldn't they do <something else>/Google will just shut this down".

Can we stop with the kneejerk reactions? This is a p2p browser extension, doesn't run through Google, wasn't developed by Google, the only involvement Google had was maybe fund it.

Are we going to be getting these comments any time Google is mentioned from now on?

<comment><USER9> _Are we going to be getting these comments any time Google is mentioned from now on?_

Yes, and I think rightly so. What evidence do you have that this will not happen? None - which is the _less_ evidence that the people saying it will happen have. Google has earned that rep and, until 1-3 years have gone in which they've not done something like that, people will continue to bring it up.

<comment><USER8> > What evidence do you have that this will not happen?

"This" being "shut it down"? My evidence is that this is a third-party extension, developed by a third party and doesn't touch Google's infrastructure at all. They couldn't shut it down if they wanted to. The most they could do would be to cut its funding, but it's still open source.

</comment></comment></comment><comment><USER10> While we're speculating about trust and such, the video mentions that it's a browser extension which connects to a trusted peer and uses the peer as a proxy. This leads me to believe that,

1\. Since it's a normal browser extension, the source will be readable and verifiable.

2\. It probably uses WebRTC.

It seems Google merely plays an incubator role here for the authors. Either way, I don't see much trust issues that other comments are complaining about.

Looking forward to trying this out when it's released.

<comment><USER11> _> the source will be readable and verifiable._

that's all well and good, but if it's executed by an unverifiable binary build of Chrome (i.e. the one distributed by Google), it's not worth much. For what you know, Chrome might just detect the extension is installed and silently eavesdrop on all its calls.

 _If_ this extension will work as-is on third-party Chromium builds compiled from public sources, then yeah, it can be trusted on those builds.

<comment><USER12> We actually don't know with 100% certainty that Chrome runs the code that we see.

Considering Google is forced to comply with NSA's shit (and other agencies in their respective countries), I wouldn't trust my life to this extension.

<comment><USER13> Then compile it yourself. If you don't trust your hardware then what else can you use?

Can you actually trust people who built your house? What if NSA has built a device hidden in everyone's house right now?

</comment></comment></comment></comment><comment><USER14> Official links:

[http://googleblog.blogspot.com.au/2013/10/new-free- expressio...](http://googleblog.blogspot.com.au/2013/10/new-free-expression- tools-from-google.html)

[http://uproxy.org/](http://uproxy.org/)

<comment><USER15> Much more useful than the engadget link. Thanks!

<comment><USER8> Why isn't there a link to this from the Engadget article? That is useless and shoddy. Do they not know how the internet works, or have a single shred of common sense?

<comment><USER16> It's almost as if they care more about traffic than informing their readers.

<comment><USER8> Informing their readers _is_ their traffic.

</comment></comment></comment></comment></comment><comment><USER17> The article has reached a new low in bullshit, knee-jerk, commentary. No one bothers to read the FAQ, or the technical information on how it works. Oh no, just hit "Reply", put on the tin-foil hat, and get going. Yeah, vote this down. I'm frustrated at the quality of HN posters recently.

</comment><comment><USER18> Fast forward a year, HN headline: "Google shutting down uProxy".

It looks interesting and I'm sure some number of people will find it useful while it lasts.

<comment><USER15> How exactly could they shut it down? Its a client-side browser extension that uses peer-to-peer connections. It doesn't run on any of Google's infrastructure.

I'm getting a bit tired of seeing this comment every time Google release a new product. I understand that people think they're being insightful in saying this, but they're really not.

<comment><USER19> Ok, to rephrase for the pedant: "Google pulls core developers off of uProxy; without leadership, multiple incompatible forks form and quickly die"

(Not saying that that will happen, just clarifying what I presume is the grandparent's point)

<comment><USER15> I'm not a pedant. And the core developers work for the University of Washington and Brave New Software, not Google. [1].

[1] [http://googleblog.blogspot.com.au/2013/10/new-free- expressio...](http://googleblog.blogspot.com.au/2013/10/new-free-expression- tools-from-google.html)

</comment></comment></comment></comment><comment><USER20> Nice! So I can use uProxy to access the Google Play store to buy a Nexus phone? ("Sorry, not available in your country")

Thanks Google :-)

<comment><USER21> Remains only to figure out how to route the physical delivery via a US address... anyone know of such a service? I'd find that pretty useful actually. A lot of stuff on e.g. Amazon is only available for delivery to the US.

<comment><USER22> I personally use Aramex shop and ship account [http://www.shopandship.com](http://www.shopandship.com) for US only products from Amazon. Buying from Google play is more difficult as they added a security procedure that the credit card has to be from US and the shipping address from should match for circumventing this, earlier one could use a US proxy and order it.

</comment></comment></comment><comment><USER23> _Can I look at the source code ?_

 _The source code will be released by the University of Washington under the Apache 2 license after the trusted tester phase is completed ._

This is the important part.

</comment><comment><USER24> Sorry Google, I can't really trust you anymore.

<comment><USER25> Open source + p2p. Why wouldn't you trust it?

<comment><USER26> Automatic updates?

<comment><USER27> So turn them off. You can do that in Firefox, I don't know about Chrome, but if you're using that then you already are trusting Google just as much as if you use this extension.

</comment></comment></comment></comment><comment><USER28> I wouldn't trust Google with this.

Fuck no.

Why don't they help develop the Tor plugin?

Why don't the open up a whole bunch of Tor nodes?

Wait... scratch that last one.

This is just bad.

<comment><USER29> Because it appears to be open source and peer to peer, so you don't need to trust Google at all?

<comment><USER30> Open source does not mean secure. Half the time nobody even reads the source, let alone compares the binaries to the repository.

<comment><USER29> It's a chrome extension, so the source you see is the code executed by your browser.

<comment><USER30> That wasn't my point. Have you ever read the source of the extensions you have installed? No. If everybody has that mentality then nothing gets "checked" and malicious code makes it though.

<comment><USER31> I have read the source of extensions I've installed.

<comment><USER32> And are you a crypto expert?

</comment></comment></comment></comment></comment></comment></comment><comment><USER33> It will be very interesting for us living in Iran. We have a lot of friends abroad.

<comment><USER34> Doubt that it will help a lot - metadata is valuable. Sometimes the fact that you are communicating with someone is as damning as the communication itself.

Unless the addon is really sneaky and confirmed by a lot of people chances are it will still be detectable by DPI. And you have the problem of the addon traversing the state firewall in the first place.

And you need secure OOB way to transport password anyway.

From what I see you need secure way to transport keys and don't minding to raise a few red flags with the authorities.

In that case just rent micro instance with any out of country cloud provider you have access to and ssh tunnel trough it.

</comment></comment><comment><USER35> So Google helps building a proxy for by passing their own censorship, Bravo Google, Bravo. (I'm being ironic of course)

This is what I get any time I try to download anything from Google Code or Android sdk or even read something hosted on GAE.

[http://s24.postimg.org/gr0lto1l1/work107.png](http://s24.postimg.org/gr0lto1l1/work107.png)

I'm in Cuba but the same should be for Iran and others "bad boys".

<comment><USER36> By "their own", you mean "as required by US export restrictions that all US companies have to abide by", right?

See also [https://sourceforge.net/blog/clarifying-sourceforgenets- deni...](https://sourceforge.net/blog/clarifying-sourceforgenets-denial-of- site-access-for-certain-persons-in-accordance-with-us-law/)

<comment><USER37> The irony here is that they are announcing a tool to subvert restrictions in other countries, but they are following their own countries restrictions to the letter.

<comment><USER36> Right, which they're obligated to do. As a company, you're bound to follow the laws of the countries in which you do business.

You have the option to direct lobbying power against laws you feel are unjust.

<comment><USER37> Same could be said about individuals. Citizens are bound to follow the laws of the land.

<comment><USER38> But citizens are not forced to spy on their friends, like these companies are.

</comment></comment></comment></comment></comment></comment><comment><USER39> why should I trust google for an application that would enhance my internet privacy?

<comment><USER40> Privacy is not mentioned at all in the article. This is about bypassing censorship.

<comment><USER24> What if censorship happens in USA?

<comment><USER41> >What if censorship happens in USA?

Then people who who use a Google proxy to bypass it get picked up by the FBI. It's not like Google doesn't give the government data hand over fist.

</comment></comment></comment></comment><comment><USER42> So is this kinda of like Tor but without the anonymity and only one peer to connect to?

<comment><USER43> I see uProxy as giving a friend my wireless network password. I'd compare a Tor exit node to printing the network password on my mailbox or posting it to craigslist.

I regularly share my wireless network access with friends without thinking, while running a tor exit node/publishing my network password gives me serious liability concerns.

</comment></comment><comment><USER9> I'm interested to see if their AdWords/AdSense algos will detect uProxy and choose not to serve ads to its users. Right now, the US/UK/Canada are huge markets for Google AdWords/AdSense but most US-based companies do not have their ads shown in Latvia/Iran/Russia (just to randomly pick some faraway countries). There's a good reason - if I own a restaurant in Dallas, for example, I want people searching for "best dallas steak restaurant" to see my ad. If that starts getting shown worldwide, the CTR will plummet which would not be good for Google.

</comment><comment><USER44> Slackers rejoice! No way to block you from surfing porn at work anymore :)

<comment><USER34> Because the slackers that surf porn at work have no idea how to bring a tablet to work loaded with porn.

</comment></comment><comment><USER45> This sounds good. But how is it better than just installing Tor?

<comment><USER46> "just"? Man, normal people can't install Tor. It is not that it is difficult for them, it is impossible.

Also, this solves a problem slighlty different from what Tor solves, in my opinion.

<comment><USER45> Fair point. They make an effort with the Browser Bundle but I just tried it and it broke on the second run...

Now I want to write a Tor compatible client that 'just works'. Just one static binary that implements the proxy. It embeds a static firefox binary and a prepared profile, which gets extracted into a visible location so the user can delete it if desired.

Basically minimize its dependence on the environment as much as possible.

</comment></comment></comment><comment><USER47> Wow. If they added an option to be an intermediate proxy for traffic you were unconnected with, could they turn this thing into a global tor with authorized exit nodes?

</comment><comment><USER48> Why don't they simply run Tor end nodes in each of their server farms all over the world. That would actually help. But that would not make any mainstream news, would it?

Bleh.

<comment><USER49> The problem with Tor is that it's not clear who is running which nodes and where you'll come out. uProxy is designed for people who _know_ that their endpoint is friendly, such as a friend who no longer lives in the country, or a journalist that you are working with.

</comment></comment><comment><USER50> If a dissident hacks into a government site or does something else like speaking out his opinion, will I get arrested for them, when I live in a neighbour country? Or even get arrested for their actions on hacking stuff? I mean the US and Europe both ban hacking and penalize it with more jail time than rape and in some cases even murder.

<comment><USER51> UProxy is a point-to-point proxy, where both sides know each other (by being buddies on the chat network) and choose to participate with one another. Don't proxy for your hacker friends.

</comment></comment><comment><USER52> Okay, sorry I didn't read the source code yet, but don't pretty much all the standard block-censorschip-circumvention approaches work here? They don't mention anything that makes it a tool for actively circumventing censorship like... well, all the tools that exist today and have been analyzed throughly.

</comment><comment><USER53> So now you also expose your confidants? So if you are targeted they automatically get on the list? Why inconvenience the secret service with doing tedious network analysis to flush out your peers - uProxy might (they are not very specific about the security of peers) disclose that automatically...

</comment><comment><USER54> So US government employees could install it to read Snowden's documents?

Then the NSA gets a list of those who do?

</comment><comment><USER34> I have a better idea - bring the cost of project loon balloons really low (order of magnitude below the price of the rockets needed to shoot them) and just flood the censoring country sky with them.

The country will either have to bankrupt itself or open its internet.

</comment><comment><USER55> This is going to be a nightmare if you verify and process transactions online. How do you now know whether someone who purchased a product is really really on Comcast from SoCal and not someone who's exploited a hole in uProxy?

</comment><comment><USER56> Original url: [http://www.reuters.com/article/2013/10/22/google-tools- idUSL...](http://www.reuters.com/article/2013/10/22/google-tools- idUSL1N0IB25B20131022)

</comment><comment><USER57> Good timing as nyud.net seems to have stopped working.

</comment><comment><USER7> Another "free" Google service that blinds lay people from objectively considering the cost vs. benefits of online privacy/anonymity (since "free" tends to make us act irrationally). Instead, consider paying the equivalent of a cup or two of coffee and buy yourself a real VPN subscription. Even if you must get yourself a free VPN, consider someone other than Google, a company that already has so much data on your digital lives.

<comment><USER8> Did you read the article? It's not a Google service. Why buy a "real" VPN subscription instead of running things through a friend, which is way more decentralized and harder to surveil en masse?

<comment><USER7> I did. I also went to the uProxy site which mentions it was seeded by Google Ideas. Also,

>> One of the ways uProxy connects you through your friends, is by connecting to existing chat networks, such as Facebook or Google Hangouts. uProxy can use a chat network to discover new friends and setup peer-to-peer proxying from your friends. If a user does so, then the chat network can see that the user has uProxy installed. A user's chat contacts may also see this.

So Google funded uProxy; it will be able to see who your VPN "host" is via Google Hangouts; and lastly it controls one of the two browsers on which this plugin runs, Chrome.

That's too much Google for me, personally.

<comment><USER51> .. So don't use it on hangouts and run it on Firefox. Scan the source for any "call home code."

<comment><USER7> This isn't about me. I already use a different VPN. I don't use Hangouts or Google+. Those rare Google services I do use, I use sparingly.

My point was the average Internet Joe or Jane needs to look beyond "free" services and be willing to spend some money buying better alternatives. One of the reasons we're all so compromised on the Internet today is our collective blindness towards the hidden "costs" of free services.

<comment><USER51> I agree with your point on the costs of free services. I'm happy to pay myself. In some parts of the world, it's very tough to transfer money to a circumvention or anonymizing service without getting in trouble.

But if a user is both unable to assess the security of the system them self, and unwilling to trust another's analysis, the funding model is irrelevant. Source is the gold standard, IMHO, even if that's still not terribly helpful.

</comment></comment></comment></comment></comment></comment><comment><USER58> Hulu, Pandora and other US-only internet services now available. Brought to you by Google.

</comment><comment><USER59> What about corporate firewalls?

</comment><comment><USER60> How is this new? I can create a proxy server now, and I can share it with a friend and they can use my internet connection. They can do the same.

This is new because, It's likely easier to use, and it's all done in the browser.

The technology is certainly not new though...

Apache with mod_proxy, nginx, squid, ssh,

just to name a few of the many ways to do this...

Further to this, one doesn't need a browser plugin to do this, firefox for example already has configurable options to connect to proxy servers.</comment>


Google Apps Spam with No Way to Unsubscribe - <AUTHOR> http://imgur.com/UrAzyTD

<comment><AUTHOR> Google Apps decides to include me in this email because some random person has decided to use my email ID as part of the sign-up. I keep getting these messages and I have no way to unsubscribe.

At least in other Google emails, there will be an option to disconnect but this one doesn't have it. The fine print at the bottom says this is 'mandatory'. I know I can apply a filter to get rid of it but that's not the point.

<comment><USER2> Someone did that with one of my google addresses several years back. The emails stopped after a couple of months.

Since GApps is now a 30-day freebie unless they subscribe, the emails should stop soon after that. Since they had the emails sent to your address, they won't see the setup details from Google.</comment></comment>


A Gnome Developer's Arguments on Vala Being a "Dead" Language - <AUTHOR> http://www.phoronix.com/scan.php?page=news_item&px=GNOME-Vala-Bassi <comment><USER2> Sad but true... The problem with Vala is that it has never escaped from Gnome orbit...

Maybe Zig[1] would be a good replacement for Vala usecases, one day?

[1] [http://ziglang.org/](http://ziglang.org/)</comment>


Scientists are working to eliminate senescent cells - <AUTHOR> https://www.theguardian.com/science/2018/oct/06/race-to-kill-killer-zombie-cells-senescent-damaged-ageing-eliminate-research-mice-aubrey-de-grey <comment><USER2> While the article title is sensational, it's encouraging to see SENS getting wider traction in the public imagination. A lot of the other proposed therapies seem to involve genetic engineering, and this one seems more somatic, more at the scale of designing a drug to work at the scale of cells, vs the scale of DNA. It seems, to my interested layperson's mind, that a rough and ready treatment is more likely at this scale, albeit one less likely to result in 4-digit lifespans, measured in years. This does make one of my fears more imminent, which is what to do with things like teeth, the vitreous humor, extant arthritic damage, and other systems and organs, the effects of aging for which the body has more or less lost or never had cells in place that can be recruited for repair. Time will tell. With any luck, we'll have loads of it!

<comment><USER3> I'm amazed that anyone thinks above normal individual longevity is a good idea. In my view it will be the end of human progress morally and scientifically rather than the beginning.

<comment><USER4> Do you believe in inserting a heart stent to save someones life from coronary heart disease, potentially buying them many increased years.

Longevity science is basically all of human healthcare practices, but iterated ad infinitum. Where do you draw the line?

We only lived to our 30s just a few hundred years ago. Was that the natural way things should be?

<comment><USER5> Say no to heart stents, btw. Do the research.

<comment><USER4> ... you arrogantly said to a medical professional working at a hospital ...

<comment><USER5> Sorry if I came off as arrogant. I want more people to know about the uselessness of stents.

[https://www.nytimes.com/2018/02/12/upshot/heart-stents- are-u...](https://www.nytimes.com/2018/02/12/upshot/heart-stents-are-useless- for-most-stable-patients-theyre-still-widely-used.html)

</comment></comment></comment></comment></comment></comment><comment><USER6> As documented by Dr. Rhonda Patrick (and others), fasting can trigger cellular autophagy and reduce senescent cells without the use of drugs. [https://www.foundmyfitness.com/news/t/fasting](https://www.foundmyfitness.com/news/t/fasting)

<comment><USER7> Well. To be fair these theories are based on studies using mice. Is there some parallel to humans? Likely. But that nonetheless remains to be seen.

<comment><USER4> Sadly it takes a century to do those studies

<comment><USER8> There's a substantial tradition of fasting in Christian (especially Orthodox) and Islamic faiths. I'd say that even if we don't know the mechanism of action, the fact that it was something preserved through the years rather than abandoned means it merits thought about its benefit.

<comment><USER9> Religious fasting won't induce autophagy. At least in those religious fasting traditions that I know of (Christian lent and Islamic Ramadan) observers can consume calories each day. Autophagy (IIRC) only starts after several days with zero caloric intake.

</comment></comment></comment></comment></comment><comment><USER4> I think senescence may be largely driven by viral infections. The top gene associated with senescence is hijacked by many viruses to lock the cell cycle into a specific point and optimize energy production, which viruses need to propagate.

[https://medium.com/@InfinoMe/senescence-links-between- heart-...](https://medium.com/@InfinoMe/senescence-links-between-heart- disease-genomics-and-aging-fa78bde773da)

We need better antivirals so we can kill off stuff like Epstein-Barr that infects so many of us for a lifetime.

</comment><comment><USER10> This is curious:

[...] says Kirkland, who is also running a handful of clinical trials at Mayo for repurposed cancer drugs and _natural products_ that have been shown to kill senescent cells in mice. [...]

What are those "natural products" I wonder?

<comment><USER11> [https://www.clinicaltrials.gov/ct2/show/study/NCT03430037](https://www.clinicaltrials.gov/ct2/show/study/NCT03430037)

[https://www.clinicaltrials.gov/ct2/show/study/NCT03675724](https://www.clinicaltrials.gov/ct2/show/study/NCT03675724)

</comment></comment><comment><USER12> > _In a lab just south of San Francisco..._

I'm always so amazing that Silicone Valley is so obsessed with finding the fountain of youth, yet so willing to dash their own youth upon the rocks by working long hours, putting off having kids and starting a family, etc.

<comment><USER13> One person's dashed youth is another person's life well spent

</comment></comment><comment><USER14> I think we are the bubble generation, like the poor schmuck who died last in the ww2, humans will live forever and conquer the space.

<comment><USER15> But that means we'll be the youngest, hottest, and coolest people in the afterlife.

<comment><USER16> damn, good point.

Do you want to be the hippest dead person or the lamest, out-of-touch alive person? Hard decision

<comment><USER17> Live fast, die young and be a good looking corps

<comment><USER18> Well, I messed that up already. Too late to fix it.</comment></comment></comment></comment></comment>


That's me in the picture: Kevin Berthia on the Golden Gate bridge - <AUTHOR> http://www.theguardian.com/artanddesign/2014/oct/17/kevin-berthia-golden-gate-bridge?CMP=fb_gu

<comment><USER2> Ted talk by Kevin(the officer): [http://www.ted.com/talks/kevin_briggs_the_bridge_between_sui...](http://www.ted.com/talks/kevin_briggs_the_bridge_between_suicide_and_life?language=en)

</comment><comment><USER3> Death by suicide is very common. In the US there is one death to suicide every 13.3 minutes. In the UK about 12 men die each day.

[http://www.afsp.org/understanding-suicide/facts-and- figures](http://www.afsp.org/understanding-suicide/facts-and-figures)

[http://www.mandown.co/](http://www.mandown.co/)

<comment><USER4> Sorry to nag, but there is no reason to put those similar metrics in two different "measurements". That just makes the ratio blurry.

drunk trol...

<comment><USER3> Replying to an old comment:

You're right. I tend to not change the numbers when I quote them. That makes it easier for people to check that I am accurately reporting from the source rather than just pulling a narrow - wrong - interpretation.

Statistics are tricky. One source of error is to misquote a statistic, or to give it a different context. Thus, I try to avoid doing that.</comment></comment></comment>


Notice of Data Security Incident - <AUTHOR> https://www.minted.com/data-incident-notice <comment><USER2> Timing aligns with Salt vulnerabilities (CVE-2020-11651 and CVE-2020-11652)?

[https://blog.f-secure.com/new-vulnerabilities-make- exposed-s...](https://blog.f-secure.com/new-vulnerabilities-make-exposed-salt- hosts-easy-targets/)

<comment><USER3> Those were pretty well publicized CVEs when they were patched.

On the assumption that this data breach was caused by those CVEs (which I think were even publicized by the US CISO / NSA, how does the average website- hosting company find out about CVEs that apply to their stack in a timely manner? (note: I'm playing as devil's advocate, but would seriously like to hear realistic answers)

<comment><USER4> My answer is probably a bit cynical, but I believe it's accurate. The average when it comes to security and patching is pretty low, so on average, a hosting company probably doesn't find out about it, or patch it.

The majority of companies I've seen operations at didn't have people trawling the web looking for these kinds of issues. In theory you can sign up to get CVE notifications, and hopefully the software vendor will put a message on a mailing list. Whether anyone subscribed to that list is another question, and whether anyone reacts to it is another matter.

The challenge for most orgs I've seen would be even determining what tools (and versions) they need to keep on top of updates for. In a case like Salt however, I imagine short of being on their list (if they have one), most people's best hope is that one of their team sits on hacker news all day, and monitors relevant security resources, and knows salt is used.

Even big CAs don't get it right - the Salt attack was used against one of the certificate transparency servers. Clearly there's a gap between the theory and practice here.

<comment><USER5> Clearly we need some form of industry-standard notification mechanism, akin to security.txt for notifications.

Perhaps a well-formatted RSS feed at example.com/.well-known/security.rss ?

Email just doesn't work in 2020 for anything mission-critical.

<comment><USER4> Yes, that would probably work. This would then need to tie in with versioning support on the client side, so that people can "listen" for particular versions of dependencies.

As a user it would also need to support team or shared accounts, so that a whole team can get alerted to any issues in components of their stack.

Then need to get everyone to support yet another standard(!), and companies need to hunt through their existing stack and identify all the critical components - I imagine lots of people will forget their dependency on things like OpenSSL/OpenSSH and ensuring they track bulletins for their relevant version.</comment></comment></comment></comment></comment>


Imzy is shutting down - <AUTHOR> https://www.imzy.com/imzy/post/imzy_is_shutting_down <comment><USER2> I wish the founders well, but I feel like people nowadays give up too early. And this is one of the most extreme examples of that.

Most community sites take a while to grow and you really never know what will happen. Even Reddit was sort of a failure vs. Digg and they sold it off to conde nast. It was only later AFTER the sale when Digg messed up on their own and Reddit enjoyed success as a side effect.

You really shouldn't be building a community site if you're so impatient to give up so early. I mean the site opened to public in October 26 of 2016, that's exactly 7 months in existence. It's probably because they raised so much money, which is why you should never raise too much money when you're trying to build a community site. I have never seen a successful community site that raised that much money before getting traction.

<comment><USER3> I was there from early in the beta. The thing that annoyed me, when I suggested that people should take a look at it was the decision that you had to make an account to see content. Most people visited the homepage and then said 'no'.

<comment><USER4> This is one of the main reasons i detest pinterest. Lately they have changed, so that you can see small amount of the content, before annoying you with the login screen.

<comment><USER5> Ditto for Quora. I see interesting content, but they annoy me so much with their accounts (even when I'm just reading) that I never spend much time there. Don-t worry, I will create an account when I have something to say, but until then just let me be.

</comment></comment></comment></comment><comment><USER6> Hi, I'm the founder of Imzy. It's a hard day but I want to make myself available, especially to entrepreneurs who may have questions. This last 2 years has been fun, and hard and I've learned a lot. You can reply here or email me at firstname.lastname@example.com

I also have an amazing staff of developers, community minded folks, product people, executives, who are looking for work. Many of them mare open to moving (we are in Salt Lake City) and all are open to remote work. They are all very talented. Please drop me a line if you're interested.

<comment><USER7> Hey Dan, I was a member in the early beta, am really sad to see Imzy go but really appreciate you guys branching off and making the efforts toward a new site (which I agree definitely still needs to exist).

> We still feel that the internet deserves better and hope that we see more > teams take on this challenge in the future

As someone with a headful of ideas hoping to potentially take on this challenge (:P) - any writeups or info on scaling/architecture would be much appreciated. There are some HighScalability articles on the bigger sites but every bit of info on comparison of architectures helps us newbies, heh.

Also, as others asked about - if you guys do manage to open source, that could be a starting point for those who liked Imzy's layout/model (personally as one of the ones who likes aspects of "oldschool" and novel design concepts, I'd go in a diff direction; but the engine could still help me figure out components needed and possibly other scaling/metrics/etc logic)

Thanks for giving it a shot, take care man.

<comment><USER8> > _any writeups or info on scaling /architecture would be much appreciated. > There are some HighScalability articles on the bigger sites but every bit of > info on comparison of architectures helps us newbies, heh._

I don't think Imzy's scalabilities issue is what did them in. I signed up to see what it was about, and saw a JS bug and reported it, and they not only fixed it super-quick, but also sent me a thank-you sticker. So their team, while imperfect as all teams are, was at least responsive and dedicated.

If I had to guess - and I do - their problems stemmed from their community size not growing as rapidly as it could have, and monetization.

That's the interesting thing - how do you build a community? How do you build a bunch of communities? How do you advertise, how do you tackle moderation successfully, how do you keep people invested, etc.

There's a billion write-ups on writing code, but nowhere near enough on running a meta-community.

<comment><USER9> Building "a community" is one thing. You don't need a product to build one community. You really just need passion, credibility, and perseverance -- and some combination of a blog, email list, and facebook/slack group as the tool.

Building a bunch of communities (aka facilitating community) is a different beast entirely, and seldom takes off very quickly at all. The best example of facilitating community is Meetup.com.

I've been working on a facilitation of community model called Horizon ([http://www.horizonapp.co](http://www.horizonapp.co)) which is best thought of as airbnb/couchsurfing with friends, friends of friends, and communities. So, privately, rather than publicly with strangers.

You can either facilitate existing community, or build a community. Trying to do both is a recipe for disaster imho.

</comment></comment></comment></comment><comment><USER10> Wait, what? They raised a $8M Series A less than a year ago! [https://techcrunch.com/2016/10/26/imzy-raises-8-million- seri...](https://techcrunch.com/2016/10/26/imzy-raises-8-million-series-a- round-opens-communities-platform-to-everyone/)

That was also the time it was opened to the public. This shutdown appears to be a strong counterpoint against Reddit alternatives becoming an inherently successful business prospect.

<comment><USER11> >a strong counterpoint against Reddit alternatives becoming an inherently successful business prospect

It looks like Voat is not in good financial shape too:

[https://voat.co/v/announcements/1866053](https://voat.co/v/announcements/1866053)

[https://voat.co/v/announcements/1881376](https://voat.co/v/announcements/1881376)

<comment><USER10> Voat never raised millions in venture capital, though. (and _can 't_ given their content/userbase)

<comment><USER12> They will probably have a hard time raising from institutional investors, but my guess is their userbase is primarily single men who spend large amounts of time on the computer, a decent subset of whom have spending cash.

The "goats" are also people who feel like they've been politically badgered into a corner, so I suspect they will spend to maintain their last refuge. Your will to fight goes up as the space you are confined to gets smaller.

I think there's definitely a market for a "social network of last resort" in this age of community guidelines.

Which... I think is a great thing. It's good that Twitter, Reddit, etc, are being aggressive about harassment. That promotes the freer flow of certain ideas (feminism, social justice, etc). But then that necessitates an alternate space for the free flow of opposing viewpoints (harassment filters out the weak, feminism is cancer, this woman should be raped for her opinions, etc).

<comment><USER13> _Which... I think is a great thing._

You think it's a great thing that there is less dialogue between people with differing opinions and more places that function as echo-chambers?

<comment><USER14> Yes I think it is a good think there is less dialogue between hate groups. I want them to all feel they are the only ones in the world with those beliefs so they died off with them.

<comment><USER13> Why would echo chambers, where people are surrounded by those who think like them, convince anyone that they are alone in their beliefs?

<comment><USER14> Honestly my response is the result of reading the thread wrong shortly after waking up.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER15> I run an online community. Building a safe space is extremely difficult and full of grey area, online or offline.

There's a fine line between the freedom to express yourself and offending someone else. As a community moderator, choosing what is and isn't offensive is by definition subjective. It's an impossible task for a global, multi- cultural community. You end up with a vanilla message board where most interesting thought/debate is stifled. Reminds me of the campus "safe space" debate.

<comment><USER16> You really don't want to cater to the easily offendable, imo.

I remember writing an ebook on affiliate marketing when it was a new thing (free for email subscribers), which had the word Bullshit stamped on an image. Two people said maybe I should tone down the language heh.

Fuck right off, buddy :D

<comment><USER17> This. The easily offended are a tiny minority, and those who attempt to cater for them too much have usually had their product or business fail.

Don't worry about people in a community who get easily offended. If they like the community they'll stay, if not then there's not really anything lost.

</comment></comment></comment><comment><USER18> It seems perverse that I only learn about a lot of products when news of their shutdown hits HN. I'm not exactly sure I'm sure what Imzy is for, but it seems in some ways similar to a concept I had for online communities built around discussion of content. Might have been right up my alley.

<comment><USER19> > I'm not exactly sure I'm sure what Imzy is for

If I recall, it got started right around the time there was a lot of shenanigans going on at Reddit around corporate drama, censorship, and the nastier subreddits. Imzy and Voat popped up to try to offer an alternative. (My impression is that Imzy was aiming for less awfulness and Voat aims for less censorship.)

<comment><USER3> It was basically aiming to be a nice, polite version of Reddit.

<comment><USER16> So, what would Imzy do when a user started acting "not nice"?

Because if they're forced to act nice, most people will just quit. Nobody's nice all the time (everybody has problems), and online communities are great for when you want to vent once in a while.

Plus, all the nicety invites narcissistic assholes who think they are better than everyone else.

I've never heard of Imzy either, and I think I keep up with all the potentially interesting stuff online. Launched in 2016 and not a single time I've even read the name.

<comment><USER20> They'd probably ban them.

Unfortunately, having your site based around the idea of throwing up barriers to entry, and kicking people out, isn't good for user growth.

</comment></comment></comment></comment></comment><comment><USER21> October 2016: [https://techcrunch.com/2016/10/26/imzy](https://techcrunch.com/2016/10/26/imzy)

"We now have a number of years to take our time and get the community thing right."

Less then a year later they give up. Why? Some minutes ago, there was a post of the founder here saying they still have most of that $8m: [https://news.ycombinator.com/item?id=14411586](https://news.ycombinator.com/item?id=14411586)

<comment><USER22> [https://news.ycombinator.com/item?id=14411586](https://news.ycombinator.com/item?id=14411586) ?

</comment></comment><comment><USER23> I worked on [https://microco.sm](https://microco.sm) with mattrco and it was forum/community software too. It looks like [https://www.lfgss.com/](https://www.lfgss.com/)

The #1 problem with a community startup: Every community is itself a startup.

The revenue math and compounded growth all makes sense, but you need to assume that few of your communities survive, and that they each take as long as a startup to get traction and grow.

If it takes you 1 year to get an MVP of sufficient quality to start attracting communities, it's still going to take the community at least a year to have sufficient attractiveness to bring in members. And it's unlikely that either will take as short as a year, and if it did that isn't going to be enough to bring in another round of funds to keep going.

Community startups are hard.

<comment><USER9> "Community startups are hard."

Ain't that the truth. I've got scars to prove it.

</comment></comment><comment><USER24> I spent 5 minutes on the site, and I still have no clue what it is... I would like to know, since it's interesting to understand what people have tried and gave up on.

<comment><USER25> It was like reddit with a shinier but harder to use UI, and less racists.

<comment><USER26> Fewer racists. Or did you actually mean people who on average were less racist?

<comment><USER27> "Less" is correct, and your interpretation is ungrammatical.

Here is what the experts (linguists) have to say:

> less has been used of countables in English for just about as long as there > has been a written English language

\-- [http://itre.cis.upenn.edu/myl/languagelog/archives/003775.ht...](http://itre.cis.upenn.edu/myl/languagelog/archives/003775.html)

</comment></comment></comment></comment><comment><USER28> Imzy was a nice place to be.

Some of the problems I had:

1) The interface was confusing. Making posts was confusing.

2) Users were allowed to create communities, and they did. There were a gajillion of very tiny communities. This fragments the userbase and makes each tiny community seem dead.

3) Not enough users. Seriously, seeding the community with posts is a good thing. It sets tone and gives people something to interact with. If you're a startup in this space you need to hire a few people on minimum wage and get them to spend 9 hours a day making posts on different accounts.

It's a shame to see it go.

<comment><USER7> 4) login required. Seeded content does nothing to attract new users when behind a wall. Hell, I _had_ an account and the content still felt a degree removed from when I wanted it. Even a static cached digest would at least attract new users.

Agree on it being a shame though. Imzy was founded by a contingent of "the good admins" who've left reddit, as far as I can tell.

<comment><USER29> Required login is a problem.

</comment></comment></comment><comment><USER30> "The site will go dark on June 23rd."

(1) Two years is too little time to create a Reddit alternative (2) shutting it down in less than 30 days is really bad.

<comment><USER31> Reddit took off within months of its launch. ~30 days to download data is pretty standard.

<comment><USER32> Reddit spammed fake comments for months in order to gain traction...

[https://motherboard.vice.com/en_us/article/how-reddit-got- hu...](https://motherboard.vice.com/en_us/article/how-reddit-got-huge-tons-of- fake-accounts--2)

(I'm not proposing Vice as a great source, but it's the first thing that came up on google.)

<comment><USER33> I first checked them out the day they opened (July 05), and was using them daily by January 06. There were definitely real people and a growing community by then.

I wouldn't attribute their success to fake accounts, although the fake accounts were probably necessary to seed the community. Rather, they took off once they added comments (Dec 05, IIRC). It's the same story as Whatsapp (messaging), YouTube (related videos), and AirBnB (pro photos): there was one feature that they really needed for product/market fit, and once they added it, people started using the product on their own.

<comment><USER32> Steve Huffman himself attributes early success to the spam campaign.

<comment><USER34> Yep, because otherwise the site would have seemed like a ghost town despite growing because of the 1-9-90 rule. They had to keep submissions going until they attracted the 10% of users that makes a community truly come alive.

</comment></comment></comment></comment></comment></comment><comment><USER35> nothing on the home page or "learn more" link actually shows anything about the site, just that it's yet another online community. I'm not surprised this shut down so quickly, you're giving almost no details to the user at all about how it works, what it looks like, or any sort of interactive demo. requiring someone to sign up just to see it in action is silly.

<comment><USER36> I wonder what their bounce rate was. Seems like such a strange decision to put a community behind mandatory registration… should have dropped you into some public topics instead.

<comment><USER37> How in the world did they raised 8 Million a mere 8 months ago is baffling to me

</comment></comment></comment><comment> brian-armstrong I don't know anything about Imzy but this page traps my back button. I hate that :(

</comment><comment><USER38> Whenever I see a startup shutting down, sadly, my first thought is: Who? Granted I don't work in technology, but I'm a big user, fan, consumer, etc. So I have to wonder: Am I just missing these companies, is their market too narrow, or do they have trouble reaching a larger audience?

<comment><USER39> Hey, Imzy is the first one of those startups you are talking about, that I did know before reading its "incredible journey" message :-) It's also one of the very few the purpose of which I understood.

Granted, I didn't think it was a startup but a hobby project run by 2 or 3 volunteers on their free time... That millions and millions are invested in such projects is a mystery to me.

</comment></comment><comment><USER40> What was this? It appears to be some sort of community, yet the front page offers zero discoverability?

</comment><comment><USER41> I'm on HackerNews multiple times every day.

Imzy is a company that came, raised over $10MM in funding, and went out of business in 7 months. This is the first I've heard of them.

How on earth does that happen? It's inexplicable.

<comment><USER6> We were actually a company just shy of 2 years.

<comment><USER42> You were a /usable platform/ for just shy of 7 months.

Being a company and having a usable product are not similar things.

</comment></comment></comment><comment><USER43> How do you burn through 8 million dollars in 2 years on what's basically a forum? This is crazy.

<comment><USER44> bay area salaries?

<comment><USER37> They are front Salt Lake City

</comment></comment></comment><comment><USER45> If you will miss Imzy, check out Lyra - we're a nonprofit conversation service which respects language and the reader's attention. www.hellolyra.com

We're also a nonprofit and don't accept ad revenue or investment, so please excuse the plug. In contrast to Imzy, we're more focussed on conversation than community-building, but this enables us to make our sharing model harrassment- proof by design.

<comment><USER9> Just checked your home page. Really no idea what the service is after 3 seconds of looking. Sadly, that's all most people are going to give you when they land on your website.

</comment></comment><comment><USER46> That's too bad. I tried it out, made an account and posted and everything, but there were too few people and everything was very tricky to figure out.

I wish there was a simple Reddit clone that focused on positivity, like Imzy, but it seems that all of these things are way too expensive.

I mean cmon, eight million dollars (in the last round alone) wasn't enough to keep a link sharing site alive? How is that possible? What on earth were they spending that money on?

<comment><USER16> I sort of don't like how centralized Reddit is, but there is indeed a subreddit for everything.

UpliftingNews, Wholesomememes seem to be very popular, positive shit being the main content

</comment></comment><comment><USER47> I clearly remember when Imzy and Voat sprung up out of reddit turbulence, trying to ride a wave of discontent in the reddit community.

I'm sorry to say I was cynical and doubted they would last.

You can't force a community to happen. I never followed Voat but I did give imzy a chance and the feeling was very much that they were trying to force a community.

Personally I think the best chance of building a community is to build it around a service. Look at reddit and imgur for examples. They both started out offering a pretty specific service to users but grew into communities because people could use the service in a social way.

I believe there are other examples of this but mentioning instagram feels silly since they're now owned by THE largest community. But it's the same thing, they were a photo website and now every 13 year old is there.

I'm sure there are more examples of this. Offer a service to people, something mildly useful or entertaining, and attach a social aspect to it and I'm sure you'll get a community to spring up.

<comment><USER48> [http://cdixon.org/2015/01/31/come-for-the-tool-stay-for- the-...](http://cdixon.org/2015/01/31/come-for-the-tool-stay-for-the-network/)

This article by Chris Dixon sums up what you're trying to say — couldn't agree more with it!

</comment></comment><comment><USER49> I checked out Imzy a couple of weeks ago:

1\. Barrier to entry was a login (I had previously gone here and left when it first started, and didn't sign in. I eventually created an account just to check it out.)

2\. Interface was confusing

3\. Exploration felt difficult

4\. It wasn't immediately obvious why I was there

5\. Not enough juice/content to bring me back

tl;dr: Social networks + open domain communities are hard.

</comment><comment><USER50> This was inevitable from the very beginning. Disagreement forms the kernel of worthwhile discussion.

An argument can also be made that "echo-chamber bubbles" are affecting people personally, intellectually, and culturally in tremendously harmful ways, so this is a very tiny step in the right direction.

<comment><USER51> Can that argument be made persuasively, though? I for one do not enjoy online "debating" one bit and try to avoid it as much as possible. I see it mostly as people shouting at each other.

Meanwhile, the best "debates" I've ever had were with people within what could arguably be described as my "filter bubble."

</comment></comment><comment><USER52> Imzy suffered from the big launch syndrome which always fails, instead they should have applied the proven path approach [http://course.feverbee.com/the- proven-path/theprovenpath.pdf](http://course.feverbee.com/the-proven- path/theprovenpath.pdf) community startups are hard but success is possible with lots of patience, i run [https://www.kenyatalk.com/index.php](https://www.kenyatalk.com/index.php) and can vouch for the proven path

</comment><comment><USER53> I like Imzy and am sad they are shutting down.

Reddit needs alternatives to it that works better.

I am working with someone to open source their Kr5ddit code on Github by rewriting it. Look at [http://k666.kr5ddit.com](http://k666.kr5ddit.com) which is a start with no money invested yet. Look at [http://kr5ddit.com](http://kr5ddit.com) to see how it uses bitcoins to buy Kr5ddits used to moderate stories and comments. It is not complete yet, but it is a good idea and allows anonymous posts without an account, but you can't earn kr5ddits without an account. Imzy tequired invites to get an account.

<comment><USER54> Why does Reddit need alternatives?

What would "works better" entail?

</comment></comment><comment><USER55> My team and I launched a Reddit-like platform called Snapzu ([http://snapzu.com](http://snapzu.com)) in 2013, a couple years before Imzy launched and I know exactly what the struggles/hurdles are in building community and generating consistent but vital user growth. | However, we are extremely lean (all of us are working part time and out of pocket) so our monthly costs of operations are extremely low, allowing us to keep going. We also have no outside funding, so basically no investors breathing down our necks, or any rush to monetize.

That being said, our original base plan (like Imzy's) never really materialized (because of the harsh "network effects" AKA "chicken or egg problem"), so we've since pivoted allowing us to use most of our core tech (of which we admit we slightly over-built at the time) in a separate (but still completely tied in) SaaS-like service that allows bloggers to have their own Reddit-like communities for their blogs.

Utilizing a voting community on a blog brings several previously untapped benefits which I won't get into here, but our recently launched landing page at the Blog Enhancement Suite ([http://blogenhancement.com](http://blogenhancement.com)) explains it. Note: It's still a work in progress and we're playing around and A/B testing the copy, but the service is live.

I've been paying attention to and observing Imzy ever since I learned about it, which was shortly after their launch. Some mistakes I feel they made, right off the top of my head:

1\. No front page (for lurkers): They force users to join to be able to view content. The 90/9/1 rule is real, ESPECIALLY in the "community" space. 90% of users just want to lurk and that's just the nature of the internet. It's probably the same here on HN. 9% will participate in some ways, voting, etc. 1% will submit and comment, etc.

2\. Lacking in social media: I've been following the @Imzy Twitter account for the entire duration, and most of their Twitter activity basically stopped approx 5-6 months ago. At that point I had a feeling that they we're starting to "give up" because it likely wasn't effective enough for the time they we're dedicating to it. We faced that exact problem, but we split up our content into 15 main categories (science, gaming, politics, tech, etc) and have Twitter, Medium, Wordpress, etc profiles for each. We then automated them using IFTTT using our category RSS feeds so that each account automatically tweets/shares the best posts as submitted by our users into said category.

3\. No real target market: It's really hard to get people to stick around when most of them DO NOT share most common interests. Again, it's why we made sure to categorize the content so that people that want Science stuff can easily find it and/or subscribe to the Science RSS, follow the Science Twitter account, etc. We now also only focus on attracting bloggers, our new REAL target market (in a business sense) after the pivot.

4\. Giveaways: Imzy was giving away all these plushys and stickers and stuff in return for loyalty. I just don't believe many people care about gimmicky things like that and it must drive up the costs/expenses that could otherwise be spent elsewhere with more effectiveness.

Imzy IMHO also did a lot right. I envy their PR tactics/strategy, as they got mentioned on all the top tech sites numerous times. Their devs/team made a solid app/website.

I wish the Imzy folks best of luck in their future endeavors.

<comment><USER56> I'd be interested in snapzu, but when I put in my email to request an invite, it says "already registered", yet when I try to log in, it says "email not in our database".

</comment></comment><comment><USER57> If you're looking to create your own community, I run a small tool called HelloBox

[https://www.hellobox.co](https://www.hellobox.co)

We started as a "build your own HackerNews" then we transitioned it to a "build your community" tool. We've been going for about 3 years - a plenty of work to do and undergoing a pretty big re-design at the moment.

</comment><comment><USER58> Do you think if you pivoted into a niche like drivetribe you could have survived?

[https://www.reddit.com/r/startups/comments/533ml7/our_journe...](https://www.reddit.com/r/startups/comments/533ml7/our_journey_building_imzy_for_the_first_year/)

</comment><comment><USER59> I still didn't get my stickers....

</comment><comment><USER60> What did Imzy do? Anyone know?

<comment><USER61> They were a Reddit clone that tried to be more mainstream both in UX and content moderation.

<comment><USER62> Reddit never would have been reddit without gonewild and jailbait.

</comment></comment></comment><comment><USER63> The execution overall at Imzy seems lazy. Kind of shocked that a founding team that raised an A last October is folding in May. Embarrassing performance all around.

</comment><comment><USER64> I'll miss the community. Really nice folks. :-(

</comment><comment><USER65> Been on there for a while, but not posting much as... there isn't much to post about. Something of a pity, but also very expected.

</comment><comment><USER63> Overall execution feels lazy. Can't believe someone funded this team at a series A at that valuation.

</comment><comment><USER66> How did they go about promoting the site? I ask only because I have never even heard of Imzy until just now.

<comment><USER54> There were a couple of splashes of coverage about June/July 2016, and again in October. Faded out quickly after that.

</comment></comment><comment><USER67> Turns out the vast majority of people don't want to spend their lives in a permanent "safe space"[0]. That was a fast flameout

[0] [https://techcrunch.com/2017/04/25/a-chat-with-imzy-co- founde...](https://techcrunch.com/2017/04/25/a-chat-with-imzy-co-founder- jessica-moreno-on-building-a-kinder-online-community/)

<comment><USER68> I don't see what's massively objectionable about wanting to build a community based on tolerance, kindness and mutual respect.

<comment><USER69> It's an existential threat for people who want to be intolerant, unkind, and disrespectful, because it makes it clear that spaces that don't accept such behavior end up being at least as productive and as useful for the world as spaces that do.

Therefore it's extremely important for such people to establish the world as a a safe space against safe spaces, and to push the idea that such spaces are untenable or morally bad or whatever will avoid more of those spaces existing.

<comment><USER70> I make an effort to not be intolerant but I have found myself being attacked for holding beliefs and political positions that are "outside of the mainstream" and there are people who can not tolerate that.

I like that they made the attempt to build this but I would have never joined it because I could see myself getting into conflicts because of my beliefs.

<comment><USER68> Would you join a Subreddit which reinforces these political beliefs and is that not a safe space in itself?

It seems to me that everywhere on the internet that you might class as a 'haven of free speech' (whether it's 4chan, Twitter, Mumsnet or Atheists Rationalist Skeptics Anonymous) comes with an underlying set of social norms which to some extent preconfigure the kind of debate that will happen there. Imzy is just another one of those, no?

<comment><USER70> _Would you join a Subreddit which reinforces these political beliefs and is that not a safe space in itself?_

If I understand your question, yes. I would join such a Subreddit because an echo-chamber isn't what I seek.

I completely agree with forbidding things like doxing or making threats of violence but I'm concerned that "Safe spaces" only encourage intolerance towards other points of view.

Disagreement is good. Maybe I'm wrong and you can show me a side that I had never considered. Maybe you're wrong and I can present an argument that changes how you think about something. I have had my mind changed by a persuasive argument in the past. Perhaps I will again in the future. I have friends that I have seen change their views over time and I hope that I was at least a part of what caused them to change on those issues.

<comment><USER68> > If I understand your question, yes. I would join such a Subreddit because an > echo-chamber isn't what I seek.

Good.

> I completely agree with forbidding things like doxing or making threats of > violence but I'm concerned that "Safe spaces" only encourage intolerance > towards other points of view.

Now now. If I went on /r/the_donald and started leaving comments about Gun Control, Trans Rights and Abortion, you and I both have a fairly good idea what would happen.

How do I know that? Well, a giant Pepe the fucking Frog fills half the screen when I even load the page, for a start, and I literally cannot upvote in /r/the_donald until I click the frog and subscribe. It's the online equivalent of a pub hanging a sign on the door saying who it welcomes in. Sure, you _can_ ignore it, but are you really going to?

It's a de facto safe space. In fact, it's not even really a de-facto safe space, given Rule VI of The Donald is "This forum is for Trump supporters only." and if rule VII - "No linking to other sub-reddits" doesn't make it an echo chamber, I don't know what does.

Likewise, If I went on a Democrats subreddit and started raising Republican talking points, I'd be shown the door pretty quickly.

The issue isn't "pro" or "anti" safe-spaces, because everywhere is a safe space to someone. It's when people start to get selective about which safe spaces they're going to allow that gets to people.

<comment><USER71> > Now now. If I went on /r/the_donald and started leaving comments about Gun > Control, Trans Rights and Abortion, you and I both have a fairly good idea > what would happen.

/r/the_donald has become (or maybe always was) a safe space for 1488 identitarians. Things like /r/The_Donald and Stormfront are part of the problem just as much as safe space policies.

> Well, a giant Pepe the fucking Frog fills half the screen when I even load > the page, for a start, and I literally cannot upvote in /r/the_donald until > I click the frog and subscribe

Disable custom CSS, it's a dumb feature anyway.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER72> Looks like a wonderful product. Too bad I find out about it on the day they're shutting down.

</comment><comment><USER73> Why are you shutting down so soon? ~2 years doesn't seem like a very long time.

</comment><comment><USER74> Will you guys follow the trend recently and Open Source your code base?

</comment><comment><USER75> yet another startup I only hear about when they are shutting down.

<comment><USER76> Agreed. Why is that, and how can it be avoided? I guess that's the million dollar question.

<comment><USER77> that's probably why they are shutting down?

Bad marketing?

</comment></comment></comment><comment><USER78> Surprise, surprise. Last time I heared something about Imzy was when they were handing out beta invites.</comment>


Notice Israelis: Congress to approve E-2 visas today - <AUTHOR> http://thehill.com/blogs/floor-action/house/216459-house-set-to-expand-work-visas-for-israel

<comment><AUTHOR> ...which would grant visas to Israelis willing to invest around $50,000 in a US business: <http://en.wikipedia.org/wiki/E-2_visa></comment>


Twitter Enables Option for HTTPS by Default - <AUTHOR> http://www.securityweek.com/twitter-enables-option-https-default

<comment><USER2> I find it funny that they requested my password (via http) before allowing me to change to SSL-by-default.</comment>


Watch this flying car cruise around the skies of Slovakia - <AUTHOR> http://www.washingtonpost.com/blogs/innovations/wp/2014/10/29/watch-this-flying-car-cruise-around-the-skies-of-slovakia/

<comment><AUTHOR> This is rather impressive. In the video, for just a moment I thought he was going to take off directly from the freeway. Top speed of 100mph, range of up to 500 miles. How can I get a test ride?

It does require a pilot's license, and has lots of regulatory hurdles...</comment>


Node.js: v10.0.0 - <AUTHOR> <comment><USER2> In case anyone wants to read the release notes: [https://nodejs.org/en/blog/release/v10.0.0/](https://nodejs.org/en/blog/release/v10.0.0/)

</comment><comment><USER3> So is all that happened with async_hooks really that old stuff was deprecated? Is this stable now?</comment>


OnSen UI – Develop HTML5 hybrid and mobile web apps - <AUTHOR> https://onsen.io/ <comment><USER2> What's so "most beautiful" about HTML+CSS masquerading (badly) as UIKit?

I know, I know, every web framework is "best", "most" and "beautiful". But still, for once I would like to know what is so "beautiful" about web emulating native in a bad manner.

<comment><USER3> The killer feature of web is that there are at least 5 implementations from major vendors (Mozilla, Google, apple, Microsoft, Opera). Nothing else come close. I've been burned too many times before by discontinued products to use anything else for UI.

<comment><USER4> Funny thing is there's practically only Mozilla and Google left with their browsers. Microsoft, Apple and Opera all basically piggyback on the chrome renderer (prolly not entirely true for safari, but it doesn't run on anything besides apple anymore)

</comment></comment></comment><comment><USER5> The animations in the Anim tab of the demo still lag a bit on my Samsung S6. It's always these subtle, uncanny things that tell you it's not a native app

<comment><USER6> These, and/or lack of _deep_ integration with platform's UI features (e.g. keyboard shortcuts), and/or UI occasionally blanking out with 404 or 500 page because of networking problems.

Yes, you can usually tell webapps from native apps apart pretty quickly.

<comment><USER7> While I agree with you, it is also a consequence of not doing proper testing.

I have used a couple of native apps that crash on network problems, and in some cases they just vanish from the screen on crash without any OS dialog coming up.

I rather have to deal with mobile web apps than web widgets, specially if I have to code them.

</comment></comment></comment><comment><USER8> Alternatives: [https://framework7.io/](https://framework7.io/) and [https://ionicframework.com/](https://ionicframework.com/)

Did anybody evaluate all of them? On iOS I experienced that most approaches have issues keeping the header in place when the keyboard shows up.

<comment><USER9> I was curious to see if anyone posted how this compared against Ionic (which I have used since v1 and love).

Appreciate anyone who has used both chiming in with their thoughts in this thread.

</comment></comment><comment><USER10> I was just looking at this the other day--at first it looked pretty jank on my desktop chrome, but I switched to an android phone and the animations looked surprisingly slick. (Haven't tried on an iPhone yet.)

I know the bar for purists is "it will never be native", which is true, but this is a huge improvement from the state-of-the-art mobile webapp frameworks/widgets from ~5 years ago.

Definitely great to have options, especially for building/prototyping apps that otherwise wouldn't exist, e.g. because they'd be (for some/many developers) prohibitively expensive to MVP.

</comment><comment><USER11> We leveraged this for an internal product trying to see how far we could push a PWA with a native feel. Biggest pain was that it doesn't play nice with the Vue router and history API and really wants to function as a single page app. Happy to ping one of our product engineers to elaborate if folks are curious on more specifics.

</comment><comment><USER12> I really like how far mobile web apps and the ecosystem has come. This is right in line with my timeline of when it would get good.

Source: Former native mobile app developer that used to defend native mobile apps.

</comment><comment><USER13> This is pretty great on iPhone. One suggestion: on the carousel component, it requires too much of a swipe (50% of device width?) to feel native. Maybe reduce that to 20%?

<comment><USER11> The carousel is pretty garbage overall, we dropped it fairly quickly.

</comment></comment><comment><USER14> this directly competes with Ionic 4, which is a nice thing.

<comment><USER15> We're bit fans of Onsen at Ionic, definitely push us to improve

<comment><USER9> Hmm... Does this mean we can use Onsen as a 'drop in' replacement for the front end of an Ionic app? And simply rely on Ionic for the 'back end' routing etc.? I was just wondering if Onsen is mainly a set of CSS classes which could replace the Ionic ones for a different look and feel?

</comment></comment></comment><comment><USER16> This looks like a deliberate attempt at cloning iOS's aesthetic.

The demo does work well!

</comment><comment><USER17> So this is a competitor to ionic?

Can someone who chose this instead sell me on whether this offers anything better at the present stage? Curious to know when I should use this instead.

</comment><comment><USER7> Actually it looks quite good on my phone, congratulations.

</comment><comment><AUTHOR> [https://github.com/OnsenUI/OnsenUI](https://github.com/OnsenUI/OnsenUI)

</comment><comment><USER18> Obligatory, this uses Idris state machines to build a mobile app using OnSen UI:

[https://medium.com/the-web-tub/idris-state-machines-in- javas...](https://medium.com/the-web-tub/idris-state-machines-in-javascript- apps-b969e2cb6ed2)

</comment><comment><USER19> how does it compare to React Native?</comment>


Copy-on-Write in C++ and Rust - <AUTHOR> https://oribenshir.github.io/afternoon_rusting/blog/copy-on-write <comment><USER2> Note that Rust's "Cow" type is NOT an analogue of copy-on-write C++ strings.

The correct analogue in Rust are the Rc and Arc types, and the "make_mut" method that clones the data if and only if there is more than a reference.

Also the claim that "Rust's COW implements the Send and Sync traits, which due to Rust safety requirements, means the implementation is designed to be used in multi-threaded applications" is technically true, but highly misleading, since Cow of course doesn't have interior mutability, and so can't be modified if shared between multiple threads (unless put in a Mutex or equivalent container) and it's Send and Sync because all "simple" types do, and not because it's "designed" to be so.

Overall, the author doesn't seem very knowledgeable about Rust.

</comment><comment><USER3> I don't get what point is the author is trying to make. If it is to show that Rust outperforms C++ when implementing COW, I think he is mistaken. COW is intrinsically performance limited in multithreaded environments, this is not a language defect. The examples shown are definitely not apples-to-apples comparisons. The author compares C++ runtime-evaluated COW to a compile time evaluated strategy in Rust. At least, that is my take on this. I'm interested in learning Rust, but I feel either I am not seeing the whole picture, or Rust is only an interesting option if you are not already a seasoned C++ engineer. (with up-to-date practices on how to use the language)

</comment><comment><USER4> Example of generic COW implementation in C++: [https://github.com/ClickHouse/ClickHouse/blob/master/dbms/sr...](https://github.com/ClickHouse/ClickHouse/blob/master/dbms/src/Common/COW.h)

</comment><comment><USER5> How does one detect ownership bottlenecks in Rust?

<comment><USER6> Ownership on its own doesn't incur any performance overhead. If what you mean is the overhead incurred by using Rc and Arc, it's just something you have to be aware of.

<comment><USER5> > Ownership on its own doesn't incur any performance overhead.

That means barely anything.

The computational cost is paid at compile time for deciding who owns the object, but the consequences are still felt at runtime.

As I understand it, no parallel thread of execution can do anything to an object while I believe I need to write to it, by any mechanism presently in Rust (or planned?). So if new computational complexity creeps into the middle of my operation then the availability of that object begins to drop like a rock. Correct?

> it's just something you have to be aware of.

Take any feature in any language, and this solution doesn't scale. The general case is not, "I made the code slow and I should have been aware of what I was doing." The general case is, "someone who wasn't aware of what they were doing has broken something and now we need to find it when we don't even know who did it." and, "how do we explain to people how to do better in the future instead of just scolding them?" I have been living in this very space in another language for the better part of a month, and I expect to be here again later this year.

I have tools do find memory leaks, and performance bottlenecks. Is anyone thinking of analogous solutions for constrained parallelism in Rust?

<comment><USER6> > constrained parallelism in Rust

I'm... unsure what you mean. As far as I know Rust doesn't require any extra runtime overhead for parallelism that wouldn't be required in C++. Rust ensures you use locking mechanisms at compile time, but you still need those in C++, you just "have to be aware of it" in that case.

I suppose Rust does require a value shared across threads to be reference- counted, where that might technically be optional in C++. But then you get to do manual deallocations across threads, which just sounds like a nightmare. And each thread only has to increment the counter once, so the overhead should be minuscule compared to the overhead of creating a thread in the first place. The only exception would be if you have bad lock coordination, but again, that problem is no different in Rust than it is in C++.

<comment><USER7> > I suppose Rust does require a value shared across threads to be reference- > counted

It does not require it; that is one of many possible strategies, depending on what you're doing.

<comment><USER6> What are the other strategies? Aside from making it static.

<comment><USER8> Much like in C, you could use several other schemes such as a Mutex (or RwLock). There are crates which implement more complicated memory management primitives -- the most obvious example being crossbeam[1].

Crossbeam even has an implementation of an epoch-based memory manager[2] which (in very loose terms) amortises the cost of reference counting each object by tracking the epochs of each thread and freeing objects once all threads have moved past the "death time" of an object.

[1]: [https://docs.rs/crossbeam/](https://docs.rs/crossbeam/) [2]: [https://docs.rs/crossbeam/0.7.3/crossbeam/epoch/index.html](https://docs.rs/crossbeam/0.7.3/crossbeam/epoch/index.html)

<comment><USER6> Normal mutexes in Rust still have to be paired with a reference-counting structure. Those are separate mechanisms.

I don't know anything about the epoch-based manager, but it does sound interesting.</comment></comment></comment></comment></comment></comment></comment></comment>


What does it take to make Google work at scale? - <AUTHOR> https://docs.google.com/presentation/d/1OvJStE8aohGeI3y5BcYX8bBHwoHYCPu99A3KTTZElr0/ <comment><USER2> Keep in mind this is really "How does Google (and other big companies) do it", not "what does it take", because what it actually takes is much simpler than custom hardware and custom software. This was all pretty accessible 15 years ago using available software; the trick was putting it together right.

In general, the maxim of "cache everything, everywhere" is the cheapest way to gain both speed and availability. Of course you need to have results already to cache them, which is where all that big data processing comes into play, but there's still way more optimization going on here than is necessary to get results like this. You could make a tradeoff and give people newly-processed results more slowly and still give them mostly what they want, and not have to maintain so much custom software+hardware infrastructure.

Sometimes I feel like Batty from Blade Runner when I think about how well old crappy software used to work. _" I've seen things you people wouldn't believe. Attack ships on fire off the shoulder of Orion. I watched mod_perl apps serve 50 thousand dynamic requests per second with nothing but Apache and MySQL. All those moments will be lost in time... like tears in rain..."_

</comment><comment><USER3> Nice overview. I particularly like how they visualized BigTable and MapReduce. Will make it easier for some to understand. For those liking Spanner, Google has exceeded that with their awesome F1 RDBMS (built on Spanner/GFS) below:

[https://static.googleusercontent.com/media/research.google.c...](https://static.googleusercontent.com/media/research.google.com/en//pubs/archive/41344.pdf)

Can't wait for someone to clone this. Come to think of it, has anyone cloned Spanner? I recall some calling GPS a hack but I thought it was engineering brilliance. Spanner was some good work, too.

<comment><USER4> The people who are working to it are the Cockroach Labs folks: [http://www.cockroachlabs.com/](http://www.cockroachlabs.com/)

<comment><USER3> The Wired article says they're not fully replicating Spanner, esp is time tricks. However, they are replicating a lot of its other capabilities. So, that's still a great tech in development. Thanks for the link. :)

Still gotta wait a while for a full Spanner replacement with GPS tricks and all. Or something even better hopefully.

<comment><USER4> You don't _NEED_ the GPS tricks and all, and realistically you can replace some of the HLC code in Cockroach with a time network time server implementation that speaks to GPS / Atomic clocks, if you want.

<comment><USER3> Good to hear :)

<comment><USER5> Note that Spanner always waits out the clock uncertainty on commit, while Cockroach doesn't need to do that - by design there are fewer situations in which the offset really matters. We can still benefit from a good bound in some situations, in particular you get global linearizability between causally unrelated transactions by waiting out the maximum clock offset (so just what Spanner does). BTW, I'm not sure when you would ever need the above guarantee, but it's cool! (disclaimer: actually working on the project).

<comment><USER3> Again, appreciate the insight.

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> "NTP isn't accurate enough so we use a hardware clock assist that uses GPS and atomic clocks" \- Google

I think it is crazy that something as simple as keeping time can have such a complicated solution at that sort of scale.

Every review I hear about working at Google makes me want to stay away, just like the recent conversations about working at Amazon, but crazy stuff like this always piques my interest.

<comment><USER7>
       I think it is crazy that something as simple as keeping time can have such a complicated solution at that sort of scale.

Time keeping is one of the things that is most often underestimated and screwed up at any scale, in my experience. Many a subtle bug turns out to be a poor assumption or misunderstanding about how clocks work. Or calendars.

<comment><USER8> Can you elaborate on the need? What possible reason, short of a very contrived one, is there for having to keep a large number of machines' clocks in-sync?

And for that matter, why would anyone build any process/system/software that requires a distributed system's machines to all have their clocks in-sync. I am baffled.

<comment><USER9> Many security protocols use credentials that are only valid for a brief time. Here is a simple example of a problem caused by my server's time being more than 10 minutes off from the time on S3:

[http://illuminatedcomputing.com/posts/2015/04/paperclip_expi...](http://illuminatedcomputing.com/posts/2015/04/paperclip_expiring_url_and_request_has_expired/)

<comment><USER10> Yep, security is a big one. Authentication & encryption can behave very unpredictably if your times are not in sync. So, you might not be able to login to a server, or connect via HTTPS etc

</comment></comment></comment></comment></comment><comment><USER11> Are these slides attached to a video presentation or something similar? I'd really like to see the talk this accompanies.

</comment><comment><USER12> _> Wow, this file is really popular! Some tools might be unavailable until the crowd clears._

Hopefully the irony isn't lost on the readers of this document :)

<comment><USER13> What irony?

To me, this isn't irony at all. It shows that google can't defeat the algorithmic complexity of things like consensus and shared state editing, and so gracefully degrades functionality.

That shows a very good understanding of scaling - realizing any solution you choose has limits and tradeoffs, and thinking about and handling those limit cases sanely ahead-of-time, rather than waiting for it to fall over and hoping for the best.

<comment><USER14> I got an error message saying the document wasn't available at all and to come back after the "crowd clears" which is much more ironic... after I refreshed a bunch it became available...

</comment></comment></comment><comment><USER15> It's presentations like this that give me a that spark to go out and build crazy-shit. Sometimes you HAVE to reinvent the wheel because wheels just don't work to move objects the size of the planet the wheel is bound to. I'm not a fan of re-inventing the wheel by any means but it's this kind of stuff that makes me love going to work every day and basing ideas off presentations like this!

<comment><USER11> Well, it isn't every day you get to redefine π :D

</comment></comment><comment><USER16> previous discussion on work from the same author: [https://news.ycombinator.com/item?id=9652528](https://news.ycombinator.com/item?id=9652528)

</comment><comment><USER17> Is it possible to view the video or the presentation given in which the speaker talks more in detail explaining the slideS?

<comment><USER18> Hi, author here.

The talk for which I put the slide deck together was given at a summer school and unfortunately not recorded, but if there is sufficient interest, I might tape a re-run and upload it. (Though unlikely to have time in the next month, so it might be a while.)

In the meantime, the original papers (listed in the bibliographies at [http://malteschwarzkopf.de/research/assets/google- stack.pdf](http://malteschwarzkopf.de/research/assets/google-stack.pdf) and [http://malteschwarzkopf.de/research/assets/facebook- stack.pd...](http://malteschwarzkopf.de/research/assets/facebook-stack.pdf)) have _a lot_ more detail than my (very condensed) slides.

<comment><USER19> Please DO re-run the talk and share it with us. It would be quite valuable for a variety of audience. Thanks in advance!

</comment></comment></comment><comment><USER20> I understood some of these terms.

</comment><comment><USER21> Wow. That's amazing. Anyone knows how they do a backup/restore of a GFS distributed file system? (in case they do backup of some sort)

<comment><USER22> Apart from other people mentioning that distributed file systems have replication as a part of the architecture, Google also uses tape[1][2].

[1] - [http://www.tested.com/tech/1926-why-google-uses-tape-to- back...](http://www.tested.com/tech/1926-why-google-uses-tape-to-back-up-all- your-emails/) [2] - [http://www.theregister.co.uk/2013/12/29/a_year_of_tape_tittl...](http://www.theregister.co.uk/2013/12/29/a_year_of_tape_tittle_tattle/)

</comment></comment><comment><USER23> This may seem irrelevant, but as a GPU computing researcher, I'm still disappointed that GPU still hasn't made its way to be the first citizen at data centers. I know world of HPC looks much different, but I wonder when GPU can be vastly used in data centers, and will NVIDIA's Pascal architecture make a huge impact on this?

<comment><USER24> I don't think GPUs will be big with "web services" datacenters anytime soon.

As the slides mentioned, the difference between this web-services stuff and HPC is that HPC has a much higher compute/data ratio. Said another way, this web-services stuff is all about moving data, collating it a bit, and less about intensive mathematical processing of it.

Most of the boxes in the diagrams are datastores. Block stores, object stores, columnar stores, caches. I hate to say it but... big data. Not (as) big compute.

</comment></comment><comment><USER25> The thing that might be scary working at Google is that you work with tech than no-one else uses.

<comment><USER26> I'm not sure that Google thinks of that as a problem. In fact, I'd argue a lot of the tech that many companies use nowadays exists _because_ Google pioneered it.

<comment><USER27> I think that he's talking about the employee perspective, not the company perspective. Google's tech stack is mostly proprietary, which means you can't take your tech skills with you to a new employer.

...And I haven't found it to be a major problem, being an ex-Googler a little over a year out. Tech skills are easy to pick up on your own. My current startup is based on Node.js, a native Android client, and AWS; the one before it was Django & Heroku. Haven't tried looking for jobs yet - I made enough at Google to not have to worry about that for a while - but I occasionally get in-bound interest from big-name, fast-growing startups. Most clueful hiring managers look for experience with _problems_ , not with _solutions_ , and Google lets you face problems that the rest of the industry won't deal with for a while.

<comment><USER28> As a Googler I find it to be the most fun and most attractive part of the job. I'm not too worried about learning specific technologies. Learning the core fundamentals of how these technologies work is however critical. But since Google is (still nowadays) pioneering a lot of that, esp. in the distributed world, that's not really a problem either.

</comment></comment></comment></comment><comment><USER29> Do young (new to google) googlers get to work on these projects?

</comment><comment><USER30> There is no mention of SPARK like in-memory compute engine(s) Did i miss it in my read ? thanks in advance

</comment><comment><USER31> Wish there was audio / text that went along with these slides :(

</comment><comment><USER32> Kind of ironic: "Wow, this file is really popular! Some tools might be unavailable until the crowd clears"

<comment><USER27> Incidentally, that's part of scalability: knowing when you can drop functionality and the user won't care. For Google Docs, it's highly unlikely that a file with 1000s of viewers is actively being _edited_ by 1000s of users, and more likely the link just got shared on the Internet. So you can drop edit functionality for everyone but the original author and they won't care.

Another example - one that I've heard second-hand - is how Facebook gets consistency on the news feed. Apparently _your own_ writes to Facebook are sent separately to a write-aside cache, and then the webserver merges them back in whenever you view a page. As a result, Facebook is always strongly- consistent when it comes to _your_ comments (you'll never post something and then fail to see it show up), but it's only eventually-consistent with respect to _other peoples '_ comments. But then, you won't know about or care about the latter, because how would you know that you're not seeing something they posted?

<comment><USER33> Same at LinkedIn. (Source: presentation by their then-CEO at JavaOne, circa 2009.)</comment></comment></comment>