WhatsApp backdoor allows snooping on encrypted messages - <AUTHOR> https://www.theguardian.com/technology/2017/jan/13/whatsapp-backdoor-allows-snooping-on-encrypted-messages <comment><USER2> Current thread on the response to this article: [https://news.ycombinator.com/item?id=13394900](https://news.ycombinator.com/item?id=13394900)

</comment><comment><USER3> Well, I kind of feel that I have to repost my comment on this old thread[1] with regards to the government of Egypt blocking Signal application:

"Isn't it "weird" that they chose to block Signal app and not the signal- protocol based Whatsapp? If Whatsapp really implements the same kind of security and privacy measures that Signal does, why is Whatsapp allowed to continue operating? If signal is preventing them spy on users and they ban it, is in't it safe to assume that Whatsapp is NOT preventing them spy on users, so they let it operate? Wouldn't you expect Whatsapp to be also targeted, especially considering the broad user-base it has compared to Signal? Yes, I know they had blocked Whatsapp in the past, but they didn't block it now. Which means that something has changed in the relationship of the Egyptian gov and Whatsapp since 2015."

1\. [https://news.ycombinator.com/item?id=13219304](https://news.ycombinator.com/item?id=13219304)

<comment><USER4> Simple explanation would be that activists use Signal. [1]

They don't trust WhatsApp and rely on Signal for secure messaging. Blocking Signal means they are able to target activists without impacting much of the rest of the population.

[1] Many of the people I know who are activists in countries where they need to protect their identities use Signal

<comment><USER5> I wouldn't trust whatsapp even before this revelation.

I would never trust a closed source messaging app if I was an activist, regardless of what encryption they claim to implement.

<comment><USER6> Good point. At least as a technical person, I would like to use an open-source messaging application.

Of course I'm not going to read the source code but at least I'm sure developers behind the app do not open a backdoor for someone else.

<comment><USER7> While I'm totally the same in this regard, this does feel a bit like an open- source version of the bystander effect.

<comment><USER8> I don't know what the bystander effect is, but I assume we're taking about the same thing: I often feel that everyone is, along with myself, thinking "great - open source! I'm sure someone's checking it."

Of course, the counter is that if you publish it you don't risk that someone actually is checking.

Open beats closed, but we must be careful not to think it immediately makes the code sound.

I've been thinking about this particularly recently in relation to Monzo, the will-be bank. There's no web app and slow progress on the android front. Lots of open source effort though, since they publish an API, but... That's my bank account I'm (not) giving open source developers access to.

<comment><USER9> _but we must be careful not to think it immediately makes the code sound_

nobody is saying it's automatically sound, but open is the only option that makes any security analysis possible.

<comment><USER8> > _open is the only option that makes any security analysis possible_

I'm not disputing that. Let me repeat myself:

> _Open beats closed_

All I'm saying is that it doesn't stop there. Too often there's this complacent 'great, it's open source!' \- I'm as guilty of it as anyone.

<comment><USER9> You're begging the question.

<comment><USER8> Pardon?

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> I remember receiving the downvote brigade[1], when Moxie himself said that I should trust WhatsApp without having the source code and the ability to put it on my device.

We (even a "smart" community like HN) clearly do not have the ability to think critically about security, and even when our leaders are sincere -- and I really don't mean to suggest Moxie/Signal was complicit in this move -- we still rush to defend our champions so quickly that we don't even think about what's going on.

However something really important is that this might be mere incompetence: FaceBook might not have any mechanism for launching this attack, they just thought the notification message was annoying so they didn't display it. To that end we need to be vigilant about stupidity as well.

Where does it end? Will we actually stop being okay with buffer overflows and sloppy programming? Or are we going to continue trying to "be safer" and use "safe languages" and continuing to try to solve the problem of too much code to read clearly with more code.

[1]: [https://news.ycombinator.com/item?id=11669395](https://news.ycombinator.com/item?id=11669395)

<comment><USER11> I'd go further and say Moxie is complicit by way of negligence. It's unethical to assist in the implementation of your protocol when you can't guarantee its privacy protections will actually stand. Otherwise it's free PR for Facebook to tout "Snowden-approved crypto".

I have no doubt Moxie acted in good faith and wanted to expand encryption to a large number of users, but this is just another example of why proprietary software cannot be trusted.

Any and all proprietary implementations of the Signal protocol are now suspect. OWS should denounce these implementations as least as firmly as they do interoperable open source Signal client forks.

<comment><USER12> On a completely unconnected note, what was the name of that technique that GCHQ uses to disrupt online forums and subtly undermine peoples reputations?

<comment><USER11> [https://theintercept.com/2014/02/24/jtrig- manipulation/](https://theintercept.com/2014/02/24/jtrig-manipulation/)

</comment></comment></comment></comment><comment><USER13> Some more background:

This was presented in the lightning talks at 33c3, starting around minute 48: [https://media.ccc.de/v/33c3-8089-lightning_talks_day_4](https://media.ccc.de/v/33c3-8089-lightning_talks_day_4)

Here's the congress wiki with some more links: [https://events.ccc.de/congress/2016/wiki/Lightning:A_Backdoo...](https://events.ccc.de/congress/2016/wiki/Lightning:A_Backdoor_\(/Bug%3F\)_in_WhatsApp)

And a blogpost: [https://tobi.rocks/2016/04/whats-app-retransmission- vulnerab...](https://tobi.rocks/2016/04/whats-app-retransmission- vulnerability/)

<comment><USER14> Thank you. The last link should be the source (a note to moderator).

<comment><USER15> It's news that Facebook still hasn't fixed it (and they're saying they won't fix it).

What do you call a known vulnerability that can be used for eavesdropping that a company refuses to fix ?

1) A mistake

2) A bug

3) A backdoor

<comment><USER16> 4) A deliberate UX trade-off that, while clearly suboptimal for the kind of people who read HN, still leaves WhatsApp's massive base of everyday users in a much better position than they were prior to integrating the Signal protocol: immune to the more mundane threats of passive mass surveillance and the exfiltration of message history from Facebook's servers.

<comment><USER17> Nicely put. Anyone that is so shocked, shocked about this is well advised to install Signal, Threema, Wire, and furthermore employ defence in depth.

</comment></comment></comment></comment></comment><comment><USER18> The key part is this, and it was apparently reported back in April 2016 with Facebook replying it's "expected behavior", it's not something a general attacker can do but it would enable WhatsApp/Facebook to read conversations:

> WhatsApp has the ability to force the generation of new encryption keys for > offline users, unbeknown to the sender and recipient of the messages, and to > make the sender re-encrypt messages with new keys and send them again for > any messages that have not been marked as delivered.

It's worth noting as the article says, that this is built _on top_ of the Signal protocol. In Signal, a similar situation with a user changing key offline will result in failure of delivery. Within WhatsApp under Settings>Account>Security there is an option to _Show Security Notifications_ which will notify you if a users key has changed.

<comment><USER19> I happened to have the Security Notifications on for a while now. I see the message: "X's security code has changed." pretty often. Under what circumstances does a new pair of encryption keys get generated?

<comment><USER20> One circumstance is when you put your sim card in a different phone. The new phone recognises that you already have a WhatsApp account, as it's tied to your phone number, but it doesn't have your private key, so it will generate a new pair and start exchanging the public part.

</comment></comment></comment><comment><USER21> Nothing to worry about according to Gizmodo:

      > The supposed "backdoor" the Guardian is describing is
      > actually a feature working as intended, and it would
      > require significant collaboration with Facebook to be
      > able to snoop on and intercept someone's encrypted
      > messages, something the company is extremely unlikely
      > to do.

[http://gizmodo.com/theres-no-security-backdoor-in- whatsapp-d...](http://gizmodo.com/theres-no-security-backdoor-in-whatsapp- despite-report-1791158247)

I, for one, certainly cannot imagine Facebook collaborating to such an extent with the government.

<comment><USER22> There's a </sarcasm> there right?

<comment><USER21> What? You must be some sort of conspiracy theorist. Just be rational and extrapolate from your beliefs: if you admit that Facebook might do this, then why not Google, AT&T, Microsoft? There would be no end to it. Basically it would mean that all businesses are spying on you and handing the information over to the government.

I have complete faith that that is untrue based upon just the history of the last 5 years.

<comment><USER23> Sarcasm usually plays out very poorly on written mediums like this, but you nailed it.

<comment><USER22> Yes, well done.

<comment><USER21> I feel bad now. I'm just highly frustrated that everyone is not actuated by the idea "if they _can_ spy on you, then they _will_".

Any appeal to morals/integrity/laws are essentially moot in this area. We have the ability to protect ourselves and we should be using it.

[https://www.eff.org/deeplinks/2017/01/obama-expands- surveill...](https://www.eff.org/deeplinks/2017/01/obama-expands-surveillance- powers-his-way-out)

<comment><USER24> "They have no reason to look" is to me equivalent to "I have nothing to hide".

Both may be true, but both willfully surrender control of the situation.

</comment></comment></comment></comment></comment></comment></comment><comment><USER25> At the risk of stating the obvious: there is real benefit to using an entirely decentralised open source comms system like Riot.im (Matrix) or Conversations (XMPP), where you can pick precisely which app to run, who to trust to build that app, who to trust to advertise your public keys, and who to host your server.

It's inevitable that big centralised services like WhatsApp or even Signal are going to be under pressure from governments to support lawful intercept; in many countries it's essentially illegal to run a communication service that can't be snooped under a court order. Multinationals like Facebook are neither going to want to break the law (as it ends up with their senior management getting arrested: [https://www.theguardian.com/technology/2016/mar/01/brazil- po...](https://www.theguardian.com/technology/2016/mar/01/brazil-police- arrest-facebook-latin-america-vice-president-diego-dzodan)) - nor pull out of those territories (given WhatsApp market penetration in Brazil is 98.5% or similar).

<comment><USER25> oh, and one other thing - there's also real value to independently published public security audits of the crypto to pick up on things like WhatsApp's retransmission 'bug', at least as of a given snapshot of the codebase. E.g. [https://www.nccgroup.trust/us/our-research/matrix-olm- crypto...](https://www.nccgroup.trust/us/our-research/matrix-olm- cryptographic-review) for Matrix or [https://conversations.im/omemo/audit.pdf](https://conversations.im/omemo/audit.pdf) for OMEMO & Conversations.

<comment><USER17> Off topic, but I like how their URL spells _nccgroup trust us_

</comment></comment></comment><comment><USER26> No matter what IM service you use: As long as they manage the public keys for their users, they will be vulnerable to exactly this problem. This isn't just WhatsApp. This applies to iMessage and Signal too.

In all cases, we rely on the word of the service provider that they don't sneak additional public keys to encrypt for into the clients and in all cases we hear that doing so would cause a message dialog to appear, but we have zero control over that as this is just an additional software functionality (yes. Signal is Open Source, but do you know whether the software you got from the App Store is the software that's on Github?)

Also imagine the confusion and warning-blindness it would cause if every time one of my friends gets a new device I'd get huge warnings telling me that public keys have changed.

This is a hard problem to solve in a user-friendly way and none of the current IM providers really solve it. Maybe Threema does it best with their multiple levels of authenticity.

As such I think it's unfair to just complain about WhatsApp here.

<comment><USER27> 'As such I think it's unfair to just complain about WhatsApp here.'

I disagree. WhatsApp have a known vulnerability which they won't fix (indeed they deliberately added this vuln on top of the Signal protocol), and no denial that they have used this vulnerability in the past.

They made a big PR song and dance about this feature only to backdoor it. That deserves criticism.

<comment><USER26> _> I disagree. WhatsApp have a known vulnerability which they won't fix (indeed they deliberately added this vuln on top of the Signal protocol)_

how would you fix it without causing notification-blindness?

<comment><USER27> There's no notification blindness. If a key was changed after a message was sent, then the sender would simply be notified and they could choose to resend using the new key. This is how Signal works.

</comment></comment></comment></comment><comment><USER28> From the outset I've always expected that a backdoor was present in Whatsapp. In fact, I'd be surprised if they hadn't granted themselves some special capabilities with regards to the content of the communications. Touting their end-to-end encryption has enticed many people to trust the product, sometimes with strong conviction, while giving themselves a monopoly on access to communication perceived as secure by the end users. It stands to reason that claims about security and privacy of an end product (the Whatsapp app), no matter how lofty the goals that its creator (especially a murky company like Facebook) has purportedly set out to realize, can be verified without being completely open. There is software out there like OpenSSL that is developed by PhD's, and is completely open and available to anyone who wishes to validate its security, yet vulnerabilities are found years after they've been introduced into the code. Claims to Whatsapp's security/privacy are preposterous a priori.

<comment><USER29> The fact that you have a PhD in cryptography doesn't necessarily mean you know how to write secure code. Especially C code. Lot of people hated OpenSSL quality long before Heartbleed, but it took that vuln for people to actually realize how bad it is. I can imagine a good, secure SSL library being written by somebody without a PhD, in a safer language.

<comment><USER30> > Especially C code

Isn't WhatsApp an Erlang app?

<comment><USER31> Whatsapp is both a server and a client. The server might be written in Erlang, but the client (where all the end-to-end encryption happens) is written in whatever the device can run.

<comment><USER32> The device runs machine code. Client code can be written in any language which can be either compiled or interpreted to machine code.

<comment><USER33> Android devices run Java, with an option for machine code for some functionality.

</comment></comment></comment></comment></comment></comment><comment><USER27> "Asked to comment specifically on whether Facebook/WhatApp had accessed users' messages and whether it had done so at the request of government agencies or other third parties, it directed the Guardian to its site that details aggregate data on government requests by country."

This is why people should try and use Signal instead of WhatsApp. You can't trust Facebook to care about your privacy.

<comment><USER34> Signal is bad as explained previously, it requires Google on your phone to even work.

If you think Google is more trustworthy than Facebook, sure go ahead and just use Hangouts or whatever.

We cant have nice good encryption and safe communication when geeks push this Signal onto unsuspecting users, when the real option is to keep improving Tox.Chat and bitmessage.

<comment><USER35> I guess it's worth mentioning that people are currently working on removing the Google services dependency in Signal: [https://github.com/WhisperSystems/Signal- Android/pull/5962](https://github.com/WhisperSystems/Signal-Android/pull/5962)

<comment><USER36> That is good to know, thank you for sharing that! I'll be following this and try Signal again when it should finally work on my phone :)

</comment></comment></comment></comment><comment><USER37> More details in "WhatsApp Retransmission Vulnerability" [1] from April last year.

[1] [https://tobi.rocks/2016/04/whats-app-retransmission- vulnerab...](https://tobi.rocks/2016/04/whats-app-retransmission- vulnerability/)

<comment><USER17> _This_ should be the top post - exactly this vulnerability was announced last year April; it's just that the Guardian picked it up now (with a somewhat clickbait-y headline, to boot).

<comment><USER37> I'm going to have to come to the Guardian's defence here. We may take issue with the term "backdoor" but, for a general readership, their headline is a good summary of the issue using appropriate language.

<comment><USER17> Doesn't backdoor imply malicious intent? (Of course you could argue that a good backdoor looks like a innocuous bug or even a feature...)

Also, if I have notification of key changes enabled and verify key fingerprints, at most one exchange could be snooped without me noticing. (If notification of key changes is not enabled and key fingerprints not verified, all bets are off anyways.)

</comment></comment></comment></comment><comment><USER38> C'mon we know this already, it's not a backdoor.

This has been known and is discussed in the protocol and forums as the trade off in ease-of-use versus validation. For people wanting security, they simply check the verify keys, warn on key change. For people who don't care as much about verifying the recipient, they don't know about the feature, and don't use it, but they still get pretty good security, can upgrade to verifying if the choose, all without having to re-key or change protocols/messenger apps.

<comment><USER39> They should also add a toggle that prevents the client from retransmission to unknown keys without human approval.

</comment></comment><comment><USER40> But if whatsapp owns the code, they don't need a backdoor. They can simply push an update that sends a copy of the msg to whatever server they may like.

<comment><USER34> Which is the case with Signal as well, and this "security" feature of "google play services" is why the developer of Sigal does not want Signal to be in f-droid.org's repositories. He wants to be able to push "updates" for any future "vulnerability" onto the users of Signal.

<comment><USER41> A big reason I dont trust signal. Every single that app has some bad side, signals is the reliance on Google.

<comment><USER42> Using Signal on iOS here - what is the reliance on Google?

<comment><USER36> Nothing since you don't have Google Cloud Messaging on iOS, but it's a different situation. IOS is not open source software like Android (AOSP) is. If you want, you can have all the software on your phone be open source (save perhaps for drivers), even though most people will opt to install at least the Google Play Store, which requires you to install the whole google suite (or at least it used to when I flashed Cyanogenmod).

So anyone wanting to have a phone with open source products on it for security reasons, they totally can on Android, but it's impossible with iPhones. Signal probably relies on Apple's variant of Google Cloud Messaging, but since you'll always have that on your phone anyway, it makes no difference.

</comment></comment></comment></comment></comment><comment><USER43> This is not a backdoor. It is a vuln, and it'd be nice if it wasn't there, but this is not a backdoor.

There is no reason to assume this was "snuck in" with an intent to deceive users. Retransmission has been known and discussed repeatedly, months ago, and Facebook acknowledged it. What happened here is a choice of UX over security, specifically, choosing not to break existing WA users as they move them over to the otherwise great Signal protocol.

When a key changes, you can just keep trying, notify the user, or drop everything on the floor. If you want the latter, use Signal.

It would be nice if WhatsApp made 2 the default, and 3 optional. Right now 1 is the default and 2 is the option. The trick is to get the UX somewhere where normal people can do something useful with that information.

If you are at all upset about this, you are not a target WhatsApp user. It'd be nice if they changed this, but for the love of all that is good and holy, stop calling it a backdoor, because it isn't. Words mean things.

</comment><comment><USER44> > The desire to protect people's private communication is one of the core > beliefs we have at WhatsApp, and for me, it's personal. I grew up in the > USSR during communist rule, and the fact that people couldn't speak freely > is one of the reasons my family moved to the United States

Jan Koum and Brian Acton, founders of Whatsapp

</comment><comment><USER45> I think it's pretty obvious that we cannot trust any messenger app that is closed source or relies on some company's service infrastructure. If it's closed source, you cannot possible know what it does. If it's relying on a company's infrastructure, it's likely to be banned by oppressive governments (and that includes most of the so called "free world"). In frustration over my own Government (Norway), I started last year a project to launch a new IM client based on the legacy TorChat protocol ([https://github.com/jgaa/darkspeak](https://github.com/jgaa/darkspeak)). It turned out to be way more work than I expected - so it's been on hold for a few months while I spend time on some more urgent projects. However, I think p2p IM software, based on open source, over Tor (or similar technologies) is the only way to preserve privacy and confidentiality in the future.

<comment><USER46> > If it's closed source, you cannot possible know what it does.

You can set up a wifi and try to MitM yourself and see what packets WhatsApp is sending/receiving. Then you can try to snoop on them and test. The fact that it is closed source doesn't mean you can't analyze it, it just means it's a black box that you have to carefully dissect.

<comment><USER45> You can get some idea by looking at where the packages are going - but in todays ipv4 space, most p2p packages have to transit trough some public IP addresses. That means that, unless you are able to decrypt the traffic, it will be difficult to know if someone is listening in on the conversation. Also, just by looking at the packages, you will not have any means to detect back-doors, unless they are accessed while you are looking. Back-doors potentially requested by intelligence agencies for snooping on high value targets are likely to go undetected.

<comment><USER47> So just look at the actual code executing. Should be fairly easy to tell if there's some huge secret function in the binary.

<comment><USER45> Well - you know, when you strip the symbols from the optimized binaries, the "huge_exploit_nsa_hook()" function kind of morphs into 0x66666666 or some other seemingly random number. Besides, I knew only one programmer who could read binary dumps of a program and instantly tell what id did. That was 30 years ago, when executables were measured in kilobytes.

<comment><USER47> Fortunately there are useful tools that'll help navigate binaries, like IDA Pro. They'll produce control flow graphs in addition to letting you annotate things. I've done this in a professional capacity a few times, though I'm not remotely an expert and barely know what I'm doing.

In Java, it's even easier due to JVM restrictions. I wrote an obfuscator for .Net, but Java offers less capabilities in it's bytecode. I even used a commercial product that had been obfuscated. The obfuscator broke something on Mono. It took about an hour to write a small script to go through the binary and fixup the broken bits so other tools would work on it.

<comment><USER46> Good call on reversing, I'd written about it in a first draft but then scratched everything and started over again. Indeed, there are some good reversing tools. Still, his call on packet analysis being incomplete (unless you happen to see an interesting event) is right. I was thinking of a more simple test to see if things are effectively encrypted, and how resistant to cryptoanalysis is the protocol.

</comment></comment></comment></comment></comment></comment></comment><comment><USER48> Has anyone heard anything from Moxie Marlinspike on this? Would be interesting to hear his perspective - Open Whisper Systems helped out with the encryption.

<comment><USER49> Well there are two possible scenarios I can envisage.

      a) The issue was an oversight and simply a bug that needs
         to be fixed. The question is why FB doesn't want it
         fixed?
      b) Moxie knew that this issue existed but was NDA'ed into
         leaving it there for nefarious purposes. Now it's public
         knowledge, where do we go from here?

<comment><USER50> This exploit is not in the original Signal protocol, and was introduced by WhatsApp. Signal discards undelivered messages when the encryption key changes, WhatsApp implemented re-transmission because they think it improves usability. It does do that, and it also introduces this security risk.

It says so right in the article. Stop spreading FUD.

<comment><USER51> Moxie endorsed Whatsapp, though. We view Moxie as a trusted actor, so either he is untrustworthy which would SUCK or he didn't know that they did this.

</comment></comment></comment></comment><comment><USER52> It doesn't matter whether you use WhatsApp, Facebook Messenger "Secret Conversations" or even Signal app (or PGP or any public key based communications system)!.

If you are not verifying key fingerprints out of band, then you are potentially vulnerable to a malicious server MITMing new sessions.

If you want secure end-to-end messaging, verify keys out of band, do not solely trust a 3rd party for key exchange!

<comment><USER53> And you have to verify the software is using those verified keys for every message you send.

</comment></comment><comment><USER54> Is anyone surprised? Facebook owns them, and Facebook has been in the back pocket of the intelligence agencies for at least half a decade.

<comment><USER55> Are there some landmark issues around this assertion? We know Yahoo backdoored email, and their head of security resigned as it happened behind his back. This doesn't mean agencies are successful at coercing every company by default.

</comment></comment><comment><USER56> Does anybody seriously still doubt that all the main US tech/communication products all have backdoors?

<comment><USER55> I think the shock here is that FB considers this a usability feature rather than a vuln. I can see both sides. If you want real security use something else. If you want privacy but not from state actors or companies, use WhatsApp.

</comment></comment><comment><USER57> The biggest security issue on WhatsApp are the backups, especially the cloud backups not the protocol and this so called "backdoor" itself. Pictures not encrypted on backups, encryption keys of backups stored on WhatsApp side which might or might not (???) have access to your cloud backups on Google Drive and iCloud. If a government (USA?) gets access to one of your or your friends backups and the encryption key it can see all of the conversation. This is for me the weakest point of WhatsApp.

<comment><USER58> I've noticed this as well, do they even encrypt the backups the upload to google drive and if so with what key? If they use one key then the advantages of perfect forward and perfect future secrecy that the double-ratchet protocol provides is lost.

<comment><USER59> Messages and media backed up to Google Drive are "not protected by WhatsApp end-to-end encryption while in Google Drive" according the app.

<comment><USER60> Hey

You replied to me about a month ago concerned about my health when I was dealing with issues with my wife: [https://news.ycombinator.com/item?id=13039203](https://news.ycombinator.com/item?id=13039203)

I couldn't reply to that as it is too old, but wanted to tell you that we talked and we ended up parting ways. While things are still in a turmoil, it seems like some kind of window opened and hope is out there again.

Just wanted to thank you for the concern showed then.

Happy new year!!

</comment></comment></comment></comment><comment><USER61> "why don't you use whatsapp now that it has built in encryption like your Signal?"

meh.

</comment><comment><USER62> I've used signal for quite a while but went back to Threema because the messages were delayed too often.

What are opinions about Matrix (matrix.org) used with the Riot client?

This combo checks all the boxes that Signal checks (including the Olm ratchet, a close relative of the Signal ratchet), and adds :

\- decentralization (run your own server)

\- no need to disclose your phone number

</comment><comment><USER63> > Boelter said: "[Some] might say that this vulnerability could only be abused > to snoop on 'single' targeted messages, not entire conversations. This is > not true if you consider that the WhatsApp server can just forward messages > without sending the 'message was received by recipient' notification (or the > double tick), which users might not notice. Using the retransmission > vulnerability, the WhatsApp server can then later get a transcript of the > whole conversation, not just a single message."

Actually it is not that easy. Signal protocol [0] does not have any inherent delivery notification, but it is implemented in the application [1]. If attacker wants to deliver messages two-way without delivering receipts, it has to recognize them somehow. Of course you can try to guess by not delivering the first message after each delivery, but it seems too unreliable for a backdoor.

[0] [https://whispersystems.org/docs/specifications/doubleratchet...](https://whispersystems.org/docs/specifications/doubleratchet/)

[1] [https://support.whispersystems.org/hc/en- us/articles/2125355...](https://support.whispersystems.org/hc/en- us/articles/212535538-How-do-I-know-if-a-message-has-been-delivered-)

</comment><comment><USER64> > in many parts of the world, people frequently change devices and Sim cards. > In these situations, we want to make sure people's messages are delivered, > not lost in transit.

That quote sounds even more alarming to me than the description of the backdoor. Because, as I read it: the unencrypted message is not stored on the device, but somewhere else. How else would they be able to still deliver a message, using a new encryption key, even after the sender switched to a new phone?

</comment><comment><USER65> > Boelter reported the backdoor vulnerability to Facebook in April 2016, but > was told that Facebook was aware of the issue, that it was "expected > behaviour" and wasn't being actively worked on. The Guardian has verified > the backdoor still exists.

This is really damning on the part of Facebook and WhatsApp! How could they just brush this off as "expected behavior" and wasn't being actively worked on? I guess their priorities are where a social media company like Facebook would have them be - make more avenues to monetize the usage.

The initial response from the WhatsApp spokesperson is just PR speak, and really terrible for a response (until the direct question came up and another statement was issued).

It's sad that Signal and Open Whisper Systems are being dragged in here, because many people may just look at the headline, probably skim the beginning of the article a little bit and assume that the OWS implementation is the culprit or that OWS is somehow complicit in this.

</comment><comment><USER66> Use Signal. Get everyone around you to use it. Seriously. Facebook is a for- profit that gets all of its money from ads (just like Google), would you seriously expect them to protect your privacy?

</comment><comment><USER67> Why do we sit here and argue about whether people should use WhatsApp or Signal? It's Facebook. How can we talk about Facebook as a serious candidate for private end to end messaging when they're one of the world's biggest data brokers? Why wouldn't you just use Signal and recommend it to everyone?

</comment><comment><USER68> I'm not a crypto guy, but I'm trying to understand how this backdoor could be used by governments or WhatsApp/Facebook itself. I'm not entirely sure how such an attack based on this backdoor would work.

The article says that WhatsApp servers have the ability to trigger the clients to generate new keys, but even with new keys how can the server read the messages at all? Has the server got a copy of the new generated keys?

Probably there is something big I'm missing.

<comment><USER69> I'm trying to understand this same thing. I don't see why triggering a client to generate new keys is a problem. Giving the client keys to use is a problem, but that's not what it's saying.

Edit: it is described much better here: [https://tobi.rocks/2016/04/whats-app- retransmission-vulnerab...](https://tobi.rocks/2016/04/whats-app- retransmission-vulnerability/)

The idea is that in addition to the keys being regenerated, the recipient phone is spoofed (a key point not mentioned). So the FBI could tell the Whatsapp company to generate a fake recipient phone and connect the sender phone to that phone instead.

<comment><USER68> Thank you, now I understand.

</comment></comment></comment><comment><USER70> I had a conversation about whatsapp capabilities recently with an assistant state AG. This person debunked the notion that whatsapp is secure from government snooping and further intoned that you don't even need a FISA court to provide a warrant to get to the target's information. Any judge can issue the warrant for a line tap and the target would never be the wiser as they are sealed in secrecy.

</comment><comment><USER71> For everyone who is (rightfully) upset about this: turn your anger into action, donate to people who are actually concerned about your privacy and who are taking action to defend it. I suggest OpenWhisperSystems:

[https://freedom.press/crowdfunding/signal/](https://freedom.press/crowdfunding/signal/)

</comment><comment><USER72> It's a typical example to CONVENIENCE.

It's convenient to re-send the message.

No one serious of privacy would ever use Facebook / WhatsApp.

So the title is a click-bait. The decision behind re-sending is based purely on convenience and cost-benefit analysis.

Actually I think they should display a notification / popup / warning whatever.

</comment><comment><USER73> Without being open-source, who can assure that there isn't always encryption with a second backdoor key ?

I can't easily even see a hash of my key, how do I know it has or hasn't changed? It's pretty easy to have a feature that only shows some of the keys changes and not all of them.

<comment><USER74> Even if it is open-source you still can't be sure unless you build the app yourself. Otherwise there's no way to know whether the source code you're reading is really the same code that's running on your phone.

</comment></comment><comment><USER75> How do I know that my Android phone doesn't have a backdoor keylogging everything that I type and uploading it to Google/NSA each night?

I haven't rooted and installed wireshark on this device, but even if I did it could just not send it whilst that is logging. Or, it could be that wireshark doesn't see everything. Or I just wouldn't notice as there are many packets going back and forth between my phone and Google.

I suppose I could install Cyanogen and not install Gapps. But then, how do you know that Cyanogen isn't compromised?

Life's too short. Facebook messenger is convenient and most of my friends use it so I go for it. I just assume that all of my communication and more seriously location data for the last few years are logged with the intelligence agencies.

<comment><USER76> "Life's too short to worry about privacy" is precisely the kind of attitude that normalizes increasingly invasive surveillance and inadvertently feeds into the desire of companies to glean as much information as they can from their users' data. Why does the convenience of Facebook messenger have to come at the cost of privacy?

I think it's an appropriate response to criticise a company for implementing what can only be generously interpreted as a bug, if not a backdoor, and dismissing concerns when it was pointed out to them, all the while making specious claims about being secure and lulling its users into a false sense of security. Public outrage is a powerful tool in ensuring that companies don't get too adventurous in spying on their users for fear of getting caught and called out on it.

At the risk of raising the spectre of authoritarianism, I think the folks who held on to their religious beliefs in countries that enforce/d a particular religion (or no religion), or secretly organised protests against communist regimes would gape in disbelief at the choices of the current generation to use always-on digital assistant devices, communication tools and social media platforms that have been shown to be linked with government surveillance programs. Sure, your government may be democratic and benevolent at present, but what would stop an authoritarian President from using troves of already collected data to purge the country of its "dissidents"? It's not a far- fetched concept - Why do the UK fire and rescue authorities need access to the browsing history of citizens [1]? It will be all too easy for a government with all kinds of data on its citizens to establish a "citizen value" score [2] and optimize access to healthcare and other services based on it. Just the possibility of such a dystopian future should be a cause for concern on our willingness to exchange privacy for convenience.

[1] - [http://www.ibtimes.co.uk/big-brother-watching-you-every- orga...](http://www.ibtimes.co.uk/big-brother-watching-you-every-organisation- allowed-snoop-your-internet-history-revealed-1593830)

[2] - [http://www.independent.co.uk/news/world/asia/china- surveilla...](http://www.independent.co.uk/news/world/asia/china-surveillance- big-data-score-censorship-a7375221.html)

</comment></comment><comment><USER77> > […] In the WhatsApp case, chat data is end-to-end encrypted, and there is > nothing the company can do to assist the FBI in reading already encrypted > messages. This case would be about forcing WhatsApp to make an engineering > change in the security of its software to create a new vulnerability -- one > that they would be forced to push onto the user's device to allow the FBI to > eavesdrop on future communications. This is a much further reach for the > FBI, but potentially a reasonable additional step if they win the Apple > case.

[1] [https://www.schneier.com/blog/archives/2016/03/possible_gove...](https://www.schneier.com/blog/archives/2016/03/possible_govern.html)

</comment><comment> rodrigo-mx In countries like Mexico, carriers do not charge your data use of fb and WhatsApp. They offer it as free social network. I am sure government is behind of such a good will to users from big companies. You get free communication in exchange from your privacy.

</comment><comment><USER78> This headline is not the article headline. It's not a small change either. There is a huge difference between:

"WhatsApp _vulnerability_ allows snooping on encrypted messages"

and

"WhatsApp _backdoor_ allows snooping on encrypted messages"

</comment><comment><USER79> Facebook 100% reads your "encrypted" WhatsApp messages. I had a conversation with someone about a very unique topic on WhatsApp, 5 minutes later I see remarketing ads on Facebook about the same topic.

</comment><comment><USER80> Well, if anyone is surprised by this... you really should'nt have been.

I still use it. Lock in effect. But I never would have trusted their encryption nearly enough to send anything sensitive.

<comment><USER36> If only sensitive stuff is encrypted, encryption becomes suspicious.

Add "you don't have something to hide, right?" to using encryption for sensitive stuff and you got a 1984 sequel where encryption is banned or must contain backdoors.

</comment></comment><comment><USER81> Some of my friends refuse to use LINE, claiming WhatsApp is totally secure and LINE is really insecure.

If my messages are going to be read I would rather they be full of stickers.

I love LINE.

</comment><comment><USER82> Look there's no defense against the company WhatsApp itself. They are managing the public key infrastructure AND the message forwarding infrastructure.

The clients are not verifying the keys independent of WhatsApp. If WhatsApp have to (pushed by governments) or want to (FB advertising enrichment) they can always MITM conversations.

The question is whether others can read the data in transit - and the answer is still no.

</comment><comment><USER83> This is why you should never trust proprietary secure messaging solutions that offer you both the client and the channel.

The future of trusted secure messaging will be open source, auditable, independent non-native clients that connect and send over third party message channels independently.

See [https://www.seecret.io](https://www.seecret.io)

</comment><comment><USER84> I feel like this shouldn't surprise me, but I had a lot more faith than was probably warranted in the guys behind WhatsApp. Part of it was I was so impressed with their backend tech, I just felt these were people like me that had similar cares and concerns that I do, including security, privacy, and performance. So when they implemented the Signal protocol, it was like a sign that I really had been right to trust them.

This is a sad day, because BILLIONS of people use WhatsApp. I wish I could get everyone to convert to Signal, but as I travel around the world WhatsApp is the most used way to communicate with people. Just today I added two additional local contacts to my WhatsApp so I could communicate here with them.

I wish I had a clearer understanding of the incentives here. Is this pure government strong-arm style coercion with NSLs, or is this intentional malfeasance on the part of executive management hoping to data mine for their own profits? Is it an innocent mistake? The technical talent was there to do this right, and they flubbed it anyway. WhatsApp implementing the Signal protocol was one of our great hopes for having legitimate worldwide secure communications in the hands of everyone in the coming decade. Now it's all lost...

:*(

<comment><USER85> "Is this pure government strong-arm style coercion with NSLs, or is this intentional malfeasance on the part of executive management hoping to data mine for their own profits?"

Facebook is a surveillance company that sells profiles and/or data to 3rd parties for money. They own WhatsApp. That gives us a probable answer. Far as general case, the Core Secrets leaks indicate they both bribe companies & the FBI "compels" those that resist to "SIGINT-enable" the systems under "FISA" authority. The Yahoo case also indicated they fine companies enough to put them out of business. So, they can fine companies or possibly jail their executives if they don't put the backdoor in. It's also always secret with likely excuses that it's classified matter of national security, part of ongoing investigations, etc.

</comment></comment><comment><USER86> I am flagging this article, as the headline and first few paragraphs are very misleading, based on my understanding from: [https://tobi.rocks/2016/04/whats- app-retransmission-vulnerab...](https://tobi.rocks/2016/04/whats-app- retransmission-vulnerability/)

They make it sound like an intentional backdoor has been introduced to WhatsApp to facilitate monitoring.

Rather, it seems like there's a weakness in the implementation, where if a message is undelivered, an attacker could trick the sender's client into sending the undelivered message to a new key they control.

That does seem like a weakness, but not an intentional backdoor as the article initially lead me to believe. I could see how someone would trade off ease of use and message delivery with security and make that call.

Yes, it could be a subtle backdoor (with limited exploitation), and yes, open source clients would be great. But real end users use WhatsApp to encrypt their private messages on a scale never before achieved, because of the usability tradeoffs they've made. I think we should bear that in mind before describing any implementation tradeoff as a 'backdoor'.

<comment><USER87> Agree, also think it's likely this is an intentional trade off: Alice sends Bob a message but Bob's phone is broken, so he gets a new one. The message is marked as not delivered. Since Bob's old keys are lost, WhatsApp needs to generate new ones. The trade off here allows in this scenario to accept new keys transparently.

Not ideal from a security perspective but what would be the alternative? Bob meeting Alice so they can compare fingerprints? Bob sending Alice a PGP signed message?

<comment><USER88> >what would be the alternative

Alice getting a warning about key mismatch and a prompt for redelivery (or not) of the pending message. Bob-with-new-phone does not get to read Alice's messages to Bob without Alice at least having the ability to verify that Bob indeed changed phones. Yes, 99% of users will click "redeliver" without checking, but the ones for whom secrecy matters won't.

I think this is how Signal does it, and it is the only security conscious way to do it.

<comment><USER87> Yes, I personally prefer that too. But I understand if facebook decided this is too much to ask for their users.

</comment></comment></comment></comment><comment><USER89> > The recipient is not made aware of this change in encryption, while the > sender is only notified if they have opted-in to encryption warnings in > settings, and only after the messages have been re-sent.

Surely this is backwards. It's the _recipient_ who is notified about key changes when the relevant setting is enabled.

</comment><comment><USER90> The complaint here seems similar to complaining ssl is insecure because the certificate authorities can create certificates at will.

Whatsapp can't do this without leaving traces and if they did this on a larger scale without only doing it with people that don't care to look for the signs, someone is bound to find out.

</comment><comment><USER91> Who would have guessed..

</comment><comment><USER92> I think it is worth changing the behavior of the client to fix this. At time of sending the recipient's key is known -- there should be no circumstances where the message is re-encrypted for a different recipient without the sender's explicit involvement...

</comment><comment><USER21> Seeing as we're on the topic of encrypted comms, anyone have an analysis/critique of SpiderOak's "Semaphor"?

[https://spideroak.com/solutions/semaphor](https://spideroak.com/solutions/semaphor)

</comment><comment><USER15> Does the safety numbers verification do anything against this, or can they bypass that as well?

</comment><comment><USER93> So this was on the front page with 1302 points at time of writing, and now it's nowhere to be found...

Is there a quirk with HN's algorithm that I'm not aware of, or is there something else afoot? A mass-flagging? A manual take-down of sorts?

</comment><comment><USER94> Doesn't this mean that only subsequent messages can be decrypted? i.e. Whatsapp has provided forward secrecy (as long as they haven't been using this trick from the initial secrets that were set up)?

<comment><USER95> Pretty sure that is the case. the key is changed while you're offline making any unsent messages use the new key that they know.

But if they can change the key while you're offline that means they can change the key and know everything from that point on.

<comment><USER17> Though you would get the key-change-notification (if you had enabled it, overriding the default), and could then verify fingerprints via some other channel.

</comment></comment></comment><comment><USER96> The moral of the story is, don't exchange messages electronically if you are expecting privacy.

The only real private way of exchanging information is face-to-face in a private place.

</comment><comment><USER97> How does one protect oneself for this?

</comment><comment><USER98> Wait... you mean key management is hard to get right with a large and distributed userbase? Who knew?

</comment><comment><USER95> Doesn't this mean that only unsent messages are vulnerable, as they are sent with the new key?

</comment><comment><USER99> Yeah, really pretty much confirms what everyone already believed.

</comment><comment> torrent-of-ions I can't believe that so many apparently security conscious people accepted WhatsApp as being OK. For years we've known and been told that any security software must have publicly available algorithms and source code. And then all of a sudden WhatsApp was lauded for protecting users' privacy when it is itself proprietary, closed-source program, owned by a company notorious for not not respecting user privacy.

</comment><comment><USER100> I find this hardly surprising. Somehow the USA government is very, very good at convincing companies to spy on their users.

<comment><USER55> Many governments are good at spying on their citizens, but are you implying the USG forced/compelled/convinced WhatsApp to intentionally weaken their security?

</comment></comment><comment><USER101> Are there are recommendations for video chat / conference calling yet? Googling around leads one to believe that WhatsApp's is the most security- minded video calling available that's widely available...

</comment><comment><USER102> If You're Not Paying for It; You're the Product;

</comment><comment><USER103> I am not a security expert, but for me Moxie lost his credibility, even though he maybe one of the best crypto experts out there</comment>


Xmake v2.3.3 released, Support for building iOS/macOS Framework and App - <AUTHOR> https://tboox.org/2020/04/27/xmake-update-v2.3.3/ <comment><USER2> We developed a really neat resigning of PKG installers on Linux, only to learn that the binaries to notarize macOS installers and apps (altool, see [https://developer.apple.com/documentation/xcode/notarizing_m...](https://developer.apple.com/documentation/xcode/notarizing_macos_software_before_distribution/customizing_the_notarization_workflow?language=objc)) ONLY run on macOS.

This looks to be the level we reached using a variety of tools, and could simplify the workflow, but doesn't answer the notarization step (arguably only because of Apple's limitations). We basically built a valid, signed installer, unxar'd it, did slug replacements for values for each instance, compiled some postInstall scripts, packed and resigned it using the Application ID certificate.

Anyone know of any projects that hope to bring the notarization step across platforms?</comment>


Tesla Electric Airplane? Elon Musk sees electric aircraft in 5 years - <AUTHOR> https://electrek.co/2019/07/01/tesla-electric-airplane-elon-musk/ <comment><USER2> Umm... the cars can barely go 370 miles. While that is better than a lot of old cars, the old cars had a 5 minute "charge" time which beats the pants off of tesla's charge time.</comment>


Show HN: CrossClip – Sync Clipboard across macOS/Linux/Windows on LAN - <AUTHOR> https://github.com/yue/crossclip <comment><USER2> Fascinating! I wished I could do this years ago.

Funny thing is I once had a dream exactly like this where I copied on one computer and pasted on a different computer. And now it's real. Wow.

I might actually use this. Well maybe. The truth is I don't use multiple workstations as often as I used to since remote access is so much easier now than it was.</comment>


Tesla Posts Surprise Profit - <AUTHOR> http://www.cnbc.com/id/100946535

<comment><USER2> Tesla is building the infrastructure for a supercharger network. If Tesla has any common sense at all, eventually all electric cars, not just Tesla's, will depend on this network. To me, this makes TSLA an obvious buy. Who cares if Tesla sells any of its own cars? It will control the national, and likely global, infrastructure for all electric cars in the future. That is worth a lot of money.

I'm young. I have $4,000 in my IRA account. Based on my earning potential, in 15 years $4,000 will mean relatively nothing to me. So it's in my best interest to invest in high-risk, high-reward stocks with my current funds. I am going to invest 100% of this $4,000 in TSLA. I'm in this for the long play, and I believe in the company.

<comment><USER3> Yes, when you're younger you (general you) typically are less risk-averse, so you can invest in these high risk high reward stocks.

That being said, whether it's TSLA or AAPL or some other "sure thing," exposing yourself to such a large amount of unsystematic risk isn't really wise. What if Elon Musk dies tomorrow? What if a plant catches on fire? Then your $4,000 could be decimated. Yes $4,000 will not mean much to you in 15 years, but compound interest average returns for 15 years hopefully should.

I love TSLA and I have money invested, but I don't think it's wise to be 100% in anything, no matter what it is.

<comment><USER2> $4,000 compounded at 5% interest in 15 years is $8,315. (Ignoring further additions to the IRA, since those are irrelevant to current decisions). $8,315 will be about as meaningless to me in 15 years as $4,000.

</comment></comment></comment><comment><USER4> I'm curious why the expectation was a loss of 17 cents. TSLA made a profit last quarter, what changed to not expect some of the same this quarter? As most (if not all) of the pre-orders are filled, perhaps there was worry that folks wouldn't buy them off the "showroom" floor?

Oh, well, I obviously thought differently as I bought call options yesterday, as well as held on to the shares we already have. And I'm glad I did. :-)

<comment><USER3> Well, profit was not expected last quarter either, and analysts are generally pretty slow to act. Also there may be various cyclical or one-time charges involved; a negative income isn't necessarily a sign of being down on a stock. Especially comparing this quarter to last year's same.</comment></comment>


The Evolution of the World Cup Ball - <AUTHOR> http://www.nytimes.com/interactive/2010/06/06/magazine/20100606-world-cup-balls.html?ref=soccer

<comment><USER2> The 2006 ball was the best one. Loads of long range goals scored in that tournament. This one looks to be another flyaway like the 2002 ball - so far every single free kick has whizzed way over the bar. Still, the 2002 ball was so bad you could visibly see it change trajectory and life upwards mid-flight when it was kicked hard enough, as if it had been deflected.

<comment><USER3> German engineering for the win.

</comment></comment><comment><USER4> From the matches I've seen so far, the latest ball seems very light. For long range passes the player has to be behind the ball to trap it with foot or control it with chest before it drops on the ground.

Players who try to control the ball after it's bounced are being deceived by the bounce as the ball seems to move off the pitch like it's very wet (but it doesn't look that wet on the TV). Passes over the head of the forwards (for the forward to run onto) are going straight to the keeper or out unless the forward is very quick.

</comment><comment><USER5> Why do they have to introduce a new ball for the world cup anyway? Surely it reduces the quality of the play to have a ball that nobody is familiar with. Not the best advertisement for the game for the casual viewer to see people making mistakes all the time.

<comment><USER3> I guess they want to sell the new World Cup ball to all the fans.

</comment></comment><comment><USER6> I remember as a kid loving the look of the tango ball and trying to draw it using a compass and an eraser. I was really pleased with myself when I managed it finally

</comment><comment><USER7> Love the '70 and '74 ball, also the evolution from '66 to '70 seems huge.

<comment><USER8> The '70 ball was designed to be visible on TV and somehow ended up becoming the archetypical soccer ball. That is, I think, a pretty cool story. The soccer ball I grew up with, the one I drew whenever I wanted to draw a soccer ball (always looked ridiculous because drawing icosahedrons is hard if you don't know what you are doing) as a child is actually just forty years old!

But I don't think that difference is actually that big. Sure, there is the color and it's a icosahedron, but just look at a volleyball. They still look like the '66 ball looked. So this change of shape didn't have to happen. (Recent design also abandoned the icosahedron – it's quickly becoming a thing of the past.)

<comment><USER9> I was actually surprised by the 1970 ball. I grew up thinking that the 1970 design was the design that's _always_ been there.

So how did this design become the synonym for "soccer/football" while the others have not?

<comment><USER8> The first soccer ball that wasn't boring and actually recognizable as a soccer ball? Many more people than before were able to see the Worldcup in the 1970s (because many more had TVs)? It was the first sponsored ball and Adidas put a lot of money in Marketing?

I don't know but those seem like plausible explanations.

<comment><USER9> The first sponsored ball angle makes a lot of sense.

</comment></comment></comment></comment></comment><comment><USER10> Is there a non-flash version?

Sent from my iPad. ;)

<comment><USER8> NYTimes.com always has nice Flash infographics. When they started the use of Flash was probably justified, today nearly everything they do would be possible with HTML, CSS and Javascript. This infographic included.

But, I guess, it's also a question of process. Doing this in Flash is probably a whole lot of easier and they already know how it is done. HTML5 needs a development kit.</comment></comment>


Europe's Plan to Simulate the Entire Planet  - <AUTHOR> http://www.technologyreview.com/blog/arxiv/25126/?a=f

<comment><AUTHOR> If nothing else, this proposal to simulate humanity on planet Earth is ambitious. The original paper is here:

<http://arxiv.org/abs/1004.4969></comment>


Show HN: Debugging Babel and Node done right - <AUTHOR> Requirement: - Excellent feedback during development - Debugging with source maps
Method:
I'm using these scripts in package.json.

  "scripts": {
    "di": "node-inspector -d=7000 -p=8000 --save-live-edit --hidden node_modules/",
    "ds1": "babel ./server -d ./build/server -s -w",
    "ds2": "nodemon --watch ./build/server --delay 100ms --debug=7000 ./build/server/main.js"
  },
 Then run "npm run ds1; npm run ds2; npm run di"
Why:
I took some time to put this together, after navigating all the tools out there. I personally find this to be "correct". Thought I'd share.
Did not use: babel-watch, babel-node, forever, etc. I found configurations with those tools to not meet the requirements. <comment><USER2> A little off topic but I'm curios if most devs use debugging tools? My main debugging tool has been printf and it's stdlib equivalents on other languages for 20 years of coding. I used to do some C# dev and used VS debugger, I feel like it is less efficient than print statements / assertions.

Am I missing out a lot?

<comment><USER3> I wonder if that's an age thing, I'm 36, I've been programming since I was 7 and seriously since I was 14 (I say seriously since that's when I started doing stuff people would pay for) and I rarely use a debugger.

These days I mostly program in PHP (it's where the money is locally and I actually don't mind the language, it's come along well) and use the _excellent_ FirePHP (it allows you to put fp_log($foo) (fp_log is a wrapper around it I wrote for terseness - it also checks local context so that I don't leak debug stuff out into the wild accidentally) and $foo is then passed to the browser via headers (you need a browser extension to make it work but it integrates into the console) that does for 99% of the debugging I need to do, the 1% is when I fire up XDebug, I like XDebug but I've found over the years that printf debugging solves the vast amount of problems since they nearly always trace back to a faulty assuming about what $foo contains at a given point and it's (at least in interpreted languages) way quicker to just whap a print(foo) etc in there and see.

</comment></comment><comment><USER4> This "just works" IME: [https://github.com/CrabDude/babel-node- debug](https://github.com/CrabDude/babel-node-debug)

<comment><AUTHOR> I used that for a while, and it worked for me too, but found that it took a long while to reload the app, and also some time for node-inspector to bring up all the files.

There's babel-watch ([https://github.com/kmagiera/babel- watch](https://github.com/kmagiera/babel-watch)) that attempts to solve some of that, but I found that support for flags (debug) was limiting.

In the end, I figured why not just put together the fundamental tools. I use tmux and it's really not a problem to run multiple commands. Reloads are very rapid, and I never have to worry about things like flags or any other configuration being passed to the underlying tools, even as the ecosystem continues to evolve.

<comment><USER4> How often are you reaching for the debugger?

Most of the time I'm just writing tests / code, so spinning up babel-node- debug on the occasions when I'm stumped isn't a major problem.

<comment><AUTHOR> I concede your point.

I suppose the nice thing here is that we both now have two ways of doing the same thing.

I've explained why I prefer running the underlying tooling; hopefully it will be useful as one of those snippets of internet knowledge.

Independent of debugging, I would contend that this set up is better than running babel-node with something like nodemon, again, because of much better reload times.

Again, thanks for babel-node-debug, I've used it before, and I won't be too surprised if I find myself reaching for it again in the future.</comment></comment></comment></comment>


Day's till Demo Day - <AUTHOR> http://daystilldemoday.com

<comment><AUTHOR> No pressure. Also, I feel like it should start counting down the hours now.. Good luck everyone!</comment>


Ship it, already - <AUTHOR> https://medium.com/p/fb3ada43f760

<comment><USER2> I really need to ship this sucker, but I'm still feeling a lot of resistance.

I know, I'll write a blog article! That's a useful piece of procrastination...

<comment><AUTHOR> Hahaha!

You totally got me, officemonkey :-)!

Going back to it _now_.</comment></comment>


Introduction to Linux - <AUTHOR> https://www.edx.org/course/linuxfoundationx/linuxfoundationx-lfs101x-introduction-1621

<comment><USER2> Thanks for the link.</comment>


Defining a Distinguished Engineer - <AUTHOR> https://blog.jessfraz.com/post/defining-a-distinguished-enginner/ <comment><USER2> You can exhibit leadership and all those things at a much lower job tile.

On a semi-related note: I really dislike job titles. They make people think in labels. The most powerful feature of a team of creators is their idiosyncrasies. The best way I found to build something as a team is to adapt the work to the strengths of the individuals. Job titles squash the peculiar strengths and differences into a label and make organizations treat people as fungible units of work. Too many organizations define the work first and then assign it to the individuals, rather than define the work _based_ on the individuals.

<comment><USER3> It seems to me these days that job titles are more an indicator of time-served rather than technical abilities in many organisations in addition to a method of retaining staff.

I recently observed a company move from 'everyone is the same title' to specific jnr, snr, distinguished engineer titles. The primary reasons for this was to create a framework for salaries and provide a defined track for 'progressing' as the organisation got bigger.

But if you think about it - it really comes down to a method of retaining staff and salary banding, I have yet to see any organisations where the titles of engineers defines their abilities, all engineers have the same say.

<comment><USER4> I work at a very large company with decades of complex systems. I find titles useful because they let me quickly identify experts on other teams who are good at communicating.

If I have a problem integrating with their service, I will get more useful answers from that team's "senior" or "principal" engineers than from an "engineer I" who just joined the company a year ago.

Higher titles are not given out lightly here, so they still have some usefulness. I have yet to meet a senior who is anything less than highly competent.

<comment><USER5> >I have yet to meet a senior who is anything less than highly competent.

Where is this mythical land? Are you hiring?

<comment><USER6> Sounds like Microsoft's naming scheme. I also found seniors there to be highly competent - but it does vary by org.

</comment></comment></comment></comment></comment><comment><USER7> Overall great, but I've always disliked this:

> Have strong opinions loosely held

It comes out of the very true reality of needing to pick a direction and lean in hard. For example, Postgres vs MySQL. Almost anywhere either would do, but you can't split the baby. Pick one or the other and carry on.

The part that breaks down for me is when people start talking about having strong opinions. Why on earth would I have a strong opinion that I hold weakly?

I'm just honest with people. We went with Postgres because we had to choose one or the other, but both would have worked.

The things I have strong opinions on are the very things that are _not_ weakly held. "One shouldn't use Ruby for feature extraction on video at scale." It would take a _lot_ to convince me otherwise, hence the strong opinion.

I find some people have trouble thinking in non-discrete ways. For example, I know this smart guy but he's just irrationally pissed off at five star rating systems and he only ever gives 1 star or 5 stars. He considers it a usability failure because he'd rather do a thumbs up or thumbs down. I discovered this only after complaining that the five star system was _not continuous enough_ for me. I wanted to give something 4.8 stars because it was great, but had some slight flaws.

<comment><USER8> You make a good point, but I don't think loose = weak here. Loosely held, to me, indicates that you are willing to consider other options when presented rather than ignoring what's out there. So have a strong opinion, but be ready to listen when other options are presented. This, in my mind, does not equate to _weakness_ of opinion, just ensuring you are actually _hearing_ things.

<comment><USER9> It's just more nuanced than the phrase acknowledges.

I have a strong opinion that Go allows developers and teams to be much more productive than Java. But i'm not going to to complain if someone above me in an organization makes the call for Java. Does that make the opinion weakly held? I don't think so. If I was calling the shots there's no way i'd pick Java over Go.

<comment><USER8> This interpretation also makes total sense and was different than I was considering - nice! Continue to have the opinion but don't let it stop you from being productive when presented with circumstances that don't match with those opinions.

</comment></comment></comment></comment><comment><USER10> I'm really curious about this item

>Community Good technical leaders are also leaders in the outside communities.

Well, why would they be ? I mean, they can be, but I fail to see it as a requirement.

I'm a bit concerned that nowadays the dev culture is that you should be working ten hours a day, and also go to meetups/brown bags lunchs/user groups/whatever another 3 hours to show off how passionate you are.

Any opinions aroud that ?

<comment><USER11> I feel like the author's prose right underneath that heading explains it really well:

      If you silo yourself to only learning within your company, you are missing out on a world of experiences and expertise different than yours from the external community. Technical leaders realize this and place importance on learning from the larger world of computing than just their solo.

New ideas get introduced to orgs in many ways. In my experience, it's primarily through hiring new people, but making it an expectation of distinguished eng is clever, because you can also expect them to practice and apply discernment.

<comment><USER10> Yeah, but that has nothing to do with being specifically a leader in external community.

It has to do with having an interest in external community, but I would argue that you're probably learning more if you're in fact not a leader !

</comment></comment></comment><comment><USER12> I'm not huge of Bryan Cantrill's often provocative tone and advice. The author links to a talk by him where Bryan deliberately misdirects the audience so he can introduce a false dichotomy about whether Software Engineering Middle Management is a _toxin_ or a _cancer_. While fun if you're the kind of engineer that sneers at management I would hardly consider it a guiding post for becoming a leader.

Being a leader is hard. Being a good technical leader is harder. Programmers are like cats and their opinions are more important and refined than anyone else's. And I don't think it's sustainable to work in an environment where your every mistake or bad day will make you seem like a dipshit to your team. It can be demotivating to work under someone who has a toxic attitude problem, for sure, but it's also hard to be perfect all the time.

One thing I would add to the _Humility and Empathy_ section is that you don't have to be all these things all the time. It's okay to have a low-energy week where you don't feel up to mentoring junior developers. It's normal to get frustrated when you review code that consistently exhibits the same patterns and bad habits you've been coaching your team out of for months. Part of building humility and empathy is creating a team where it's fine to be vulnerable: the team knows you're having an off week, that your energy is low, and they trust you that you're going to recover and bounce back from it.

<comment><USER13> Why exactly are programmers' opinions more important and refined than anyone elses?

<comment><USER14> Not OP either, but I think what OP means here is that programmers feel that their own opinions are more important and refined than anyone else's, even other programmers. This means that they are likely to judge someone who operates in a way that differs from their opinion more harshly.

<comment><USER12> A bit of that too.

</comment></comment></comment></comment><comment><USER15> While the blog post is well-intentioned in its message, I can't imagine why it resonates much with the author because their professional history seems to indicate that they've never been at a job for more than a year. This isn't an ad-hominem and I'm not trying to say you need to be a faithful old fart at a company for decades to reach the rank of a technical fellow; but there's something to be said for barely being around to learning the problem space let alone having a deep impact. Seems to me a high ranking technical leader should have the experience of influencing, aligning and leading large teams on complex cross-vertical projects. Some of these things take months to design with key stakeholders, launch and finally "land". And that doesn't include the phase where you learn from said projects.

</comment><comment><USER16> I'm not sure what a 'Distinguished Engineer' is, but in the places I've worked with 'Principal Engineers' (above the other 5 ranks or so) I've noticed that their main job is to go to meetings, be on standards committees, go to conferences, and give the folks who've been at the company a long time but don't want to work on a product team something to do.

<comment><USER17> I think that's because you don't understand what a PE is doing (or you work in a very broken org). As an example:

Imagine you're the driver of a car. You're an expert at driving that kind of car. Someone gets in the back and says, "Please go to 123 Main St.". Another person gets in next to you to tell you how to get there, they are your navigator.

You are the software engineer. You understand the mechanics of actually making the car go. The person next to you is your manager, and the person in the back is the PE.

So what has the PE and your manager done here? Well, what you didn't see is that your manager went to a bunch of meetings before getting in the car to find out that 1st avenue is blocked up and will help you avoid it by navigating you around it. And the PE? The PE had 12 meetings before getting in the car with both internal and external leaders to figure out where the car will go.

Without the PE, you would just be driving wherever you want, and maybe you'd get to a useful place and maybe you wouldn't, but with the PE there, you'll go directly to a useful place. And if you ask them why 123 Main St is the most useful place, they would probably be happy to tell you.

To you it may look like the PE is just sitting in the back, but that's because you don't see all the work they did before they sat in the car, and you haven't asked (or they're bad communicators and haven't told you).

<comment><USER18> I'm not sure I like this metaphor, but here's a version of how it can fail (perhaps only in a dysfunctional org).

PE: _Sits down_ "We're driving to 123 Main St."

Manager: _Sits down_ "We want to be there within 9 months. We'll first try and get to a similar street, 456 Blue St., within 3 months."

SE: "Uh, this is a Wendy's, not a car."

When people spend all their time in meetings and not enough time in the product (or the product's technical architecture) they're going to lose track of what has actually been built and what its capabilities are. Similarly even with seemingly infinite meetings to address all sorts of interesting issues from stakeholders, roadmap destinations can only be so accurate for each distance in the future. I'm not even digging on the manager for having an intermediary destination; experience tells there's a reason to go to 456 Blue St. first (agile philosophies might help with even tighter midway reevaluation points) because maybe once we're there, we'll learn something and decide we wanted 125 Main St. instead of 123. No meeting can tell us that ahead of time.

</comment></comment></comment><comment><USER19> > A technical leader should be able to have strong opinions loosely held on > designs and architecture. They do not need to have opinions on everything, > that would be pedantic.

Pedantry has nothing to do with having opinions on everything, but has more to do with an obsession on minutia :)</pedantry>

</comment><comment><USER20> Does this article mean an engineer at the same comp level as a director or something else?

When pondering the expectations of an engineer at your organization, consider the expectations of a manager at the same level and how many engineers vs managers there are at that level in your company.

At large tech companies like Amazon (and possibly Microsoft), you'll find that managers reach higher levels significantly faster and in higher numbers, maybe because of unbalanced expectations of engineers at the same levels compared with other roles.

<comment><USER21> In my wing of a household name financial company, there are 7 directors and 1 engineer at that tier. And the 1 engineer is a lifer, so anyone would have to leave if they want that position within the next 10-15 years.

<comment><USER20> Thank you for sharing. We need more information like this to be made public before engineers make more informed decisions about where to work and companies feel some pressure to value engineers as much as they do managers.

</comment></comment></comment><comment><USER22> The call out about being "Customer focused" is key! Many engineers use the Individual Contributor path as a means to just solve engineering problems and an exit route from product teams. No matter if your customers are internal (other engineers) or external (actual clients), understanding the business is equally important.

An Engineer's goal is to solve problems. Technology is their tool to do so and the more you understand the business' problems, the more effective you become at using the right tools in the right ways.

A Distinguished/Principal Engineer's role is a multiplicative technical leader whose use of these tools in an effective manner will impact solving customer problems in a more effective and streamlined manner. Thus, building customer empathy is very important.

</comment><comment><USER23> I wonder how this posts overlays with Jess' experience at GitHub. She only worked there for a couple of months and I've heard from insiders that there was a lot of tension. It would be great to hear her side of the story and see if this post was partially a comment on GH's culture or her own growth after the experience.

</comment><comment><USER24> I realize there is a need to stratify engineers based on performance in order compensate accordingly each year during raise time, but having been in the tech ranking system for ~30 years, it turns my stomach. About 40% of the time the people promoted are really not that good, they just waited long enough or knew the right people (or were in the right division that needed to boost its clout so it promoted everyone arbitrarily). This whole "special name" business is so very misleading. You want the title of famous engineer? open source your work, let us see what you made. The masses will decide.

(And before you say "sour grapes", at my last job i rejected promotion to principal because I like my work/life balance, but eventually dropped in ranking because I refused to work 60+ hours a week in my 50's.)

</comment><comment><USER25> All these things are important, but this misses the important distinction - the higher up the leadership chain is about the scale you operate at, whether you affect one team of developers, a couple of teams, a director level organization, executive level organization, or the whole company.

<comment><USER26> Ah so influence :)

<comment><USER26> Hard to define, do you have ideas :)

<comment><USER27> The most succinct thing I've come up with is: "You're an influential engineer if an engineer magically becomes better just by sitting next to you."

</comment></comment></comment></comment><comment><USER28> This is a solid template for personal growth as an engineer. Should be handed to every engineer as they start to climb the senior engineering ranks.

</comment><comment><USER29> So - soft skills, experience, great attitude and drive. Do we really need a title for that?

<comment><USER26> it's sad it needs to be defined, I agree, but apparently it does :)

</comment></comment><comment><USER30> "A technical leader should also make time for growing and mentoring others."

I like this. From reading The Idea Factory, I learned that at Bell Labs it was compulsory for even the most established scientists (e.g. Shockley and Shannon) to mentor newer recruits from time to time. Mentorship is one of the highest leverage activities one can possibly do. Even if you're a high muckety-muck, you're mission is still well-served by teaching others part of the time.

</comment><comment><USER31> To the enumeration add "Insulates engineering team from unwarranted managerial meddling". The protective function is really critical.

<comment><USER32> That is a very important job, but that typically falls more on the shoulders of an SDE manager, not a distinguished engineer.

<comment><USER33> In my experience, sometime's SDE Manager == Distinguished Engineer.

That said - the few DE's I've gotten to work that I most appreciated were particularly invasive when dealing with management. That is, they would weigh in and use their influence to ensure the team wasn't pulled in too many directions. Sometimes this occurred even when they weren't explicitly asked.

Your most experienced engineers can be a good reminder for management that they're asking too much whether it's breadth or depth.

<comment><USER34> SDE Manager == Distinguished Engineer

I always felt whole point of a Distinguished Engineer is to not have to deal with the overhead of managing a team and instead focus on technical direction. Recognizing however that requires a certain organizational scale to be able to pull apart those roles

</comment></comment></comment></comment><comment><USER35> Most all of these are expected of principle if not senior engineers across the board. I think the point of a distinguished engineer is more about accomplishments and value generated for a company or industry and less about exhibiting all these qualities. But I understand the frustration.

</comment><comment> W-Stool My definition of a "Distinguised Engineer" is Dave Cutler.

</comment><comment><USER36> Or more concisely: Someone who has learned enough to positively engineer the engineering process.</comment>


North Korea declares 'state of war' - <AUTHOR> http://on.rt.com/iu25xh

<comment><USER2> I'm seeing a lot of tweets about this from people who are just tuning in for the first time. This is par for the course for North Korea; they have been doing it for literally decades. Nothing to see here. A good analysis of likely outcomes in here:

[http://www.guardian.co.uk/world/2013/mar/29/north-korea- atta...](http://www.guardian.co.uk/world/2013/mar/29/north-korea-attack-us- what-happens-next)

<comment><USER3> Indeed. North Korea is playing its cards right, considering how limited its hand is. With the new UN sanctions, they are basically trying to build up such a threat, that the others will eventually budge and lessen the sanctions.

And it makes sense for them to try, because it has worked every time in the past. Effectively, their aggressive behaviour is purely a bargaining position. Although, as the US Defence Secretary correctly stated, 'you only have to be wrong once'. And that is exactly the mentality North Korea is counting on we are feeling.

The most likely break out of war in Korea would be if South Korea either wanted it or provoked North Korea deliberately. Because even North Korea knows it cannot win against South Korean and the US.

</comment></comment><comment><USER4> <http://ycombinator.com/newsguidelines.html>

> _Off-Topic: Most stories about politics ... If they'd cover it on TV news, > it's probably off-topic._

</comment><comment><USER5> Isn't a ceasefire still a state of war? Meaning that they're just stating the obvious, since they've been in a state of war for half a century?

Less seriously... "oooh ooh ooh! I declare war on scala! Long live haskell!"

</comment><comment><USER6> The only response I could come up with: "stupid is as stupid does."

</comment><comment><USER7> ...and?

</comment><comment><USER8> They gone full retard.</comment>


Edsger Dijkstra - How do we tell truths that might hurt? - <AUTHOR> http://www.cs.virginia.edu/~evans/cs655/readings/ewd498.html?1 <comment><USER2> On anthropomorphic terminology, I always found his thoughts[1] on that fascinating. While I'm not completely convinced it's a flaw in every case, I find this kind of thinking almost impossible to avoid without lots of effort, which is probably a condition of being human (and learning BASIC first) :-)

[1] [http://www.cs.utexas.edu/users/EWD/transcriptions/EWD09xx/EW...](http://www.cs.utexas.edu/users/EWD/transcriptions/EWD09xx/EWD936.html)

</comment><comment><USER3> A Classic: <http://news.ycombinator.com/item?id=826080>

I'm sure I've also seen it more recently - I'll check ...

(30 minutes later) found it: <http://news.ycombinator.com/item?id=2279260>

Many, many comments there.</comment>


Bought my first mechanical keyboard - <AUTHOR> https://youtu.be/Fv0A3qCzxZ0 <comment><USER2> I recently bought Zebronics for $40 and its worth the investment. Has improved accuracy and productivity.

<comment><AUTHOR> Sounds awesome.</comment></comment>


IPhone App Store Developers Aren't Getting Rich - <AUTHOR> http://www.newsweek.com/id/216788/page/1 <comment><USER3> I'm at StackOverflow DevDays in Boston, and Dan Pilone gave a great presentation on the iPhone environment. The iPhone isn't really a gold rush, but there is money to be paid. Figures show that the top grossing apps were $50, even though $.99 sell more. The fact is, you're not going to be able to make a $.99 app and expect to make it rich. If you put in hard work, you can get paid. If Pilone's presentation was online, I would link to it.

<comment><USER4> I'm really happy to hear you enjoyed the talk. To be clear, it's the top grossing app in Sept 09 that was $50. My information for that statistic comes from the Sept. Distimo report available here: <http://distimo.createsend4.com/t/r/l/hllhtd/yuldzkhi/r>

<comment><USER5> Thanks for the clarification. There is a big difference between saying that one $50 app did well and saying that "Figures show that the top grossing apps were $50"

As itunes stats show (today), in the top 100 grossing apps list, only three apps are $50 or higher

</comment></comment></comment><comment><USER6> I am just surprised by the number of articles written with the exact same tone. Its like saying, I opened the first coffee shop in XYZ place and made a heck of money than 10 more coffee shops opened and most of us are barely making enough money to sustain ourselves. Yes, if you come up with an insanely good idea which is new and cannot be replicated easily for example: what smule is doing, no matter what, you will do extremely good. The probability of being a lucky 1 hit wonder is diminishing because of big brands now in the foray with a total of 85k+ apps on appstore. Now only the best of the best will survive who are in it for the long haul and have the patience, persistence and vision to stay there and develop a business and not looking to hit a jackpot kind of a mindset.

<comment><USER7> I think there's something that's different about the App Store, which is basically the same as on the Internet: the barrier to entry is very low.

In something like the Console gaming business, there is a huge barrier to entry. Making a copycat game happens, but they are few and far between. It takes a lot of time and money to create a game. Since it does take such an investment, everything is generally thought out much more and markets are analyzed carefully before moving in.

On the iPhone, the barrier to entry is much lower, allowing copycats to crop up very quickly and flooding the market and driving down prices. With a coffee shop there is at least a significant barrier to entry, while it isn't as much so with the App Store.

The same thing has happened on the Internet. It is very hard to make a for-pay site because there are so many others which are willing to offer similar services cheaper. This has lead to most sites on the Internet being free or mostly free. For example, look at on-line newspapers. Many of them aren't able to turn much of a profit on-line because they have to compete with many many other sources of news that are free.

You could argue that the more expensive items are better and so will attract users, but I think the Internet has taught us that a lot of people will settle for a lot less as long as it is cheaper.

</comment></comment><comment><USER8> It's a gold rush. The first prospectors do pretty well. The later ones starve. It's the people selling auxilliary stuff to the prospectors that make a killing.

<comment><USER9> Except selling auxilliary stuff to the prospectors is also a gold rush...

<comment><USER10> I wonder if anyone's done any old-west historical fiction with a mild- mannered, quiet, but well respected general store owner who is actually a scheming Machiavellian underneath?

</comment></comment></comment><comment><USER11> The longer the iFart apps remain the top selling apps and hard-working apps get rejected the less interested I am in developing for iPhone.

<comment><USER12> The common iFart example isn't a reflection of the store, it's a reflection of culture.

In 2007, "Pirates of the Caribbean 3" grossed nearly a billion dollars while "There Will Be Blood" never even got to 100 million. "Two and a Half Men" is a hit TV show and Arrested Development is off the air. The Arcade Fire were lucky to go gold with "Neon Bible" while Fall Out Boy went multi-platinum the same year.

Given your logic, nobody should bother creating anything of quality. Sometimes quality is successful, sometimes its not. But it's always regarded.

<comment><USER13> Not exactly. I would say that most people have a highbrow, but highbrow has a zillion different niches. Everyone's lowbrow is basically the same - farts, boobs, various impacts to a male crotch, beer, etc.

</comment></comment></comment><comment><USER14> "Most apps take at least six months of full-time work and cost between $20,000 and $150,000 to develop, according to Forrester Research"

So here the strategy is simple: just develop stupid things that takes a few days. If you check the top apps, half are not hard to code at all but stupid things that people are willing to buy.

So instead to write a smart, interesting application that costs 100,000$ it's better, I think, to write 20 applications costing 1000-3000$ each.

</comment><comment><USER15> Interesting, but not really surprising. Artists & musicians aren't "getting rich" either.. Is there some reason a normal(ish) distribution wouldn't apply to iPhone earnings?

<comment><USER16> It seems the same as with any "hit" driven environment. Getting a top-40 song, a top blog, the next NYT bestseller, or top iPhone app takes a lot of work and a little luck. There are those who are suited to it, persevere and get that big break. Then there are a few who just don't get lucky and thousands of wannabes who fail to execute, be it on minor flaws or epic levels.

I think the best description of the process comes from an editor explaining why so many manuscripts fail: [http://nielsenhayden.com/makinglight/archives/004641.html#00...](http://nielsenhayden.com/makinglight/archives/004641.html#004641)

It's harsh, but has given me insight into how the startup world, including iPhone app startups, works.

<comment><USER10> Apparently, even being a drug dealer works the same way.

<http://www.freakonomicsbook.com/thebook/ch3.html>

<comment><USER16> I don't have statistics to back me up, but I'm fairly certain the odds of survival are considerably higher for iPhone developers.

<comment><USER10> Yes, but the pyramid structure of wealth (concentrated at the top) definitely applies.

<comment><USER16> With the right binoculars, you can see Steve Jobs standing way up there on top. I do get what you mean about that, but it seems smaller pyramids can be built next to the big ones, even if they do pay taxes (so to speak) to the bigger ones. Maybe the iPhone isn't the best environment for that? Or maybe the real money is in building apps for other companies who need their services extended to a new platform.

<comment><USER10> I strongly suspect your last sentence is the key!

</comment></comment></comment></comment></comment></comment></comment><comment><USER5> Btw I submitted this news report yesterday, but I titled the submission with Newsweek's title/headline for the article - "Striking It Rich: Is There An App For That?" (Hardly anyone noticed that submission :-). \-- On other posts, I've seen some commenters suggest that hn submissions should keep the original title of the article and not editorialize by typing in a new title, but as this this submission shows, sometimes, re-titling a news report makes it easier for people to understand what the news report is about.

<comment><USER17> Sometimes the original titles are just not very informative. So in those cases it may be a good idea to change the title. But I still think that one should not editorialise -- i.e., one should try to use a title that faithfully summarises the article.

</comment></comment><comment><USER18> Newsweek picked two really bad examples for this article. One is flat out profitable and the other is making ~$100k. From my perspective that's rich in this economy where many talented and qualified people can't even find a job. I'm sure there are lots of real examples of people losing money on the App Store but Newsweek couldn't be bothered to find any.

<comment><USER19> Where are these talented and qualified people without jobs?

<comment><USER20> Given the nation's ridiculous unemployment rate, and especially given California's even larger numbers? Probably everywhere, actually.

<comment><USER19> The unemployed people I know of aren't people I would describe as "talented". Talented people generally aren't unemployed unless they want to be.

<comment><USER20> Anecdotal evidence isn't exactly an irrefutable argument.Not to mention you're begging the question as to how many unemployed people you actually know.

Finally, talented people with preference for working in a system than designing one out of scratch may be out of luck when looking for employment in a low-yield market. I don't think either of us are talking about talent as a static, singular or sole factor of employment probability, after all - <USER2> like it or not, there's such thing as Plain Bad Luck for some folks.

</comment></comment></comment></comment></comment><comment><USER21> There are so many of these 'iPhone development doesn't automatically make you rich' articles that make it to the top of HN. I tend not to look at the comments for those articles, so forgive me if this is a common question, but can anyone tell me why there are so many? You'd think this is something we'd all know by now.

<comment><USER22> 75k apps and billions of downloads suggest we dont know anything.

The only real winners in this whole game have been Apple and iphone dev consultants.

</comment></comment><comment><USER23> I'm convinced that on these new anyone-can-make-an-app platforms (e.g. facebook, iphone, android), your best shot to make money is to be one of the first out with a product, then with that experience go freelance.

The markets become saturated too quickly. After a while, your problem becomes advertising rather than product quality. The only way I see to survive somewhat reliably later on is to diversify and become a portal/aggregation company.

</comment><comment><USER24> If not iPhone, how is a web-hating programmer to strike rich?

<comment><USER25> Striking it rich aside, a "a web-hating programmer" is going to have a lot of trouble these days. No matter what project you start on, completely avoiding the web is one way to make sure that your competitors will one day get the best of you.

If you're talking about simply avoiding 'web apps,' there's still decent money to be made in desktop applications. But, as with almost all industries, there are two ways to strike it rich: get _really_ lucky, or work _really_ hard.

edit: now that I think about it, you might be able to get a couple years out of µC work without dealing with the web, but that's more hardware than software.

<comment><USER24> Of course, I meant developing for the web (beyond static web sites). I hate the accidental complexity of web apps and, frankly, that's not where my expertise is.

My languages of choice are Python for prototyping and (modern) C++ for the actual development. I enjoy working on machine learning types of projects and thinking about algorithms.

</comment></comment></comment><comment><USER26> This sort of article always struck me as silly. Is it really that surprising that not all developers on the iPhone are wildly successful? Or even that most aren't? Welcome to capitalism -- not everyone will be rich.

Not all developers on [insert platform here] are getting rich. But some are. Not everyone who starts any type of business will strike it rich. But some will. Why is this news?

<comment><AUTHOR> One of the more interesting points was that even the developers who everyone thought were getting or had gotten rich seem to be struggling to maintain/repeat their success or got rich for other reasons (such as the guy who bought shares in Palm from the revenue of his game).

</comment></comment><comment><USER12> I'd hope at this point, anyone looking to get into development is grounded in the reality of the market.

This isn't going to change anytime soon and it's going to play out across ALL platforms. The AppStore just gets the attention because it has the biggest "easy success" potential to a developer. A crappy app that nobody wants is a crappy app that nobody wants on any platform.

</comment><comment><USER27> Anyone telling you that the App Store is still a gold rush is trying to sell you something.

</comment><comment><USER28> This Cubby guy's biggest expense was the $29k he blew on programmers. It's crazy how many people are trying to make money on the iPhone and are either not programmers, or don't have the drive to actually learn how to write code.

</comment><comment><USER29> Bjango wrote what I thought was a good, brief response to this on their site. <http://bjango.com/articles/golddigging/>

</comment><comment><USER30> Articles about how iPhone developers aren't getting rich won't make you rich.

<comment><USER31> It will help prevent you from becoming poor if you were thinking about iPhone development.

<comment><USER32> This article tells the reader nothing except 'The App Store isn't a free ticket to millions of dollars'.

If that realization is the only thing keeping someone from going broke for having tried iPhone development, they'll soon be broke from some other idiotic scheme. Bridge ownership, perhaps.</comment></comment></comment>