Twitter's User Growth Goes Nowhere as It Meets Revenue Expectations of $710M - <AUTHOR> http://techcrunch.com/2016/02/10/twitters-user-growth-goes-nowhere-as-it-meets-revenue-expectations-of-710m/ <comment><USER2> Why on earth is wall street so hung up on user growth? Don't they still have a ton of monetization opportunities? I see no where near the amount of ads as facebook and I hear their ad targeting is pretty bad right now and despite all this, their revenue isn't bad at all.

<comment><USER3> The price reflects the future prospects of Twitter, and a poorly-monetised Twitter with a shrinking user base is worth less than a poorly-monetised Twitter with a booming user base.

Put another way, they used to be hosting a huge party and just had to work out how to turn that into cash. Now people are starting to leave the party, making cash less of a concern at that point.

<comment><USER4> I think this pretty much nails the wall street perspective. Interestingly enough I left the party because their attempts to monetize were really invasive; Emails, many notifications on my phone, etc... I think some subset of their users (to which I belonged) appreciated the simplicity of the product. Their attempts to increase engagement decreased it with what appears to be a significant portion of their user base.

<comment><USER5> I never quite _got_ Twitter. It just seemed like a giant celebrity circle jerk. Especially for celebrity tech people. And I just don't give enough of a shit about famous or prominent people for it to matter much.

<comment><USER6> Honestly, I'm positively perplexed by this comment.

Twitter allows me to follow writers and influencers like Malcolm Gladwell, William Gibson, Edward Snowden, Glenn Greenwald, to niche industry influencers ranging from Rails engineers to industrial designers to photographers in a way that is digestable and at times personal. To me, it's been edifying to read thoughts from them, discover work they've created as it happens, or find out about a book they recommend.

Twitter is literally what you make of it. Follow interesting people, you get interesting content.

<comment><USER7> Your comment is very reasonable but I've found that celebrity or wits or intelligence hardly correlates to interesting Twitter stream. Basically, most people who tweet are a waste of time to read. Even at 140 characters at a time.

It's surprisingly hard to find people who consistently say interesting things in such a restricted space.

Overall, I've decided it was so hard that it just wasn't worth my time, so I no longer read Twitter at all.

Obviously, your mileage may vary.

<comment><USER8> I too have felt the same way. I occasionally check John Carmack's twitter or some other developers, but that's it. and when he was around I loved [https://twitter.com/devops_borat](https://twitter.com/devops_borat)

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> I know there are theoretical alternatives to Twitter, but until the appropriate userbase is out there then they're not truly viable alternatives. I know that's a Catch-22, or a paradox, or whatever you want to call it, but that's the sad reality for those of us that would like to leave the platform. So, in lieu of leaving, here are the features I feel like would help Twitter retain me as a user:

1\. Bring back custom apps! Twitter is a _service_ , and I want control over how I access that service. This would also take such a huge burden off of Twitter: don't care about the super bowl? Use an app that lets you filter hashtags, piece of cake! So many features can be implemented on top of a service, with no extra effort from Twitter. I get that this could conceivably enable filtering timeline ads, but seriously they can just pull API keys for apps that do that, it's a non-issue.

2\. Let me subscribe to ideas, not just people. If I _do_ care about the super bowl, maybe let me turn on push notifications for tweets about it from people within my network for whom I otherwise do not have push notifications enabled.

3\. Make chronological timelines a setting. Not an option, not a tab, a semi- permanently enabled _setting_. It's the most annoying thing about Facebook right now, having to explicitly re-enable chronological timelines every week or so when Facebook has "forgotten". As it stands, even that much is an improvement over Twitter's proposed always-on non-chronological timeline.

4\. Don't nanny me unless I ask you to. There have been reports that Twitter has blocked notifications for @replied tweets because Twitter suspected the tweet would be offensive. I get that harassment is an issue and that Twitter was trying to be proactive, but make it an option. The user in this case was failing to be notified of tweets they _wanted_ to see, and had no way to disable the "feature".

5\. Inconsistency foments distrust. If you want that blue check mark to mean something then you'd best lay out a solid and strict process for them. I've seen at least one person have theirs removed over unsubstantiated claims, yet more egregious offenders have kept theirs throughout. I've seen others go through the process for acquire their blue checks and they always seem to have different requirements. Some reported having to change their profile name to their real name, others said they had to put their actual photo on their profile.

<comment><USER10> Out of curiosity, what would your counterargument be to those who say, "Facebook does all the things you list _wrong_ , yet look where they are today. Why should Twitter do any differently?"

<comment><USER9> I would say "Do you want to be the dominant platform because your users like you, or because they're stuck with you?"

I totally get it that a social media platform can do things that the majority of their users outright hate. Facebook even admitted that they intentionally caused their mobile app to crash randomly, just to test user retention!

But people can always find better options. MySpace was on top once. Digg was on top once. User loyalty is an important part of a social media platform, doubly so when there's someplace to jump ship to.

</comment></comment></comment><comment><USER11> the sentiment i've gathered from people who use twitter professionally, namely journalists and the like, is that an algorithmic timeline would completely destroy the value proposition for them. twitter is such a nice little social media app that i find it disturbing to see it bullied by wall street. such is the fate of a publicly traded company. if it were a private company that could focus on being profitable without growing extravagantly and taking over the world like Facebook or Google, it could focus on providing its unique value to its most important users.

i think of all the social media platforms i use, twitter is the one that most tremendously contributes to society. twitter, far more than facebook in my opinion, democratizes the dissemination of ideas and information.

<comment><USER12> > twitter, far more than facebook in my opinion, democratizes the > dissemination of ideas and information.

Not any more since the last wave of closing "alleged ISIS" accounts. I can't stand those religious retards either, but banning people just because they follow a religious cult of killers who spread hate and murder threats?

You could use the same argument to ban practically everything... including followers of Donald "Muslims out!!!" Trump, Frauke "Shoot refugees at the border" Petry, Recep Tayyip "Kurd Killer" Erdogan or whoever is the King of Saudi Arabia.

None of these groups are in any danger to be banned from popular social media sites despite their ideology being very similar (or, in case of Saudi Arabia, identically) to the IS and their followers equally murderish and morally depraved (Erdogan, Saudi Arabia, the neo-Nazis burning refugee camps down in Germany).

It's inconsequent and the mere possibility of banning someone over anything that members of another (whiter? religious-er?) group are allowed to do opens up highly complex moral issues.

<comment><USER13> _banning people just because they follow a religious cult of killers who spread hate and murder threats_

I dunno man—when you put it like that, it sounds like a pretty great idea.

<comment><USER12> Well then, why is @RT_Erdogan, @SaudiEmbassyUSA or @FraukePetry still a thing?

Because they're white, because they're allied with the West or what?

Political bigotry at its finest. Either you tell ALL the radicals to fuck off or none at all.

<comment><USER14> No, it is perfectly acceptable to ban the most extreme members. Just because they don't ban everyone with extreme views doesn't mean they need to keep all of them.

I am tired of these all-or-nothing discussions that seem commonplace nowadays. The world is not as brightly defined as you think it is. We can make forward progress progressively.

</comment></comment></comment></comment></comment><comment><USER15> US YoY numbers are down--this is true. Q4 has historically been a bad growth month for them.

If you're focused on MAUs, then Q4 in a non-election year is going to be bad. It's like "peak boring Twitter". Everyone is rocking Amazon and the online retailers. There are no new TV series or movies dropping. Bowl season hasn't started. World Cup 2014 (Men) and 2015 (Women) are past.

Granted, the US annual YoY numbers aren't good, but:

* International is up 11%.

* 2016 is an election year.

* And there are Olympics this year.

* And Q1 is historically the strongest growth month.

I kind of think that if you're strictly MAU-focused, it's not a bad time to get in.

That said:

* I have noticed casual users dropping off their interaction volume based on my puny timeline.

* I attribute some of that not to anything competitive, but to the economy picking up and everyone being so freaking busy. More lurking, less of a need to self-validate. Call it social proof fatigue. (I really suspect this is the canary in the coal mine for Facebook engagement.)

* The sharp divide between folks who claim to "get" Twitter and those who claim to "don't get" Twitter is sharpening. Rather than seeing this as a negative, I see this as a bifurcation that can be studied and exploited.

Twitter still has a unique and important niche. There are so many ways they can innovate around this niche without destroying it.

My take:

* Twitter _search_ is an unexploited global resource.

* Buffing up search and offering it _orthogonally_ to the Twitter user experience is a HUGE potential upside that is untapped. They can monetize the hell out of that and not screw up the experience! Why limit engagement with their data flow to the timeline! I'd _gladly_ accept more ads in a search than in my timeline.

* Restating that: content creators--the people who tweet--low barrier to entry. Market search and Moments in a broader way. The pulse of the country. You can laden that with the ads. Those are the MAUs you want.

They'll be fine. This feels more like a narrative created by competitors or potential acquirers to get them on the cheap before they can execute on their core value. Maybe they're run by weak-willed dullards who will cave because they can't see it, and it will be Google or someone else with a lick of sense that leads them to their promise, or who acquires them to kill them off.

</comment><comment><USER16> There is such a unique opportunity Twitter has attempted but not fully captured with Moments. When big events happen, people take to Twitter. With an aggregate of Periscope, Vine, and Twitter, we could have interactive LIVE events. Tune in on your phone, and don't just join the conversation, be part of the event. Unfortunately, Moments feels too static. They hand pick some decent tweets and there you go... Give me the car chase feeling of the 1990s! Where is a white bronco when you need one...

<comment><USER17> Twitter seems to advertise to possibly "offensive" UGC to make its platform shine. It's not an invalid consideration, but I feel they're overdoing it.

When I search a hashtag, I want to see what people are talking about. I don't want to see what CNN or HuffPost is tweeting about. Because I'd to to Google for that.

Twitter needs an automatic curation / reputation system, auto language filtering, and then a greater focus on the tweet firehose like you said. Why their product team doesn't grasp this is beyond me.

</comment></comment><comment><USER18> Q4 was the first quarter ever with negative growth: [http://twitter.com/JasonAbbruzzese/status/697532872824070144...](http://twitter.com/JasonAbbruzzese/status/697532872824070144/photo/1)

</comment><comment><USER19> I think a deeper integration with periscope and timelines will help Twitter. The real time direct global conversation is important.

<comment><USER20> I didn't understand Periscope until I saw a mini-celeb use it. People love it. It's like Snapchat in live group form for celebs. Like why people love to call into a live radio or TV show. Regardless of what happens to traditional Twitter, I think Periscope has a lot of room to grow.

However, Twitter's algo timeline makes it nearly useless to me. It was already a mess and the linear timeline was the only thing I liked. The linear timeline would have been manageable if they still allowed third party clients... but I digress. I'm sure I'll still use it anyway to announce software releases and get customer support from slacking companies.

<comment><USER18> The problem is that Periscope is a startup. Wall St will not like Twitter to be run as a startup, and yet Dorsey is trying to position Periscope as the savior for Twitter. I think that Periscope is an awesome product btw, but sinking Twitter may take it down with it unfortunately.

</comment></comment></comment><comment><USER21> If Twitter ceased to exist, would it really matter?

That is the fundamental problem with it. The world gets by perfectly fine without Twitter (and all those that 'tweet'). It is not a communication medium of record in the way that email is. I do not ask people 'did you get my tweet?' in the way I might ask people if they got my email. I never say 'I will tweet it to you' in the way I might text/skype/email someone.

I know some of my colleagues and family members say great things about Twitter, but these guys commute and Twitter is just another thing they read on the journey. I actually have no clue what my sister's Twitter handle is, I have no idea what any of my current colleagues Twitter handles are either. It simply has never occurred to me that I should ask any of them how to follow them on Twitter. I don't care and neither do they.

Twitter also fails the 'other people's screens test'. What is this? Well, walk through a large enough office at lunch time and see what NORMAL people have on their screens whilst working and whilst on lunch. Nobody is reading Twitter because they have to as part of what their job or out of choice in the few moments they have of 'free time'. The recently slagged off LinkedIn and the oft-criticised Facebook do pretty well on the 'other people's screens test' even if it is only the HR department that do LinkedIn. Twitter isn't even worth blocking from corporate IT networks!!!

I feel that with Twitter some people have bought into the hype and personally invested time and effort into believing that hype, for them to say it is useless is not going to happen. Yes it does allow me to have a window in on the programming community I am part of, however, one 'vital' news story feed in my micro-world-of-programming stopped and life went on for me, despite not having Twitter to brief me of what I thought were important developments. RSS fulfilled this requirement beforehand, life went on when RSS stopped and life will go on when this stupid Twitter thing stops, which I hope will happen sooner rather than later. Really it is like CB radio of the 1970's.

</comment><comment><USER22> Does Twitter break out the numbers on Vine? The valuation is starting to get tempting at these levels. I think Wall St is missing the big picture, as usual.

</comment><comment><USER23> I think Twitter can really pivot to become the first aggregated MicroPayments platform.

An all-you-can eat option: $10/Month - Read any news, blog, whatnot, follow anyone, tweet to anyone, upload anykind of media

A-la-cart: pay 0.01$ after reading the 140 character summary for full article access, pay 0.05$ for full tweet stream access to some really useful accounts, etc

Free: Every fourth tweet is an ad, You get only previews of articles, and only a portion of the Tweetstream of really useful content.

Twitter can then kick-back some dough to the content publishers.

Twitter maintains and controls the payment info already anyway. If they get ambitious they can hook into buying and selling as well.

<comment><USER17> There is a huge jump in $0 and $5, which is the minimum funding amount for cc fees to not be huge. You'd see a mass user exodus.

</comment></comment><comment><USER24> TWitter seems to be having this issue for a while now. I wonder if it'll do what FB is doing by going in to other ventures

</comment><comment><USER25> I never used Twitter because the product's name implicitly refers to its users as twits (a characterization which is usually accurate.)

</comment><comment><USER26> Can we stay away from quarterly earning reports and wall street style newspaper reportings? This industry is supposed to be a little different. Let's not go along with their rhythm as that way they still mold us in their image.

Let's not be like them.

<comment><USER27> Sure. You just need to stop going public after diluting ownership down so far you have no control over your own company via endless rounds of VC to pay for not having a business model (causing you to bleed red ink and ultimately be overly dependent on outside money), and stop giving all the power to institutional investors accordingly.

Then you can get away from the pressure of quarterly results. Otherwise, no, there's no scenario under which you can get away from that influence while owning 3%-5% of your own company and being public.

Twitter made a mistake by not having its ownership structure set up like Facebook and Google.

<comment><USER28> Here's an archive.org link to Dan Bigman's May 2012 Forbes post on those ownership structures (published a few months after Facebook's IPO): [http://web.archive.org/web/20120527223753/http://www.forbes....](http://web.archive.org/web/20120527223753/http://www.forbes.com/sites/danbigman/2012/05/23/facebook- ownership-structure-should-scare-investors-more-than-botched-ipo/)

</comment></comment></comment><comment><USER29> I'm looking forward to this algorithmic feed, as much as I like the simplicity of the firehose of tweets. The reason I avoid twitter right now is because I end up following a few people that I only care a little bit about, yet they dominate my feed disproportionately. It'll be a lot harder for Twitter to figure out relevance for their users though, compared to Facebook, considering the lack of user actions they have in comparison. (It's a much more passive platform)

</comment><comment><USER30> "Goes nowhere"? I see 2 million new users.

As I blogged about this recently ([http://brianstorms.com/2016/02/twitter- executives-are-like-l...](http://brianstorms.com/2016/02/twitter-executives- are-like-louis-cks-whiny-air-travelers.html)), Twitter execs fiddling with the product and the wall street banksters complaining about Twitter's growth remind me of whiny air travelers as described by Louis CK. As he might say about Twitter, people! Twitter is a technological marvel! Over three hundred MILLION people connected all over the world in real time! There's never been anything like it. And it is growing each month! What a wonderful world!</comment>


Ask HN: Any YC-backed teams have listed their space on Airbnb? - <AUTHOR>

<comment><AUTHOR> Just found the YC group on Airbnb after asking the question. Not sure whether the list is verified...

<http://www.airbnb.com/groups/ycombinator>

Any suggestions/additions?</comment>


Detecting the use of "curl – bash" server side - <AUTHOR> https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/? <comment><USER2> Need to also detect wget | bash, which should cover most cases that I see on the web

<comment><USER3> Also people not reading the source code of software they install, which has similar security implications to curl | bash.

<comment><USER2> Node would be literally unusable if people read all the code they're installing and running. I personally wouldn't be able to use Deluge, Chrome, or VS Code every day if I did that.

At some point there's an element of just trusting software because lots of other, smarter people trust it. It's a terribly flawed system, of course.

<comment><USER3> Yes, precisely. Install software from verified sources (either signed packages or fetched from encrypted, identity verified websites). Whether you use curl or not is irrelevant.</comment></comment></comment></comment>


Ursula K. Le Guin, Acclaimed for Her Fantasy Fiction, Is Dead at 88 - <AUTHOR> https://www.nytimes.com/2018/01/23/obituaries/ursula-k-le-guin-acclaimed-for-her-fantasy-fiction-is-dead-at-88.html?smid=tw-nytobits&smtyp=cur&mtrref=t.co&gwh=81FD9619256BDB234280FF7BAEC036D8&gwt=pay <comment><USER2> Dupe: [https://news.ycombinator.com/item?id=16218439](https://news.ycombinator.com/item?id=16218439)

<comment><USER3> She deserves a thousand dupes a black banner and the flag at half mast.</comment></comment>


Can a $9 Computer Spark a New Wave of Tinkering and Innovation? - <AUTHOR> http://www.npr.org/sections/alltechconsidered/2016/01/21/463592334/can-a-9-computer-spark-a-new-wave-of-tinkering-and-innovation <comment><USER2> Sigh, I believe the answer is "no". Cost is not the problem with tinkering. I don't think access to computing gizmos is an issue at all in the US. For me I surfed in on a wave of tinkering and innovation by building things that my friends were impressed by and played with (programming calculators, text adventure games, even some electronics). Where is it now? I'm not sure (and I would love to know) how kids these days are building things that are able to compete for valuable attention span. Especially if they are going head to head with psychologists who design smartphone games.

<comment><USER3> I think children having _their own_ general purpose computing devices is pretty important. Time sharing and the obligation not to break "the family computer" make it pretty useless as a tinkering platform, unless your parents are technical and comfortable with it. The individual devices children own are compilation targets, maybe, but they can't run text editors and compilers.

Cost _of the actual computer_ is not the problem. All of these $50, $20, $5 computers conveniently ignore that fact that you also need $150+ for a monitor, USB hub, keyboard, mouse, WiFi adapter, etc. This quickly raises the price from "something a low-income family can easily spend on a child" to "no fucking way." I found OLPC a lot more compelling.

Still, I'm thankful for cheap hardware on which to run pirate AirPlay targets and homebrew IP cameras :).

<comment><USER4> > Cost of the actual computer is not the problem. All of these $50, $20, $5 > computers conveniently ignore that fact that you also need $150+ for a > monitor

Chip has an answer to that.[1] Not sure whether it is really usable enough for kids to work on, but I'd did a lot of work on my TI calculator, which didn't even have a qwerty keyboard.

[1] [http://getchip.com/pages/pocketchip](http://getchip.com/pages/pocketchip)

</comment></comment></comment><comment><USER5> Olimex, who are in a strong position to know, say that the cpu alone (Allwinner R8M) costs $16, direct from Allwinner[1], in volume. That's just the CPU. None of the other components, the PCB, the labor, etc.

The $9 price just isn't sustainable. It appears the the CHIP team is doing a combination of padding shipping prices, and probably taking a loss for the sake of initial marketing.

[1][https://olimex.wordpress.com/2015/06/05/how-to-get-in-the- ne...](https://olimex.wordpress.com/2015/06/05/how-to-get-in-the-news-tell- people-that-you-will-make-and-sell-something-which-cost-you-20-for-9/)

<comment><USER6> This article gets brought up in every post about CHIP. Maybe there's something to it but coming from a competitor this sounds a bit fishy. It was also before the Raspberry Pi Zero (made in the UK!) launched, which lacks quite a few of the CHIP's features but at $5 sets a high bar in any case.

<comment><USER5> The bom cost for the RPI zero is clearly lower. No flash, no wifi, much cheaper cpu, etc.

It is almost a certainty that the BOM cost alone for the CHIP exceeds $9. That's the unassembled pile of parts.

</comment></comment></comment><comment><USER7> For the lazy:

       - 1 GHz processor
       - 512 MB RAM
       - 4 GB Storage (No SD card support)
       - WiFi b/g/n and Bluetooth 4.0
       - Composite output by default but HDMI and VGA are supported with an adapter (Sold separately)
       - 1 USB Port and 1 USB Micro with OTG
       - 8 GPIO

<comment><USER8> If you're not using the display pins, you can use at least 23 more pins as GPIO.

</comment></comment><comment><USER9> We've had cheap computers in every generation, remember the Sinclair ZX81 ? ($100 when a PC was $1500+)

What sparks tinkering and innovation is open minds and creative thought processes.

(as well as laws that don't get in the way of tinkering)

Those kinds of minds find the tools, not the other way around.

<comment><USER10> > We've had cheap computers in every generation, remember the Sinclair ZX81 ?

I would dispute that. That was the 8-bit era. An entry level programmable computer in the sub $100 price range has been missing for a long time.

<comment><USER9> A $10 smartphone today is as powerful if not more powerful than most of these attempts at low end computing.

Just needs a keyboard and HDMI output.

<comment><USER11> Do $10 smartphones exist today?

<comment><USER9> In the USA there is a $10 smartphone sale practically every week of one brand or another.

This week: [http://www.bestbuy.com/site/tracfone-alcatel-onetouch- pixi-g...](http://www.bestbuy.com/site/tracfone-alcatel-onetouch-pixi-glitz- no-contract-cell-phone-black/4427501.p)

It's very low end for a smartphone but can run almost any android apk and use wifi even without airtime. Some $10 phones can be rooted and then you almost have a full linux-like system.

For $20 you can get quad-core with 1GB of ram: [http://www.walmart.com/ip/Straight-Talk-LG-Prepaid- Destiny-L...](http://www.walmart.com/ip/Straight-Talk-LG-Prepaid- Destiny-L21G-Smartphone/45822123)

<comment><USER10> I'm not sure a $10 smartphone is going to be bought for a elementary school child to learn to program on. Nontechnical parents are not going to buy something like that, root it, and teach their child to program. The glory of the 8-bit era was the ready to go nature of the programming environment and the cheap price.

</comment></comment></comment></comment></comment></comment><comment><USER12> I really don't have any faith in the company, I have an otto camera. They abandoned all support and development for it as soon as it was shipped to backers. (one update) Felt like, "we've got your money, here is the minimal amount of stuff to keep us legal....now go buy or other stuff"

</comment><comment><USER13> The problem with these kind of articles and releases is that for most people, $9 vs $100 isn't that big of a difference... At least in the U.S. and other first-world countries where an initiative kid can earn either in a relatively short period of time, and most parents could gift it to them if not.

As others have and will point out, it isn't just $9, there's the need for another system to be able to read documentation, and work on while doing projects on said $9 computer... there's also the peripheral costs, kb, mouse, monitor which would likely run it up to close to $100 anyway.

I think the issue is sparking ideas and interest in younger people... most are more interested in writing phone/tablet apps than they are in touch with tinkering. There's a reason that Radio Shack had to shift gears, and in turn died off...

Don't get me wrong, the availability of cheap computers with decent i/o pins is really nice, and for anyone interested in integrating electronics and software, there's never been a better time... But having yet another <$100 option really isn't going to spur extra tinkering at this point... And getting exposure into schools is particularly difficult given that most people with the skills to actually work and teach for these things are likely employed at a much higher salary than they'd get in a K-8 role (at least 2-3x).

<comment><USER14> > The problem with these kind of articles and releases is that for most > people, $9 vs $100 isn't that big of a difference.

What world do you live in? Median _household_ income in the U.S is $51k.

<comment><USER15> I think you are missing the entire picture. I have to agree that it is not a big enough cost difference because if you go spend the $9 and then try and use it without $100 more in equipment or already existing computer you will be disappointed. So it simply is not going to spur that much more interest.

<comment><USER16> Actually, that isn't true.

People lacking basic means can often work, trade, scrounge, repair, etc... to get a working, usable system. And they will do that too.

</comment></comment></comment></comment><comment><USER17> I'm going to go out on a limb and say it's not the price of the electronics (which are very cheap), or the availability of them (they are plentiful), or even the knowledge to learn (this is the age of the Internet on mobile devices), but is actually the price of another thing that that is going up: time (and by extension, focus).

I feel that students have to start planning for college earlier and earlier these days, even planning how courses line up as early as middle school. When all academic scheduling decisions (sports, classes, extra curriculars, clubs, etc.) are always viewed through the lens of college admission, there is very little time to turn brains off and just play with the knowledge they've gained thus far. If an activity isn't directly linked to job training of one or two strong focuses that could potentially lead to a major in college and a job afterward, they aren't seriously considered as an activity worth spending time on, and that is a pity.

I would add lastly that as a counterbalance to this extreme need for academic focus, instead of seeking invigorating hobbies to which students at the end of the day will lack the energy for, they instead seek more mindless and passive activities which are readily available on their mobile devices. The harder they work, the dumber they want their hobbies to be.

</comment><comment><USER18> It certainly lowers the bar to entry.

Somewhere out there, there's a kid with an idea that will one day become the next Zuckerberg or Woz. Whereas it was next to impossible for my peers to convince our parents that we needed a $3,000 computer setup just for learning, these young people can earn the money for their own supplies with a summer job.

</comment><comment><USER19> I think the biggest improvement of the CHIP over the Raspberry Pi, besides the price, is it's got on-board WiFi and flash storage, and is pre-loaded with an OS. Those are nearly always the first 3 things I need to take care of when starting a new Raspberry Pi project.

</comment><comment><USER20> I think these computers (Rasp Pi, CHIP, Beaglebone, BBC Micro) are doing what the one laptop per child couldn't do. That is to be the affordable computer to the 3rd world. Almost everyone in the west can afford a $100-$500 computer, but that is still beyond the reach of many people in the 3rd world. That means basic computer and programming skills will be within reach for a large number of the population in the world.

Also, currently, most of the development work available are for PCs, Mobile, and Tablet devices. These chips are the building blocks of the Internet of Things, meaning development work needed in the future will go beyond just programming for PCs, Mobile, and Tablet devices.

</comment><comment><USER21> I think the biggest positive aspect of widespread distribution of raspberry pi and devices like it is to ward off the fear from adults in the school system.

If the school board comes out and says, we're purchasing these things for an entire district - this is an official movement from the school board top down - the governor signed off on this and we're getting these out to every single kid in our schools, teachers can no longer point to microelectronics and say that it's a bomb.

Hopefully fewer students get sent to the police station for tinkering with electronics.

</comment><comment><USER22> People do know it's possible to get $1 ones on alibaba?

<comment><USER6> an Arduino clone is something like $1.70 on aliexpress and has a fraction of the processing power so it's not exactly a fair comparison

<comment><USER23> An arduino clone is almost infinitely more useful as a teaching tool than these arm based computers are, though.

Source: I teach people to program microcontrollers every day.

<comment><USER24> completely agree, the complexity of Linux actively hinders learning. Much easier and useful to learn on a bare-bones microcontroller.... I certainly learned on a 4MHz z80 and have a much more in depth understanding of software and hardware as a result.

</comment></comment></comment></comment><comment><USER25> I believe I would have been better off with better math courses in junior high and high school than I would have been learning computing. Perhaps that's too path dependent, and based too much on the sheer level of pain experienced as an undergrad having to learn it properly.

But I was hacking (analog) electronics ( at a very shallow level ) so maybe the little RasPi class machines make up for that.

</comment><comment><USER26> A $9 computer that cannot be shipped for less than $10 is a $19 computer.

<comment><USER27> From getchip.com, shipping to Canada comes out to $6.22 for a single CHIP, and $11 for 5 CHIPs

</comment></comment><comment><USER28> The VGA/HDMI converters ($10/$15) cost more than the computer. (!)

</comment><comment><USER29> > And unlike Microsoft products, CHIP has both open-source software (Linux) > and hardware.

That seems like an unnecessary dig.

<comment><USER30> Not really? It's a valid point, it's generally easier to tinker with open source software.

</comment></comment><comment><USER31> NPR covering the news in true NPR style... Five years too late.

</comment><comment><USER32> No

</comment><comment><USER33> No

</comment><comment><USER34> doesn't this still require a monitor and keyboard? they should provide "starter-kits" for the uninitiated... but yeah $9 once you know how to use it is great.

<comment><USER35> Self-contained handheld version. $49

[http://getchip.com/pages/pocketchip](http://getchip.com/pages/pocketchip)</comment></comment>


I built RemoteCV | Reversing the job search model - <AUTHOR> Hello everyone
Inspired by by @Levelsio, I decided to start http://RemoteCV.com My goal is to: 1-Help you find a remote job for free 2-Find and Hire the best Remote Talents for (any role).
Happy to hear any feedback :) <comment><USER2> "We helps you effortlessly hire world-class remote talents." -> We help you effortlessly hire world-class remote talent.

<comment><AUTHOR> sorry for the that, i'll edit it now. Thanks</comment></comment>


Snap's ad business is in serious trouble - <AUTHOR> https://medium.com/@gregdale/snaps-ad-business-is-in-serious-trouble-e8c431201de6/# <comment><USER2> "Snap, Inc.'s third quarter 2017 earnings caught notice: a $40m accounting write-down on unsold Spectacles glasses and a complete reversal on product strategy towards a re-design of the app. In Snap's ad business, things were no better: Snap's Average Revenue Per User is only 10% of Facebook's, revenue growth is rapidly diminishing, and there's no clear path to fix it. Management attributed the revenue issues to temporary changes in the ad business's structure, but barring the outsized success of the pending product re-design, the weakness is likely permanent."

I think people are more becoming more and more fatigued with social media. I know I am and I am sensing it more and more with my friends and family. People only share 'life moments' on Facebook, travel/food/hobbies on Instagram, career on LinkedIn, politics/sports/news/social commentary on Twitter, and reddit is for who you are when no one is watching.

What is Snaap supposed to be in the current media landscape? It's pretty buggy compared to others and what made it unique is being compied shamelessly by Facebook/Instagram.</comment>


The ongoing story of a Dreamhost account compromise - <AUTHOR> http://old.nabble.com/Dreamhost-account-hacked-td28062149s24859.html <comment><USER2> I'm surprised anyone with the tech savvy to be reading and contributing to HN wouldn't be using a VPS for hosting.

The lowest tier server at Linode is $19/month (see <http://vb.ly/linode>) and will easily host plenty of virtual host based sites - although you could also check SliceHost or RackSpace Cloud Servers, etc.

Learning to run a simple server is really rewarding and you get to own root and run the box the way you want to.

Full disclosure: the link above has my referral code in it - it doesn't effect the cost of Linode's plans to you but if you do sign up you'll cover my hosting for a month. I hope people are ok with that.

<comment><USER3> Some of us aren't heavy web programmers.

<comment><USER2> Honestly, that doesn't matter.

Anyone who is the slightest bit technical would gain a lot from managing a VPS for their site. Even if you just want to host a bunch of wordpress blogs, or even static files.

<comment><USER3> You discount the power of being lazy.

<comment><USER2> ^_^

</comment></comment></comment></comment></comment><comment><USER4> By and large, Dreamhost is responsive, savvy, and competent. Lack of direct phone number for such situations is the only drawback I see to this story.

<comment><USER5> As of last month, they were still storing passwords in plaintext. They sent me my password over email when I forgot my password.

That, to me, is not a good indication of a savvy & competent company.

Edit: I haven't used them for hosting.

<comment><USER6> There was someone, maybe a Dreamhost employee, posting on HN a month ago with justifications for this practice...

He explained that there are customers who want passwords e-mailed to them, presumably even if you explain that it is not secure: <http://news.ycombinator.com/item?id=1148848>

And he mentioned that Dreamhost offers the (non-default) option of not storing the password text: <http://news.ycombinator.com/item?id=1148732>

<comment><USER5> Thanks for that.

I don't agree with their decision though, since most major websites will not email you back your password, by default. If facebook can get away with it, I'm sure dreamhost can too.

<comment><USER7> Facebook doesn't have paying customers. Also, most Facebook users access it for personal use. A lot of people access/use Dreamhost for business purposes. I'm sure there are a lot of PHBs that have access to Dreamhost accounts because they feel compelled to micromanage everything (or just PHBs that make the 'requirement' that the password is recoverable).

<comment><USER8> Along with the PHBs, we've also got a lot of plain old non-tech-savvy customers who just want to run their [personal blog / small business homepage / church web page / etc], and don't know, nor want to learn, too much about computers. Requiring them to use semi-strong passwords for FTP and email logins is enough of a challenge; requiring them to change those passwords every time they forget them is often a real hassle.

<comment><USER5> Why don't they want to change their passwords when they forget them? Presumably the old password isn't much use anymore, since it's been forgotten.

But unless there's something I'm missing, I suspect I'm just preaching to the choir right now ;)

<comment><USER8> One or both of:

\- They've forgotten the password, but it's still in the keychain (or equivalent) for their mail or FTP client, which will all stop working when they reset the password.

\- The password is shared with other employees, and it might be difficult to notify them all of the new password.

<comment><USER5> (1) Fair enough, I suppose some keychains might make it difficult to recover the password.

(2) Why not just ask the other employees for the old password?

<comment><USER8> (1) Right -- and, even if it is possible to recover the password, walking a non-tech-savvy customer through the process may not be a palatable option, either for Support or for the customer.

(2) I wish I knew. Not really our place to ask, though.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> So is there a registrar with good security measures who is relatively inexpensive? I've always just used GoDaddy, but maybe it's time for a change.

<comment><USER10> I would be very interested in any register that supported at least SMS for multi-factor authentcation, hell I wouldn't even mind having a real token.

The Apache Software Foundation has had some issues in the past with guys trying to hijack apcahe.org -- same thing, password resets on our registors site, etc, but luckly we noticed within a minute, and were able to talk to a human being on the phone quickly.

But I still really really want multifactor authentication for registers :|

<comment><USER11> Paul,

Try dynadot.com.

They offer SMS for auth, and they're also the registrar for wikileaks.org, which takes a lot of guts, IMHO. :)

</comment></comment></comment><comment><USER12> Maybe a lesson of you get what you pay for? No negative connotation implied, just stating that you are getting discount hosting and to offer that, this company needs to keep expenses low.

They keep expenses low with no telephone support. So you're SOL when bad stuff happens.

I've had a couple of these throughout the years (with hosts that will remain nameless). The nice thing was the control panel was separate from the support site. (Extra login info to remember but comes in handy when the server hosting your cpanel via a vm is compromised.).

<comment><USER7> > _just stating that you are getting discount hosting and to offer that, this > company needs to keep expenses low._

Maybe I missed something in that thread, but IIRC the original poster said that his Dreamhost account was only for domain registration. How does that translate into 'discount hosting?' Back when domain registration cost $75/year from Network Solutions, they were still known for horrible customer service, IIRC. Paying more money for something doesn't necessarily mean you get better service.

</comment></comment><comment><USER13> The ability to have my whois record anonymous (for free) by registering through Dreamhost is a big plus to me.

I have a couple of private servers on DH which entitles me to free "live chat" with support.

This story makes me wonder if I should open up another account, and put one of my private servers on it, so if something happens to one account, I use the other one to make contact with support.

<comment><USER14> The fact that you're even considering that sort of hack probably means that you should be more strongly considering looking elsewhere.

<comment><USER2> The fact he is running sites that want to be anonymized and he feels there is a high chance of "something happening" to them means everyone else should consider looking elsewhere.

Don't put up home in the ghetto.

<comment><USER7> > _he feels there is a high chance of "something happening"_

Where did he state that he feels there is a 'high chance?' If I encrypt my hard drive, does that mean I feel there is a 'high chance' of law enforcement coming after me and that I must be doing something 'bad?'

> _The fact he is running sites that want to be anonymized_

WHOIS records are only 'supposed' to be used to contact the site admin, etc. That said, when my WHOIS records were public I used to get a ton of junk snail mail. _Especially_ from other domain registrars or 'protection services' wanting me to jump on board with them. The fact that he doesn't want his phone number and address connected to a domain doesn't mean that he wants the domain 'anonymized.' He just doesn't want someone to be able to Google his name and get a phone number and address.

> _Don't put up home in the ghetto._

So the fact that a person wants a site to be 'anonymous' means that it's by definition a sleazy site? What about a forum for abused women? Should the site admin be forced to be contacted/harassed by possessive (and potentially violent) men that are trying to find where their girlfriend/wife that ran away is?

<comment><USER2> > "Where did he state that he feels there is a 'high chance?'"

He didn't but the fact cryptnoob felt the need to mention it suggests he/she is concerned about. I myself don't go around registering multiple accounts "in case something happens" to one of the accounts. Do you?

>"WHOIS records are only 'supposed' to be used to contact the site admin, etc"

Dude, cry me a river. I own a shit ton of domains and so I get that spam all the time. The spirit of the rules around public record of WHOIS data (for com/net/org at least) is that someone can be contacted for technical and administrative reasons about the domain. It's a reasonable rule and so if people fundamentally disagree with it perhaps they should lobby ICANN/etc.

From my own experience running a web hosting business in the past that _most_ people who anonymize their WHOIS details are doing so for suspicious reasons.

> "So the fact that a person wants a site to be 'anonymous' means that it's by > definition a sleazy site?"

No, and my apologies for not being clearer on that - perhaps the word "ghetto" wasn't what I meant. What I meant was shared hosting is like being in the ghetto - you are at the mercy of your neighbors on the same server. An account on the same box sharing warez forums is going to affect YOUR site's performance.

> "Should the site admin be forced to be contacted/harassed by possessive (and > potentially violent) men that are trying to find where their girlfriend/wife > that ran away is?"

As someone whose domestic partner is a leading voice in women's rights online, who receives regular abuse and has had numerous death threats, I can assure you I am very familiar with this subject.

There is a difference between anonymous (read:un-contactable) whois vs using a business address or mailbox where you can receive communication but is not your private residence, etc.

<comment><USER13>
          I own a shit ton of domains

Well, you're the expert. Who am I to argue with anybody who owns a "shit ton" of domains?

         As someone whose domestic partner ...has had numerous
         death threats

OK, on this, I'd say you're a liar. Anybody actually in that situation, I guarantee, would understand perfectly why anonymity on the net is often considered important to people. You are either a complete dolt, or a liar (or both, I suppose)

I enjoy the convenience DH offers me in keeping my name out of Google. My reasons have nothing to do with whether or not my sites are sleezy. They're not. Privacy for myself and my family is not something I should need to justify to some random git (look it up) on HN.

<comment><USER7> > _OK, on this, I'd say you're a liar. Anybody actually in that situation, I > guarantee, would understand perfectly why anonymity on the net is often > considered important to people. You are either a complete dolt, or a liar > (or both, I suppose)_

While I agree that there's a higher chance of it being a made-up story just to try and win an 'internet argument,' than of dotBen _actually_ happening to have a domestic partner in such a situation; there's still a possibility that dotBen and his/her domestic partner are people that are into ultra-openness (i.e. change doesn't happen unless you take risks). Don't be so quick to discount that possibility. Though I agree that rabidly trying to enforce your 'ultra openness' on other people is an aggressive stance to take, and a bit out of nature on HN.</comment></comment></comment></comment></comment></comment></comment>


Sort by Controversial - <AUTHOR> http://slatestarcodex.com/2018/10/30/sort-by-controversial/ <comment><USER2> Pity this isn't gaining traction, better than anything in the front page right now.</comment>


Celsius may be better for chemistry. Fahrenheit is better for real life - <AUTHOR> http://isomorphism.es/post/3767526267/fahrenheit-versus-celsius

<comment><USER2> Basically, the argument boils down to 2 points:

1\. Fahrenheit is more granular, by design

2\. Americans are used to Fahrenheit and learning new things is not cognitively free.

Fahrenheit, as a scale, was created in a similar fashion to Celsius. But then the Fahrenheit scale was multiplied by 4. Like Celsius, Fahrenheit starts at freezing and boiling points - of brine (salt water), not pure water. This gives a lower freezing point (and boiling point?). Then that output was multiplied by 4, giving us the scale we have today.

My preferred solution is a compromise -- create a new temperature scale that is just Celsius multiplied by 4. On this scale:

      * Water freezes at 0 degrees
      * A nice room temperature is 80 degrees
      * Water boils at 400 degrees
      * Your oven dial would run from 260 degrees to 1040 degrees.

<comment><USER3> Well, the main argument I saw in the OP, which I've been advocating among friends for a while, is that in Fahrenheit, 0-100° is the difference between a cold day and a hot day, which makes it more ideal for "what's the weather like today?".

With Celsius, on the other hand, you're not going above 40°, and thus so much of that 0-100° space is useless for real life.

<comment><USER2> And how would you feel about the new scale I proposed? It gives you the scale you want and it's easier to convert to scientific scales like Celsius and Kelvin.</comment></comment></comment>


Draft of Learn Enough Text Editor to Be Dangerous - <AUTHOR> http://www.learnenough.com/text-editor-tutorial <comment><AUTHOR> This is an HTML draft of _Learn Enough™ Text Editor to Be Dangerous_. You can find the full announcement at the Rails Tutorial News site here:

[http://news.railstutorial.org/learn-enough-text-editor- draft...](http://news.railstutorial.org/learn-enough-text-editor-draft/)</comment>


Dissection of COVIDSafe (Android): Australian government's contact tracing app - <AUTHOR> https://docs.google.com/document/d/17GuApb1fG3Bn0_DVgDQgrtnd_QO3foBl7NVb8vaWeKc/edit# <comment><USER2> I believe the government, PM and various ministers have said the code will be released. My sources also say exactly the same.

They're obviously operating with extreme urgency to get the app out. For you.

Give them a few weeks to clean up code and release it (which is very normal) - but in the meantime, here are some tips:

\- Turn the HN angry mob mode off - it's not helpful. We're all in this together.

\- Commend the government on some smart privacy and security choices (data deleted after 21 days, open source code, AWS in Australia, sensible sec practices etc). They won't get it all right - and we as a tech community can help them. Find a bug & help get them closed.

\- When asked by non technical people "Should I install this app? Is my data / privacy safe? Is it true it doesn't track my location?" - say "Yes" and help them understand. Fight the misinformation. Remind them how little time they think before they download dozens of free, adware crap games that are likely far worse for their data & privacy than this ever would be!

Thank you

<comment><USER3> I would love to trust them more, but the Australian government does not have a good track record with regards to privacy. Two such recent examples:

\- Australian's browser history is being provided to law enforcement even though that practice was excluded from the original intent and law [0]

\- Australia passed laws in 2018 which enable law enforcement to compel tech companies into inserting backdoors into their software [1]

0: [https://www.theguardian.com/world/2020/feb/07/web- browsing-h...](https://www.theguardian.com/world/2020/feb/07/web-browsing- histories-are-being-given-to-australian-police-under-data-retention-powers)

1: [https://www.wired.com/story/australia-encryption-law- global-...](https://www.wired.com/story/australia-encryption-law-global- impact/)

<comment><USER4> The Australian government is not a single monolothic institution. It's a set of hundreds of thousands of people with different agendas and intentions. You cannot assign singular agency to the entire government; rather we have to go case-by-case to understand the implications of programs like these.

<comment><USER5> That is a little like saying the human body isn't a single organism because, say, the digestive tract operates with its own agency and intention outside of conscious control. It isn't correct; the politicians in the government have a very high level of agency around what ends up being fed into the institutions and what agendas and intentions are allowed to rise to power.

This isn't the step that gets us to a dystopian future, but it is so cheap and convenient for government to take programs like this and expand them every single time there is a crisis that it may as well be assumed to be coming if people don't kick up a stink each and every time.

We don't need perfect safety. We've can't have perfect safety. Having perfect, technologically enforced safety will create systems that will become corrupted and evil with a high, high likelihood. I don't want the government to have the ability figure out who I'm talking too at all; I'd rather we went in the exact opposite direction of this app and put legal barriers in place to them even asking. COVID-19 is horrible, but it will pass. This tracking strategy will not.

<comment><USER6> _" I'd rather we went in the exact opposite direction of this app and put legal barriers in place to them even asking. COVID-19 is horrible, but it will pass. This tracking strategy will not."_.

Absolutely damn correct brother! 10/10.

</comment></comment></comment></comment></comment><comment><USER7> Here is how I think the app should have worked.

Instead of requesting codes from a central government server to be distributed to people you come into contact with, your phone could have generated its own codes for distribution.

Then when a COVID infection is found, the gov could simply publish a list of all codes collected by the infected person.

Your phone could request this public list daily and you could choose to get a COVID test if your code is in the public list.

The government would have no way to link any codes to a particular phone or person. A lot less data would need to collected, stored, and managed.

This app is designed to allow the government to find and collect anybody they think needs testing. It can also be used to find and punish anybody breaking social distancing laws.

(Updated for clarity)

<comment><USER8> If I understand you correctly, this is exactly the procedure that Stanford's CovidWatch is implementing.

[https://www.covid-watch.org/article#contactTracing](https://www.covid- watch.org/article#contactTracing)

They are pushing for a standard protocol that incorporates this mechanism. It may or may not be compatible with the joint effort of Google and Apple, and with Singapore's under-development BlueTrace standard.

[https://en.m.wikipedia.org/wiki/BlueTrace](https://en.m.wikipedia.org/wiki/BlueTrace)

</comment></comment><comment><USER9> It's interesting to see these tracing app discussions crop up all over the world at the moment. In Germany it quite literally took dozens of public interest groups, two weeks of media attention, EU guidance and an open letter by hundreds of scientists to make the government switch from central data collection to an acceptable decentralised approach.

The amount of misinformation put out by lobby groups in the process was frankly astonishing, is that similar in Australia or is this app primarily driven by the government itself?

<comment><USER10> > In Germany it quite literally took dozens of public interest groups, two > weeks of media attention, EU guidance and an open letter by hundreds of > scientists to make the government switch from central data collection to an > acceptable decentralised approach.

Interesting. Do you have any pointer on the current German approach? I've been looking at the Robert protocol from Inria+Fraunhofer, and I'm not sure I like the central secret DB it requires.

<comment><USER11> I guess they meant the DP-3T. See [https://github.com/DP-3T/documents](https://github.com/DP-3T/documents)

<comment><USER10> I think so, and it seems this is very recent; I found that: [https://www.reuters.com/article/us-health-coronavirus- europe...](https://www.reuters.com/article/us-health-coronavirus-europe- tech/germany-flips-on-smartphone-contact-tracing-backs-apple-and-google- idUSKCN22807J) I hope France will follow.

</comment></comment></comment></comment><comment><USER12> > Non-compliant. The CovidSAFE application heavily uses source code from > [https://github.com/opentrace-community/opentrace- > android](https://github.com/opentrace-community/opentrace-android) which was > released under GPL v3

That's not to say its non-compliant, they could have reached out to the (one) contributor and licenced it separately.

<comment><USER13> For this specific case, it would be a grave mistake to license under anything, which does not contain a copyleft to make sure they release the source code as well and grant the 4 freedoms.

<comment><USER14> If I'm understanding this right, this app was written by the Australian government. Does the license for any libraries or other outside code they have included even matter?

Generally, governments have what is called "sovereign immunity" when it comes to civil lawsuits. They can only be sued if they decide to allow it. Some countries waive their sovereign immunity for specific laws.

For example US copyright law waives it for the Federal government, and so if the US government used your library without permission you could sue them for copyright infringement. It does not waive it in regard to the US states, however, and so if individual states used your library without permission you would probably not be able to do anything about it.

I have no idea if Australia has sovereign immunity from Australian copyright law. Google, Bing, and Duck Duck Go are all insisting on just returning results about the recent US Supreme Court case that said the waiver of sovereign immunity in US copyright just covers the Federal government, not the state government.

<comment><USER15> The Australian Govt respects copyright a dictacted by legislation, rather than some general immunity concept. So particular legislation (such as FOI, Archives Act, etc) may dictate that copies are made and kept. In general, the Govt pays fees as would a commercial entity, but many of the use cases could be covered by a legislative requirement or a fair use provision, and it is rather baroque, and the process of legal reform is quite slow.

[https://www.alrc.gov.au/publication/copyright-and-the- digita...](https://www.alrc.gov.au/publication/copyright-and-the-digital- economy-ip-42/crown-use-of-copyright-material/)

[https://www.smh.com.au/business/companies/government- alleged...](https://www.smh.com.au/business/companies/government-allegedly- owes-authors-illustrators-and-journos-copyright-millions-20171119-gzob0u.html)

As to software, I don't believe any part of the Australian Govt has been sued for violation of open source copyright, and it is generally taken quite seriously at agencies like CSIRO. It has always been a big talking point for MSFT and big integrators as a reason not to use open source though.

</comment></comment></comment></comment><comment><USER16> I think this discussion is putting the cart before the horse. If there is no alternative to this app, what protections should it have? That's the second question to ask. The first one, which hardly anyone is asking, is whether the thing is necessary to start with.

There is one very strong reason to suspect Australians don't need this: the app has only been here 3 days, but the novel coronavirus has been around for 3 months, and it has never looked like getting out of control. Turns out that telephones and old-school contact tracing still work, and they work even better with some help from DNA manipulating virus detection robots. Who would have thunk it?

Plus, at this point, each app user has a 1 in a million chance of being exposed to the virus. Talk about number needed to treat!

Australia should focus on prisons, aged care facilities and concentration camps, where the risks are still meaningful. And we should rack our brains to imagine other ways that the virus could rapidly spread beyond our capacity to contain it. If things keep going right, we won't need this app. If something goes wrong, it will be an unexpected thing that the app can't fix.

</comment><comment><USER17> I've been running COVIDSafe on Android for most of today, Samsung's Battery monitor is showing 3% battery use by COVIDSafe after 6 hours. I guess that's about a 10-12% battery hit over a full day, but at least it's using less battery than Spotify or TuneIn or Pocket Casts when they were in use with the screen off. So we're not talking Pokemon Go levels of battery drain here.

It works fine in the background on Android. Much like the Pebble smartwatch app does for its Bluetooth connection, you get a permanent notification, and you have to disable battery saver to stop the app sleeping. But you can still use your phone for other things. Battery monitor regards the app as in "Active" use the whole time, not in "background" use.

<comment><USER18> The battery problem seems to be an Apple thing. iOS can shut the app down if it is in the background, and will do so if the battery is getting low. One solution is to keep it in the foreground - but that does chew power.

</comment></comment><comment><USER19> It was interesting to hear a lead story on the nightly news talking about data privacy issues related to where the data was stored, saying that the data would be stored on "American company Amazon's Servers".

No mention of Australian regions or GovCloud etc.

<comment><USER20> The ABC is reporting that the server must store data in Australia and the data cannot be transferred overseas.

<comment><USER21> Unless they've done some independent investigation, that's just federal government speak.

The feds have been at pains to present COVIDSafe as having stringent privacy safeguards, but they have such an appalling record that few will believe them without trustworthy independent scrutiny. I can't see how that can be possible until (at a bare minimum) the app's source code is released.

I really hope they do, and that they make any necessary improvements subsequently recommended. Contact tracing is a fantastic potential use of mobile technology. It would be a pity for it to be undermined by the usual impulse towards contemptuous patrician secrecy.

<comment><USER22> A "privacy impact assessment" was performed by an independent law firm, reviewed by an independent statutory authority responsible for privacy protection, and published before the app was released. [https://www.oaic.gov.au/updates/news-and-media/privacy- prote...](https://www.oaic.gov.au/updates/news-and-media/privacy-protections- in-covidsafe-contact-tracing-app/)

</comment></comment></comment></comment><comment><USER23> I saw this coming BUT I thought if they were clever they might get the code from the Singapore government (Who I think developed OpenTrace) direct?

You can release you code as GPL. But you can also release you code however, separately if you want.

Also it depends on OpenTrace's libraries and if it's been contributed to.

<comment><USER24> Uhm, no.

Once your code contains GPL code _that is not yours_ , it has to be GPL. Particularly in v3, where a number of loopholes were closed. You are free to attach further non-conflicting clauses to it, but the GPL of the original code must be respected. That's the entire point of the GPL.

Double-licensing requires you to have ownership of the entire codebase. At that point, you are licensing _everything_ , so you're free to pick any license that suits you.

<comment><USER25> You're agreeing with the OP. The point they were making was that the Australian government could've gotten the source code under an alternative license by asking the sole copyright holder (which I believe is either the Singaporean government, or a contractor of the Singaporean government).

But to be honest, as an Aussie I don't think our government is remotely competent enough to have considered the copyright license of the code they were using. There were initial reports they would provide the source code of the application, but these promises were quickly revoked for reasons of "national security" or some other such rubbish.

EDIT: I meant to say that it was a bullshit reason such as "national security", not that it was a direct quote. The actual reason they claimed was that it was easier to hack if the source code was public.

<comment><USER21> _but these promises were quickly revoked_

Were they? Where did you see that?

The Health Dept's response to the Privacy Impact Assessment's recommendation for release of the app's source code says as follows:

 _Agreed. The PIA and source code will be released subject to consultation with the Australian Signals Directorate's Australian Cyber Security Centre_

([https://www.health.gov.au/resources/publications/covidsafe-a...](https://www.health.gov.au/resources/publications/covidsafe- application-privacy-impact-assessment-agency-response))

Now that 'consultation' _might_ be a delaying tactic, but it's just as likely to be that the Dept. of Health has no idea of the implications of such release. It certainly doesn't suggest the revocation you claim.

<comment><USER25> I was basing it on the public statements of the Health Minister[1].

Now, it's very possible that they'll release it tomorrow and this whole discussion will have been a waste of time -- but at the time of writing the Minister for Government Services said unequivocally that they would release the source code[2] and later the Health Minister said they were "unsure it would be safe"[1], and finally when the app was released the source code was nowhere to be seen. To be fair, he was insistent that they would release it (despite being "unsure it would be safe").

But sure, I also wouldn't be surprised to discover that the whole process has been delayed by some other bureaucracy. After all, they probably see releasing the source code as a token gesture and not a form of review by the public.

[1]: [https://www.itnews.com.au/news/health-minister-now-unsure- if...](https://www.itnews.com.au/news/health-minister-now-unsure-if-source- code-for-covid-contact-tracing-app-is-safe-to-release-546981) [2]: [https://www.itnews.com.au/news/govt-to-release-source- code-o...](https://www.itnews.com.au/news/govt-to-release-source-code-of- forthcoming-covid-trace-app-546884)

</comment></comment></comment></comment></comment><comment><USER26> Would anybody be interested in setting up a bounty? I'm thinking first team to show a major break in privacy wins the pool. I'll put in $100, and I hope others do too.

Edit: to be explicit, I'm talking about REing the app locally, nothing server side

</comment><comment><USER27> It's called dual licensing.

The Au Gov got the code for TraceTogether (what OpenTrace, the open source implementation of BlueTrace is based on) weeks before the source was publicly released as GPL.

<comment><USER28> Not disputing, but do you have a link for when they got source?

Opentrace was open sourced 16 days ago [https://github.com/opentrace- community/opentrace-android](https://github.com/opentrace-community/opentrace- android)

<comment><USER27> Don't have a public source, sorry.

</comment></comment></comment><comment><USER29> In the Privacy Impact assessment that was released here [https://www.health.gov.au/sites/default/files/documents/2020...](https://www.health.gov.au/sites/default/files/documents/2020/04/covidsafe- application-privacy-impact-assessment-agency-response.pdf)

The government is planning to release the source code "subject to consultation with the Australian Signals Directorate's Australian Cyber Security Centre."

Take that for what you will. I suspect some people will take this to mean they won't be releasing the source, however at this point I think it's reasonable to believe it is still going through this process.

<comment><USER30> On national radio this morning they implied a belief in security-by-obscurity regarding things. I can't even. (I suspect the journalists mangled what the ASD said)

</comment></comment><comment><USER28> They said they would release source, but they've distributed the app first, so are in breach.

They also said location would not be used, but

      android.permission.ACCESS_FINE_LOCATION

Can't trust them on things that can be checked; therefore can't trust them on the things that that can't be checked.

<comment><USER20> Yes, I thought they said a few days ago that the source code will be made available for scrutiny but this now how its being reported:

"Some, if not all, of the app's source code will be made public."

<comment><USER31> Will Australians be able to build from source, install and connect to the central server (if any)? Or at least build and verify that what comes from the stores is what they built? If not, having the source code doesn't really matter much.

<comment><USER32> I think it would go a long way in establishing trust if they release the source code, even if you can't perfectly prove that the binaries are built from it. They would have to be outright lying if that wasn't the case.

</comment></comment></comment></comment><comment><USER33> The Australian government is not to be trusted, they (both parties) have been trying to take control of the internet for decades now, and even when they're not trying to do something nefarious, government IT projects have a long history of incompetence. Even recently (but before CV19) they've been drastically increasing the reach of the state to spy on people and force backdoors into software.

</comment><comment><USER34> > Remind them how little time they think before they download dozens of free, > adware crap games that are likely far worse for their data & privacy than > this ever would be!"

Not a convincing argument for anything.

</comment><comment><USER35> Does this randomize the Bluetooth address too? I saw the README (from the dissection) mention a function that hides the name "so the other side only gets the address", which would defeat the entire purpose of rotating identifiers.

If it does randomize the Bluetooth address, does it use a separate identifier, and if so, does it rotate both at the same time? Otherwise, you can use an identifier that changes at time 1 to link the other identifier with its new version when it changes at a different time.

<comment><USER18> It's OpenTrace [0]. OpenTrace is GPLv3, and is based on a published specification that's not too difficult understand. The fact that it _is_ dervived from OpenTrace and they haven't published the source is the whole basis of this story.

To answer your direct questions:

\- randomize Bluetooth addresses: I expect not, as that would screw any existing bluetooth connections, like headsets.

\- does it use a separate randomised identifier: yes.

On Android at least you would be foolish to trust it without a verifiable chain of trust from the source to the binary you are running. It has two things that matter greatly: your true name, and your precise location. There is nothing physically preventing them from uploading your whereabouts every 10 minutes to a server - so you have to trust the binary doesn't do that. Right now we only have their word [1]. Whether you care enough above the sort of information it could leak to need to trust it is a different question. But if you do care, you would be a fool to do so without a verifiable chain.

A verifiable chain of trust means:

\- source starts from a trusted origin. (It does: opentrace)

\- there is a cryptographically signed audit trail showing how they change it to get to its current state. (The original is in github, so that's possible).

\- they publish the source before deployment. (The two points above means someone inspecting the result only has to look at the changes, not the entire thing).

\- they use a reproducible build.

[0] [https://github.com/opentrace-community](https://github.com/opentrace- community)

[1] Right now I'm sure they are good for their word. Move on 24 months and if you still have it installed, then based on their past history I would not trust them as far as I could kick them.

<comment><USER35> The Apple/Google protocol does randomize:

> The advertiser address type shall be Random Non-resolvable.

> The advertiser address, RollingProximityIdentifier, and Associated Encrypted > Metadata shall be changed synchronously so that they cannot be linked.

(page 5, [https://covid19-static.cdn- apple.com/applications/covid19/cu...](https://covid19-static.cdn- apple.com/applications/covid19/current/static/contact- tracing/pdf/ExposureNotification-BluetoothSpecificationv1.1.pdf))

I assume you can use your "regular" Bluetooth address for any communication with paired devices (which is then just as trackable as it would be otherwise), while still using this at the same time for the BTLE announcements.

However, I suspect these APIs may not be available to non-OS applications.

<comment><USER18> You made me look, and my times have changed.

> I assume you can use your "regular" Bluetooth address for any communication > with paired devices

It turns out even that's not true. It's normal to use a different mac each time you connect to the same paired device: [https://www.lairdconnect.com/support/faqs/why-does-ble- mac-a...](https://www.lairdconnect.com/support/faqs/why-does-ble-mac-address- keep-changing-my-smartphone)

I don't know whether it multiple mac's in flight at the same time, but given the the effort they've put into it, it's entirely possible.

</comment></comment></comment></comment><comment><USER36> Are there concerns that unpatched Android devices could be vulnerable to the Bluetooth bug discovered in February this year?

[https://www.welivesecurity.com/2020/02/07/google-critical- an...](https://www.welivesecurity.com/2020/02/07/google-critical-android- bluetooth-flaw-attack/)

<comment><USER37> Exploit details were released a few days ago[1]. Some essential bits were removed, so not any script kiddie can use it, but it's only a matter of time before a full exploit available publicly.

As for how it relates to the app, I don't think it matters much. I'd imagine most people already have bluetooth enabled, so using this app or not won't change their vulnerability status.

[1] [https://insinuator.net/2020/04/cve-2020-0022-an- android-8-0-...](https://insinuator.net/2020/04/cve-2020-0022-an- android-8-0-9-0-bluetooth-zero-click-rce-bluefrag/)

</comment></comment><comment><USER30> I'd love to know where 15 minutes exposed came from. Feels like a value imputed from a join over battery drain and usefulness. I thought five minutes made more sense. If you are 15 min within 1.5m of a stranger in most Australian states you're probably mildly in beach of social distancing.

<comment><USER38> 15 minutes was part of the definition for a casual contact 2 months ago, a lot earlier than the app and the social distancing rules.

[https://www.health.gov.au/sites/default/files/documents/2020...](https://www.health.gov.au/sites/default/files/documents/2020/03/coronavirus- covid-19-information-for-casual-contacts-of-a-confirmed-case.pdf)

<comment><USER30> You will notice in that guidance that if you subsequently fall ill as a casual (sub 15 min) contact they will need to talk to you for contacts tracing..

So that implies there is a health risk burden under 15 which needs to incur costs of contact tracing at which time this app cannot help.

</comment></comment></comment><comment><USER39> I'm wondering how the application protects against people running malicious clients works? If the point of this app is to broadcast identifiable information into the public domain, what is stopping others from snooping this information and creating their own tracing DB?

<comment><USER40> Cool go ahead, you're only gonna get my device identifier, phone model, some encrypted temporary ID that identifies me for 15 minutes, which health agency the app is affiliated with (the same as the attacker given we are in range), etc.

Seriously my Facebook app and the underlying Android OS is sucking way more sensitive data than this is broadcasting. And only to the restricted physical range of Bluetooth.

And if you did happen to get my device identifier, TempId etc, you still have to map those to my personal identity. Decrypt my TempId and what do you get, my app UserId. Not even my phone number. Try harder.

My bigger concern is a malicious client that can exploit a weakness in mine by sending a specially crafted json payload and gaining remote code execution.

The data on its own is pretty worthless for location tracking. It needs enrichment or correlation with other data to be used for that purpose.

</comment></comment><comment><USER41> [https://docs.google.com/document/d/17GuApb1fG3Bn0_DVgDQgrtnd...](https://docs.google.com/document/d/17GuApb1fG3Bn0_DVgDQgrtnd_QO3foBl7NVb8vaWeKc/preview)

(preview link might be more useful).

</comment><comment><USER42> My biggest worry (apart from the fact that any Australian law enforcement agency or intelligence service could serve the department that released the app with a notice under the TOLA Act (AA bill) to add a backdoor, and they would be compelled to do it and then deny its existence), is that it probably just won't be extremely effective, but people will see it as a magic bullet out of lockdown.

There is a lot of pressure from the right wing and business lobbies to re-open everything, but the only reason that we have had such low numbers is because we locked down early and hard.

People are saying "Install the app so we can go back to normal quicker" already - this is dangerous. With commercial grade hardware and software not designed for this, we can't assume the app will be reliable all (or even most) of the time. The period of time somebody is infectious seems to be quite long. So using the app as an excuse to ease lockdown will not work and would probably just result in unrestrained community transmission. Especially as we are coming into winter, we really don't want a second wave!

</comment><comment><USER3> @Dang - there are a suspicious number of new users on this thread leaving positive comments about the about the Australian governments new surveillance app

<comment><USER43> Yes, don't think they were aware of news profile names being green for first <2 weeks. In this instance for the 5 hours they signed up to astroturf.

<comment><USER44> Please don't do this here. The site guidelines ask you not to: [https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)

</comment></comment></comment><comment><USER45> I would assume many GPL-licensed applications are GPL non-compliant. From a user's perspective, what are the most relevant problems when this is the case? (Excluding problems of philosophical nature that only free software geeks care about. No intention to be disrespectful; but the more practical the problems, the more likely it is that ordinary users can relate to them.)

<comment><USER13> These "problems of philosophical nature that only free software geeks care about" however, tend to quickly have very practical consequences, that many people care about, though. Only that many do not realize, that their problems would not have happened, if they had used free software. Most people are not even aware what free software means or that it exists.

So I would not mix the two issues of a problem being a real problem and people's lack of knowledge about the software licensing world or software in general. Just because people don't know what the actual root cause is, it does not mean, that the problem does not exist, or that the people will not care about consequences, that will affect them.

I will also say,that without idealism of many great people creating free software and little pockets of free society, we would not be, where we are today. A very general statement, I know, but I have no doubt in my mind, that the idea of making knowledge freely available and making sure it stays that way does help advance society in many areas.

<comment><USER45> It's hard to disagree with the statements you make in this comment, but this does not answer my question. To say "free software is important" is one thing; another thing is to say "if a GPL-licensed software includes a closed-source dependency, this is a news-breaking problem". Considering the deep dependency trees many applications have, I would assume incompatible licenses in an app or library, and yes--even closed source dependencies in GPL-licensed applications--is a problem that occurs rather frequently. I think there is a generic problem at the intersection of license management and dependency management. COVIDSafe is just an example of this, and given the prevalence of these issues, I think it is in itself not particularly newsworthy.

</comment></comment></comment><comment><USER46> In my opinion, GPL is just another flavor of proprietary software and they should stop calling it free software or even opensource. Something like "Copyleft shared source" would make more sense to what it really is.

[https://medium.com/@henvic/opensource-and-go-what- license-f6...](https://medium.com/@henvic/opensource-and-go-what- license-f6b36c201854)

<comment><USER47> As terms-of-art in the software world, 'Free software' and 'Open Source software' have clear accepted definitions. There's nothing wrong with being an advocate for 'copycenter' licences, but please don't muddy the waters.</comment></comment>


97% of Internet now full up - <AUTHOR> http://www.theregister.co.uk/2010/12/01/ipv4_countdown/ <comment><USER2> These articles are slightly misleading. The blocks have been assigned to _ISPs_ , not to _Users_. There is a still a modestly large (albeit shrinking) pool of IPv4 addresses available for end-user use. I still don't anticipate actual scarcity of IPv4 address space for another few years, though it sucks if you try to start an ISP in that time, as you likely wouldn't be abel to get any IPv4 address space allocated to you.

<comment><USER3> No, they have been assigned to RIRs, not ISPs.

The RIRs have their own pools that they can assign to new ISPs.

<comment><USER2> Yes, true, but last time I was involved it was getting pretty difficult for startup ISP's to get allocations. You pretty much had to get a temporary allocation from an existing provider until you got large enough to justify your own directly-allocated netblocks.

Anyway, I wasn't trying to get overly deep with my original post, just point out that in this case "fully allocated" is far from "no more available addresses".

</comment></comment></comment><comment><USER4> [http://www.iana.org/assignments/ipv4-address- space/ipv4-addr...](http://www.iana.org/assignments/ipv4-address- space/ipv4-address-space.xml)

How long before one of the companies sitting on "legacy class A" IP space sells them off? Are any of them doing this already?

<comment><USER5> Organisations who have been assigned /8s were almost uniformly assigned them very early in the internet's lifespan. That marks out those organisations as those with a vested interest in the internet-- that is, science and technology organisations. In the 15 years that have passed since then, there's an excellent chance that they'll have expanded to internally allocate or at least earmark all the IP space available to them.

Freeing up even half of the block would probably require a huge amount of internal reconfiguration and only buy the IPv4 internet another few weeks at most.

Of course, if it could turn some profit, that makes it more likely.

<comment><USER4> I'm mainly thinking of companies like Eli Lilly or Ford. How much of their public /8 space are they really using?

If/when the ipv4 crisis happens, yes, it should be worth their while to redo their networks to sell off a /8. Even with some of the tech companies with /8s like HP (who has two, since they own DEC) or Apple, it probably will (but not yet) make economic sense to sell.

</comment></comment></comment><comment><USER6> By way of NAT there is effectively unlimited IPv4 space. I predict IPv6 will continue its very slow pace of adoption for quite some time.

<comment><USER7> ISP-level NAT is a nightmare scenario for anything P2P; you can say goodbye to skype and bittorrent under "effectively unlimited" NAT'd IPv4.

<comment><USER8> This is happening already for much of the 3G internet (at least here in the UK).

Perhaps we'll end up with an internet-routable IPv4 address being a chargable extra from ISPs. That could be easier for them than rolling out IPv6, at least in the short term.

</comment></comment></comment><comment><USER9> Time for IPv6!

<comment><USER10> There's no place like ::1!

</comment></comment><comment><USER11> Idea for startup: create a market for reselling IP addresses? IPv4 Exchange :)

<comment><USER12> IP addresses are owned by IANA, not the user. They can't be sold.

<comment><USER2> Not to mention it's not easy to just randomly route specific IP addresses to specific locations. The IPs generally have to be part of a larger netblock, and associated with an ASN to enable border routers to figure out where to send stuff without requiring them to need 1TB of memory for routing tables...

</comment></comment></comment><comment><USER13> The new Y2K scare

</comment><comment><USER14> anyone know what the exact number of remaining IPs are in that 3%?</comment>


The Real Victims of Victimhood - <AUTHOR> http://www.nytimes.com/2015/12/27/opinion/sunday/the-real-victims-of-victimhood.html <comment><USER2> Robert Hughes produced some interesting and insightful work during his life.

I have recently been watching a documentary series he made on Modern Art in 1980, _The Shock of the New_. It has aged very well.

[https://en.wikipedia.org/wiki/The_Shock_of_the_New](https://en.wikipedia.org/wiki/The_Shock_of_the_New)</comment>


Jeff Bezos wants to save Earth by moving industry to space - <AUTHOR> https://www.fastcompany.com/90347364/jeff-bezos-wants-to-save-earth-by-moving-industry-to-space <comment><USER2> Are we supposed to take this seriously? I mean, a nerd inside me wants to cheer this - sure, let's go colonize solar system. But as a realist looking at the ticking clock of looming environmental catastrophe - can we have a more realistic plan to "save Earth" please?

</comment><comment><USER3> This is typical transhumanist nonsense, redolent of billionaires who are totally disconnected from the reality of regular people on this planet.

The last cost estimate I saw for sending something to the moon was on the order of $50K _per kilogram._ Assuming people could go to the moon[0], that means _water_ would cost $50K per kilo, _food_ would have this cost, etc. The economics of people residing on the moon are beyond comprehension. Creating a "lunar lander" (and supposedly getting government funds for doing so) isn't going to fix that.

[0] I'm not convinced we can make this assumption. The Van Allen radiation belts could nuke everyone who makes the journey and NASA hasn't explained how we would shield people from that.</comment>


New Microsoft Scroogled Ad Reveals How Google Is Corrupting Kids At School - Suraj-Sun http://microsoft-news.com/new-microsoft-scroogled-ad-reveals-how-google-is-corrupting-kids-at-school/

<comment><AUTHOR> That has seriously got to be one of the worst commercials I have ever seen.

I highly doubt teenagers actually pay attention to google ads.</comment>