Google launches Uber rival RideWith - <AUTHOR> http://americans.org/2015/07/06/google-launches-uber-rival-ridewith/ <comment><USER2> > Drivers will only be able to make two trips per day, and the software will > ensure they only travel from their home neighborhoods to their workplaces.

> There also won't be a ton of money changing hands as a passenger will pay > the driver only a nominal fare for the trip

I'd hardly call it a Uber rival

<comment><USER3> UBER plans to attack the "drive to work" segment of the transportation market, and it's potentially a huge opportunity for UBER.This Google service, if successful, might fill that role very well.

And the fact that it's cheaper is basically "disruption from below" \- a proven strategy in many businesses. While this exact transport service model generally failed , it did succeed in France(blabla car), and Google has unique marketing advantages that might make it succeed elsewhere.

Also, the main competitive barrier for UBER is that many consumers have the habit of ordering transportation through it's app. If Google gets that , the rest is relatively easy.

<comment><USER4> Just FYI, it's Uber, not UBER. It's not an acronym.

<comment><USER5> [https://www.uber.com/](https://www.uber.com/) take a look at that-there all- caps branding. It's pretty prominent in the app, too. (At least for UBER as an overall brand - uberX and the like are gladly lowercased.)

Though they do use lowercase in some minor text. Still easy enough to make the mistake, though.

<comment><USER6> That's just the logo. Looking at their legal documents is just Uber Technologies Inc.

[http://newsroom.uber.com/wp- content/uploads/2015/04/FormRule...](http://newsroom.uber.com/wp- content/uploads/2015/04/FormRules.pdf)

</comment></comment></comment></comment></comment><comment><USER7> The title is misleading. RideWith isn't a direct Uber rival, as it's a feature of the Waze app matching people doing similar trips on a regular basis. It is therefore closer to ride sharing/carpooling than to private transportation.

<comment><USER8> So it's ride-sharing instead of a cab company?

<comment><USER9> A lot closer to carpooling, since the driver is trying to get to roughly the same destination as well.

</comment></comment></comment><comment><USER10> Note: We have built a marketplace to connect drivers and passengers, so we understand some of the challenges in scaling a business like this.

Like all marketplaces, you are faced with the chicken and egg problem. The market place is supply constrained. There is demand for rides but not enough matching supply. People with cars much prefer to travel alone due the inconvenience of picking up others.

So, in order to get the drivers you need to give them a VERY convenient option. Someone that is along their route, that would not add more than 5-10 mins of extra commute time, this is also dependent on how long the total commute is. You also need to reach these drivers, without them searching for a solution. Which is insanely expensive since the cheap acquisition strategies do not work.

The best way to solve this IMHO is seeding the market with drivers (supply side). Once you have the scale to guarantee a ride in a specific area you open up ride-sharing.

* Uber is doing this by incentivizing drivers who want to make a profit.

* Google is uniquely positioned to do this as well, since they have the treasure trove of Wayze data

<comment><USER11> Google knows where every Android user and most of everyone else lives and works.

Frankly it would be trivial to ask Android users a question: "Are you interested in carpooling? [Y/N]" and then prompt them when the guy three doors down also answers yes.

<comment><USER12> We both know they'd be (rightly) yelled at by all of us if they did that.

Waze, fine. By using the app, you agree they might monetize it, or whatever. But pushing ads to stock android is a huge no-no.

<comment><USER13> Eh, but it would work inside Google Maps/Waze. Some people I know use Google Maps or Waze every day, despite knowing what the best way to get to work is. This means Google likely already has the "driver" supply, and just needs to find a good way to provide those drivers with appropriate passengers.

So when someone first opens Waze/GM, you could put up a notification: "Dakota Doe <picture, rating> is 2 minutes away and is also trying to go to X. Would you like to carpool them?" People who say yes get pushed it more and more often, people who say no get a screen the next time they open the app expounding on the benefits of carpooling.

</comment></comment></comment></comment><comment><USER14> This article in Haaretz has a lot more information, including pricing and details about how rides are set up in advance, typically the night before.

"Google's Waze to launch worldwide carpooling pilot in Israel"

[http://www.haaretz.com/business/1.664577](http://www.haaretz.com/business/1.664577)

</comment><comment><USER15> Sometimes when I read about Google dipping their hands into totally new things (another example is Google +) I think, "those greedy ...", etc., but then sometimes I read it and think, "perhaps Google is simply trying to prevent monopolies in tech fields where competition is sparse.".

If the latter possibility is sometimes the true motive, even if it is done out of self interest, the result tends to be good for all of us (except for the monopolists themselves), because Google doesn't tend to be able to maintain a monopoly in any techs other than search and advertising.

One example of the benefits of this kind of competition is the advent of larger iPhones. If not for Google's Android and subsequent proliferation of large-sized phones that evolved out of customer demand, Apple might have ignored (or not been nearly as aware of) the demand for a larger iPhone.

</comment><comment><USER16> Forgive if I am misunderstanding, but Google Ventures invested in Uber, not Google itself. Wouldn't this statement from the article be half incorrect: "This puts Google squarely in competition with Uber, which is both an investment and customer of its Google Maps product."

1\. [https://www.gv.com/about](https://www.gv.com/about) 2\. [https://www.crunchbase.com/organization/uber/funding- rounds](https://www.crunchbase.com/organization/uber/funding-rounds)

<comment><USER17> You are, of course, correct, but is that a distinction that matters?

<comment><USER18> I think it definitely does. Google Ventures has expressed in the past that their investments are not tied to any business plans of Google and function entirely separately.

<comment><USER19> If you believe that I have a bridge you can invest in!

They clearly invested in Uber because Google wanted to buy them and clearly Uber has said no. So plan B.

</comment></comment></comment></comment><comment><USER20> Is it me or is Google doing the Microsoft "Me too!" with all these things they're trying and then closing down a few months later?

<comment><USER21> Unlike Microsoft, who had the will and executive ability to expand to new territories and destroy competitors, Google has a remarkable record of half- baked works and giving up. it's a joke.

<comment><USER22> There is a very serious benefit to recognizing a losing hand and folding before you're in too deep. You see a weakness in Google's execution, and I'd agree in some places, but there is some wisdom in closing up failed experiments rather than doubling down as Microsoft has done with several of their investments in the past.

<comment><USER21> I have zero problem with the fail-fast, fail-earlier strategy and attitude. ultimately it's business. there is no point to continue if it's obviously not going to work. there is a catch though: do fail because of innovation (crazy, big ideas). I'd argue all these experiments, except gmail/map/wave, have 0 substance. most of them are crappy implemented, poor planed cat projects.

</comment></comment></comment></comment><comment><USER23> I had no idea Waze was acquired by google. I wish they would just combine the best of waze with the best of google maps into one app that just works.

<comment><USER24> Most "Wazers" actually do not want the Waze brand or its app to be diluted.

<comment><USER4> Most people don't want anything they like to be diluted or changed. People on HN don't want people from Reddit. People from Reddit don't want people from Facebook. People from Facebook don't want their parents. People in a gated community don't want poor people moving into their neighborhood. People in the city don't want rich folks moving in and gentrifying their block.

People, in general, are xenophobic and like their culture to stay small and untainted. Eternal September happens everywhere. It doesn't mean that Google has to keep two separate mapping applications running. Waze didn't stop to think about their community when they sold the application to Google.

<comment><USER25> "People, in general, are xenophobic and like their culture to stay small and untainted."

The problem is that when anybody and everyone comes into the community and you don't have some sort of filter, it turns to shit.

<comment><USER26> well it certainly changes. presupposing that change to be "shit" is of course bigotry.

</comment></comment></comment></comment></comment><comment><USER17> The premise behind uber's valuation is that they could own the marketplace for transportation. But what if the market is not monopolizable? If users (drivers and riders) can costlessly participate in multiple transportation markets, then it's impossible to form a monopoly. Users will just frictionlessly move to the cheapest market. I operate in multiple of these markets (check all of the apps before committing to a ride) and I know that many drivers do too (lyft on this phone, uber on that phone, etc). So shouldn't this monopoly unravel to the point that all of the transportation markets aren't able to capture any value from the transaction?

<comment><USER27> Uber's valuation is also based on the perception that Uber can outgun the competition technologically and in global expansion. Uber might face more or less frictionless competition from regional rivals, like Lyft, but will have some durable advantages.

Google is a different kind of competitor.

</comment></comment><comment><USER28> It heard that the branding team ruled out using "Google Hitchhiker".

What's the difference? Google's/Uber's/Lyft's imprimatur that your passenger is trustworthy? More surety of payment? If I want to take the risk, why won't cities let me give hitchhiker's rides for cash (or even credit card payments)?

<comment><USER13> In the US, especially among people of politically-influential age, hitchhiking has a fairly negative connotation. In most US states, hitchhiking is at least restricted, and sometimes entirely illegal. There was a long period in the 80's where hitchhikers were portrayed as criminal, untrustworthy and those who would pick them up were likely to want to hurt them.

Carpooling, on the other hand, is highly encouraged, even to the point where local governments create special infrastructure to encourage people to do it. Are hitchhiking and carpooling two sides of the same coin? Yeah, probably. Should we be more encouraging of hitchhikers? Again, I think so. But if you have a positive message "Look at all the cars we're taking off the road! We're helping people meet others in similar situations, who all want to commute together!" it sets you up for a very different interaction with the public and with governments than "Hey, wouldn't it be great if we could get people to hitchhike more?"

</comment></comment><comment><USER29> Fix what you have, Google.

Every time you launch into something else, like this, I become a bit more convinced that commentators are right and you are slowly turning into Microsoft.

I get the sense that, internally, things are still significantly different than they are or ever were at Microsoft. But I become increasingly concerned about some encroaching "inevitable".

De-fuck Hangouts and your rats nest of "instant" products/services. Beat Verizon over the head until they actually update the Moto X that, at the time of purchase, _you_ sold me. Stop launching the "next great thing" only to kill it 18 months later, over and over.

And as some have said, um, search? Give at least optional specific control back to the power users. And someone the other day raised the pertinent question of why it's not well-integrated into Hangouts.

I suppose RideWith is supposed to eventually overlap with your autonomous cars, or something. But I don't give a crap about the new, until the old and erstwhile reliable -- and so critical to so many -- starts working better, again.

Thanks.

P.S. Ok, that last paragraph is partially rhetoric. But, damnit, if I'm going to invest in your products -- in both dollars and time and effort -- I want some consistency, and an upward trend in features and usability. (See also Tim O'Reilly's recent comments about the -- cough -- "improved" interface in Contacts. (Pop-ups and clipped text -- really?))

</comment><comment><USER30> My prediction number 5 :)

5\. New functionality - e.g. If you're going somewhere while using Google Maps for navigation and turn on "Carpool" mode, people can see your path and message you for a pick up. They pay you for partial journey via the app.

[http://www.quora.com/How-will-Google-monetize-Google- Maps](http://www.quora.com/How-will-Google-monetize-Google-Maps)

<comment><USER31> I still want the ability to add a destination en route to another destination, e.g. "Ooh, I need to find [cheap] gas on the way to my next errand". It'd also be nice to be able to plan out e.g. "I need to go 4 places, figure out when they all close and what the optimal route is between them all". These are currently very manual and pretty tedious.

<comment><USER32> I wish one of these traffic apps had "race mode." The traffic data is mostly worthless because it's not real-time, and even when it does give a good route it's hard to confirm it after arrival. Instead it would be cool to compare my route to an alternate traversed by another app user who left the origin around the same time.

</comment></comment></comment><comment><USER33> When google announced Uber integration in their maps, I called it a trojan horse [1] Basically making maps the interface for ride sharing and then adding their own service on top.

[1] [https://news.ycombinator.com/item?id=7705706](https://news.ycombinator.com/item?id=7705706)

<comment><USER9> I'd assumed that integration was more about learning Uber's fleet size at different times, how long people are willing to wait for a car, what locations they request from, etc.

<comment><USER3> I'm sure UBER injects noise into their map requests, and since many drivers use an iPhone , It's hard for Google to filter that noise.

</comment></comment></comment><comment><USER34> That seems like a very good idea, not as a huge business, but to save energy, wear and tear of cars, etc.

<comment><USER35> I think the barrier to this sort of behavior being more common in the masses is that it's difficult to make these sort of connections.

If Google is basically able to say hey - your neighbor down the block drives to within a 5 minute walk of your office, then this could be a really useful tool for this sort of networking.

<comment><USER36> This seems like a clever way to nudge users in the general direction of self- driving cars as a service for local public transport.

</comment></comment></comment><comment><USER37> Does this mean we can look forward to fleets of self-driving cars roaming the streets and waiting for someone to hail them with Google's app?

Or maybe your personal self-driving car will inform you that there are people travelling your route that you can share fuel costs with.

<comment><USER22> Both, or at least I hope so.

The benefits of driver-less vehicles in terms of accidents and fatalities aside, consider for a moment just how under utilized the current transportation capacity is in this country. On average, even at peak drive times, what percentage of vehicles are actually being used? Just look down your street or at any parking lot you pass on your way into the office.

In order to get the convenience of not having to call a taxi which could then require a long wait every time we need to go somewhere, we take out loans for tens of thousands of dollars to own a vehicle that is all ours. We then pay to maintain the multi-ton machine, build custom paths and storage buildings on our homes just to store them, and everywhere we go large swatches of land are set aside just to give us temporary storage for our vehicles since we can't reasonably visit any location without this machine in tow.

In a reality where we must own a vehicle in order to move around quickly and easily, all of these things make perfect sense and are just a part of our lives so much so that we don't even think about them most of the time. This one "little" change can completely transform it all.

</comment></comment><comment><USER28> One big advantage of Google's solution over Uber's is the relative climate change impact of your transportation choice. In reverse order of benefit, based on my amatuer analysis:

* For a baseline, let's use one party (generally a person or a couple) with a personal car. Traveling someplace creates P marginal greenhouse gasses (GHG), plus there is the fixed cost of manufacturing the car (but I have no idea how much that is).

* Uber and taxis net GHG emissions should be worst and greater than P: Your trip uses P but added to that is the GHG generated when the taxi/Uber car has no passenger and is 'cruising'. Also, I expect taxis/Uber cars are larger on average than personal cars, and thus less fuel efficient, because they need to fit several adults comfortably in the back. If you give up a personal car for Uber/taxis, then you get the manufacturing benefit.

* Car share services (e.g., ZipCar) should net less than P emissions, if you give up a personal car when you join. The car is parked when nobody is driving it, so the marginal cost of one trip is P. But it also eliminates the emissions created from manufacturing the car, whatever that is. EDIT: As hayksaakian points out below, this is the same as buying a used car.

* Google's RideWidth's net GHG emissions should be much less than P: For every added passenger, one less car is on the road emitting P.

* Public transit probably is second best. The marginal GHG emissions of the bus/train carrying your fat a-- on its normal route probably don't amount to much. On the other hand, it probably depends on the average passenger load of the vehicle -- certainly a train/bus with only you on it costs much more per passenger than P, but those fixed costs are spread over many more passengers than Uber/taxis.

* Best of all, of course, are biking or walking. Though has anyone calculated the GHG emissions of the human energy cycle, from growing the cattle feed to transport to refrigeration to cooking to human methane emissions?

Also not calculated are the effect your use of one service or another has on demand, driving up the number of Uber/taxi/busses, etc. on the road.

<comment><USER38> the ZipCar difference is the same as buying a used car that's already been manufactured and counted towards another person's P value

</comment></comment><comment><USER39> Carpooling has fundamental challenges that are perhaps impossible to overcome.

For one, dynamic routing for two or more people is always going to hurt the user experience. Imagine you're running late and your car re-routes to pick up another passenger - ugh!

Shared transportation for anything more than a neighbourhood trip should be professionally driven and to a schedule. That schedule can be dynamic as anything but must be solid and offer guarantees BEFORE the trip starts as to start point, route, etc.

Basically a very smart and discoverable bus.

<comment><USER40> In Germany, carpooling has been a mainstream thing since the mid-90ies or perhaps even earlier. The majority of trips are long-distance, i.e across- country. You are right that carpooling has has some shortcomings but it's so ridiculously cheap that many people happily accept those shortcomings. I used it many times when I was a student and 90% of the trips went as planned.

</comment></comment><comment><USER41> Correct me , I don't find it as a Uber rival . I think they are trying to promote car pool which is much needed here in India , only problem I see is security of passsengers

</comment><comment><USER42> Doesn't sound like a play against Uber -- seems more like a companion concept to self-driving cars, which would naturally be good candidates for commuter ride-sharing.

</comment><comment><USER43> Interesting how they limit the drivers.

I assume this is from the driver-as-employee lawsuits Uber is facing and Google wants to be safe.

</comment><comment><USER44> This sounds more like Lyft's "Line" service which connects driver and passengers going the same way on regular trips. I'm not familiar with Uber's offerings though so maybe they have a similar service?

<comment><USER45> Lyft Line and UberPool match 2 passengers going roughly in the same direction, and put them in the same ride-for-hire vehicle. The driver's preferences have no bearing. :)

</comment></comment><comment><USER46> Is it just me or does that page have an annoying ad network which AUTOMATICALLY redirects your mobile browser to the app store? I've seen a proliferation of these now.

</comment><comment><USER47> This isn't Google creating am uber rival, it is quelling competition for the rideshare services that exist for co-commuting.

</comment><comment><USER48> This is a first step into google's next big play:

Self Driving Cars/Taxis/Carpools that are subsidized by Google's ad business.

</comment><comment><USER49> Who takes an Uber to work?

<comment><USER14> UberPool in SF is currently $7 each way within city limits and my wife takes it to/from work frequently.

Compared to us buying a second car, this is incredibly cost-effective, and would be worth it at 3x the price. (Monthly cost of ownership of a used car in SF would be ~$1000/mo including parking spaces at work and home).

The only other cost-competitive option is MUNI, which is $2.25 each way (or less if you commit to a monthly pass, and/or pay using before-tax income). She does use MUNI occasionally, but there are no direct routes serving her commute, and it is often unreliable at commute times.

Ridesharing for commuters is not always some absurd luxury--it can be an economically sensible luxury :)

</comment></comment><comment><USER50> Could be just a very limited service for a narrow use case. Google may want to better know which techie in Israel goes where. Say, for the purposes of optimising hiring, investment, product development, security ...

</comment><comment><USER51> Even if this isn't quite an uber rival, this is ultimately Uber's problem. All they are is an app with some marketing, and anyone with a bit of money can easily come up with a competing app.

<comment><USER52> >All they are is an app with some marketing, and anyone with a bit of money can easily come up with a competing app.

I think I'll let your first statement stand, but in regards to the second. Uber has raised $5.9bn dollars, is doing ~2m rides per day, is in 300+ cities -- sure you can create a competing app, but the chances of meaningfulness are small if non existent.

<comment><USER53> The difference is that carpooling is legal. What Uber and Lyft are doing is not in most markets.

<comment><USER52> What relevance does this have to the parent, or my, comment?

<comment><USER53> The relevance is that a $5.9b valuation is dubious when it's based on an illegal enterprise. That "value" can disappear in an instant when municipalities start cracking down.

</comment></comment></comment></comment></comment><comment><USER54> Do you really think that Google snoops into paying customers map data?

Why in the world would uber just give it away? No, no, why would they pay to give it away?

Even as a 5% investor, do they have such intimate data access?

<comment><USER55> It is interesting, but they did just buy Microsoft's map division [http://www.theverge.com/2015/6/29/8863687/uber-acquires- mapp...](http://www.theverge.com/2015/6/29/8863687/uber-acquires-mapping-data- tech-and-talent-from-microsoft-bing)

</comment></comment><comment><USER56> Self-driving taxi's would be awesome.

</comment><comment><USER57> Uber should have filed for IPO.

</comment><comment><USER58> Dumb question: how is this Google's core business?

<comment><USER59> If sharing a ride with someone frees up my attention to use my smartphone instead of watching the road, google can make more money advertising to me during that time.

<comment><USER58> Yeah, and if Google covered by medical bills I might live a few more years :-)

<comment><USER59> [http://www.calicolabs.com/](http://www.calicolabs.com/)

I think they agree.

</comment></comment></comment></comment><comment><USER60> Speaking of unfair competition.

<comment><USER52> How so?

<comment><USER60> Google: Company that is using its power established in one market to gain control of another market.

Uber: Entering a market with disregard of rules established for that market.

<comment><USER52> Interesting, how would you define 'unfair competition' and 'fair competition'? In a general sense.

<comment><USER3> amelius's answer is what the law sees as "unfair competition", altough often it's hard to sue i think(IANAL).

</comment></comment></comment></comment></comment><comment><USER61> Who's going to trust this? Google is so quick to terminate technologies that I'm hesitant to try anything new that they bring to market.

<comment><USER62> May I ask why you need to trust this from that standpoint? With other Google services I agree with the concern. In this case, if they discontinued, you revert to your old way of commuting. I don't imagine anyone doing anything stupid like selling their car over this.

It's like Shopping Express for me. Was AMAZING while it was free and I used it every week. Now I don't because the fee is in place. Since Amazon pantry is not a good fit for my needs either, I just do things like in ancient times and pick things up at the grocery store while I'm out running errands and spend a few more minutes.

<comment><USER61> I didn't flesh out my thought process but I'm thinking that there has to be some real reason to go with this over Uber or Lyft.

Obviously, no one should restructure their life around the availability of this kind of service. I'm just saying that this feels like bandwagoning to me. I can't be the only one thinking that this isn't going to last long. Uber and Lyft will be in that business until they close up shop or are regulated out of a market.

If you're going to try a non-traditional taxi-type service, why go with Google over one of the existing players?

<comment><USER62> Hard to say at this point given that this hasn't launched yet. I'll need to see what it looks like when it does its pilot in Israel.

Google's long-term play has a decent chance of involving self-driving cars and monetizing via advertising and data with some fee from the ride. Nothing says "open up your wallets" to large brick and mortar advertisers like "we _literally_ drove the customer to your doorstep."

Getting users hooked and getting this tested via commute data is a great approach before branching out to something else. It also lets users browse the web, and Google likely has clear visibility into the search behavior of users searching while in their rides to determine the incremental ad revenue this enabled.

Google doesn't need to offer this for free to provide a great experience at a lower price than any current competitors like Uber or Lyft. They have substantial revenue from other areas to fuel this and so can price their competition out of the market. Other companies do the same thing to squeeze into a dominant position in a market they want to enter.</comment></comment></comment></comment>


Hollywood DP finally said it: "Film is over" - <AUTHOR> http://www.alexandrosmaragos.com/2012/04/phedon-papamichael-interview.html

<comment><USER3> You'll be surprised that the film process is still cheaper in some scenarios. Special effects, for instance - anywhere you have to pull a matte (i.e separate the foreground from a green screen), the film telecine can be tweaked to convenience, whereas most CCDs will still give you a choppy result - <USER2> many reasons; Color compression schemes being one, the shape of the ccd cells being another. That means more days compositing and/or revisiting a film set, and in complex shots this actually means breaking up a frame to many individually shot bits, which may mean more shooting days in the first place, and a far higher complexity (just imagine how many angle coordinations one would have to make in order to match 5 parts of the same shot).

It's not that we're not getting there, but there's still a mile or two to tread.

<comment><USER4> Gamer, while an uninspired movie, was shot fully digital on RED and had a large number of green-screen shots. Even using beta firmware the results are impressive.

The compositing software you can get today does an amazing job of adding and subtracting elements. Maybe you mean film is cheaper because it doesn't mess with your existing work-flow and you don't have to re-tune your tools.

<comment><USER3> Actually, I mean film is cheaper because under highly complicated circumstances, the standard workflow is less risky. I'm not saying that it's cheaper in principle, or that there for a given situation there isn't a specific solution that's better; But when workflow is everything, it definitely is. It's much cheaper having to spend an hour on lighting, not worry about motion control and ask for 3 different setups in the telecine pull list, to have enough dynamic range to fit everything into the shot.

With RED, even though results are very good (they are, however, short of amazing: it's terribly noisy, but then again so is underexposed film), the dynamic range is lower (and the dynamic density is uniform, which isn't that good), so keying becomes an issue, and so do CCD artefacts - even more so when renting 422 equipment. The complexity/risk isn't necessarily prohibitive, but definitely less lucrative. That's why I say 'cheaper', not 'better'.

On the compositing side, software has been great for quite some time. I'm aware of only a handful of truly novel keying algorithms published in the past 6 years, and none that can deal with digital artefacts very well (if you know of any, _please_ tell me. Better yet, tell someone who works for The Foundry or Autodesk. Much appreciated. x), that's why so many commercials are still shot on 35mm instead of digital.

<comment><USER4> Based on what RED is doing, the solution to a lot of these problems is to keep bumping the resolution so the impact of artifacts is minimized.

IMAX, long the king of film, might find itself knocked out by a digital alternative. If 28K isn't good enough, then 50K? 100K? Film isn't getting any better, there's too many limitations, but digital film technology is still advancing.

Someone's probably going to invent a "de-artifacting" algorithm that works well enough that in practice nobody can see the difference. There's a lot of Ph.D. students out there in need of a thesis topic, after all.

</comment></comment></comment></comment><comment><USER5> It's inevitable and unsurprising.

I do hope that it remains feasible to shoot on film for those that want to. It's a fun medium to work in, and there's a romanticism about shooting on film that I think is lost in using digital cameras.

About ten years ago, a musician acquaintance and I were discussing the decline of vinyl. His argument in favour of this archaic technology was passionate. He dispensed with technical arguments, which are generally just not very good, but opened my eyes to a very different argument that I respected: that there is an unbroken physical lineage between the artist and the listener, from the session microphone to the tape to the masters to the copies to the stylus of your turntable.

I have a similar affection for film, even if all editing is done through DIs nowadays, and even though I've been rooting for digital film-making ever since "The Last Broadcast".

</comment><comment><USER6> The most interesting part is at the end. Online film school by Papa, Pfister & Kaminski? Three of the best. This is big.

</comment><comment><USER7> The irony is that editors and colorists spend extra time and effort degrading digital footage to make it look like film.

<comment><USER4> Just as before they spent extra time to clean up the film. It's nothing new. You're always trying to push it in a direction that's slightly different from where you start.

</comment></comment><comment><USER8> The biggest hollywood guys including Kaminski david fincher and darren aronofsky all just use real grain scans like Cinegrain or Indie Scans.

</comment><comment><USER9> Hollywood Director of Photography</comment>


Convert your KiCAD boards into nice looking 2D pinout diagrams - <AUTHOR> https://github.com/yaqwsx/PcbDraw <comment><USER2> How is this different from KiCAD 3D view, as seen from the top or the bottom?</comment>


iframe causes a BSoD on win 7 x64 via Safari - <AUTHOR> https://twitter.com/#!/w3bd3vil/status/148454992989261824 <iframe height='18082563'></iframe> causes a BSoD on win 7 x64 via Safari <comment><USER2> It's an exploitable vulnerability. I'd recommend not try that on a production system.

<http://secunia.com/advisories/47237/>

<comment><AUTHOR> Discovered by webDEViL from india..

</comment></comment><comment><USER3> this does work as just tried it :)</comment>


Show HN: ZoneWatcher – A service to help monitor and backup DNS record changes - <AUTHOR> https://zonewatcher.com/ <comment><AUTHOR> Creator of ZW here: I'm happy to answer any questions!

I created ZoneWatcher because at work we manage a ton of DNS zones for clients and it became a chore to backup & monitor all of those zones across many providers. This was especially troublesome when a client / contractor would edit a dns entry and screw it up without a backup.

With ZW this isn't a problem anymore as you'll have a complete changelog of everything :)

</comment><comment><USER2> This sounds like a great tool!

Do you have plans to integrate with other providers? I work for a web development agency that helps manage hundreds of sites records, but from a variety of registrars.

The product looks very useful!

<comment><AUTHOR> Yeah I'll try to integrate with anyone who has an API! Any specific providers you have in mind?

<comment><USER2> I am not sure if they have an API or not, but we see a lot of clients that use network solutions, as well as namecheap.

So you are pulling data directly via API, not from just a basic DNS lookup of the domain name. That is a very cool idea!

<comment><AUTHOR> Looks like Namecheap has an xml api that I may be able to work with. I'll look into that.

Unfortunately Network Solutions doesn't have one for DNS as far as I could see.</comment></comment></comment></comment>


Why you should pre-launch your startup idea - <AUTHOR> http://www.bogdannedelcu.com/why-you-should-pre-launch-your-startup-idea.html

<comment><USER2> I'm trying to force myself to do this instead of always jumping straight to hacking a prototype together, but I always hit the same roadblock: domain names. The whole point of doing early validation is to avoid wasting too much time on an idea without legs, and yet the domain feels like such an important part that I feel I need to find a "proper" one. But I hate looking for domains, so I tend to just go back to hacking instead...

Anyone else have this problem? Do you spend a few days just looking for a decent domain? Or just decide it doesn't really matter and go with a throwaway you can change later?

<comment><USER3> I always go with a throwaway that I can change later. I actually just recently changed the name for an app I'm building and, turns out, the new one is 100X better!

</comment></comment><comment><USER4> You can utilize Mechanical Turk to gain valuable insight into your startup idea.

If you have a small prototype in Rails, consider using my gem Turkee ( [https://www.github.com/aantix/turkee](https://www.github.com/aantix/turkee) ). There's a couple of helper methods that make doing usability surveys with Rails and Mechanical Turk drop dead easy.

</comment><comment><USER3> Great post. As someone that is getting closer to the finish line of developing my first Rails app, I can definitely relate to this post. I'm definitely going to take the advice in the article and run with it.

</comment><comment><USER5> Internal Server Error

<comment><USER6> The headline and the error are pretty priceless together. Not sure if this is performance art (I suspect not) but the message that you're going to have to deal with sudden bursts of traffic is a good one to learn earlier rather than later.</comment></comment>


How is NSA breaking so much crypto? (2015) - <AUTHOR> https://freedom-to-tinker.com/2015/10/14/how-is-nsa-breaking-so-much-crypto/ <comment><USER2> To summarise: the authors speculate that the NSA invested in a lot of resources into breaking Diffie-Hellman key exchange for certain 1024-bit primes. Just a few hardcoded 1024-bit primes were used in the majority of VPN handshakes and a significant minority of HTTPS and SSH handshakes worldwide in 2015. This would give the NSA the ability to recover the shared symmetric key used in these encrypted communications, and therefore decrypt them.

Since then several protocols have shifted towards preferring Elliptic Curve Diffie-Hellman key exchange which doesn't suffer from the same attack, or at least using larger primes for plain DHKE (1536-bit and above). However I don't know the extent of this - a lot of VPNs at least are still using the old, weak DH keys.

<comment><USER3> Bingo. Garbage primes that were either pushed by NIST to vendors or bribed to be included as default. The absolute arrogance of the authors in the Snowden papers in detailing the leak was probably the most powerful driver of things like dh parameters that roll every few days, and ed25519 that flat out rejected the nsa premise that primes were at all trustworthy

Fast forward to today, and devs/cryptographers absolutely threw the nsa and cia out on their asses for their SPECK kernel argument hinging on the seemingly ironclad credibility of "it's classified."

Corporate players will still sneak backdoors;it's what they do. But the real blow to the intelligence community is the loss of default trust and the active denial by the open source community.

<comment><USER4> My understanding is that it wasn't that the primes were bad but that they were hard coded, never changed, and the bit size was small enough to make attacks based on that practical.

I'm on the fence about speck. It's so simple that there isn't much room in there for a back door, meaning that if there is one it implies that the NSA knows something we don't about ARX ciphers.

If the NSA knows something we dont about ARX, then could they also know something about ChaCha?

<comment><USER5> Rotating DH groups periodically is difficult. SSHv2, for example, has support for this. It takes a lot of computation to generate new groups, but then how do the client and server agree on a group? Well, the server tells the client, and the client has to like it -- i.e., the client has to trust the server's group. This isn't better than just having a bigger nothing-up-my-sleeves group to begin with.

That, ultimately, has been the solution the community landed at: nothing-up- my-sleeve curves for ECDH and EdDSA.

The nothing-up-my-sleeve part is all about setting / agreeing to obvious and hard guidelines for generating and selecting curves _before_ doing the selection, then you can see that a curve was generated and selected without any hidden agendas. We have several of these now that are generally thought to be secure, though, of course, it's hard to say for sure. It's a pretty good outcome.

<comment><USER6> Ephemeral ECDH over 25519 solves all of these issues. How is it not standard.

<comment><USER5> Did I say it doesn't? Read carefully.

<comment><USER6> Lol

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> Huge discussions from earlier submissions:

[https://news.ycombinator.com/item?id=10390822](https://news.ycombinator.com/item?id=10390822)

[https://news.ycombinator.com/item?id=13198567](https://news.ycombinator.com/item?id=13198567)

There's probably a lot of information in those discussions, but you can't comment there, so if you have anything to add, this is the place.

</comment><comment><USER8> A novel (to me) thought: if we count on the government not to break our crypto (edit: originally said break the law, I don't want to comment on the legality of nsa actions here, it strikes me as off topic), we are already screwed. A million other crypto discussions have surfaced: if someone wants your keys, the can break your knees (rhymes too). If VA stops paying benefits, unless the organization that funds and controls them steps in, a lot of people are very screwed. While it's admirable to ensure crypto at every level (especially to address threats from other states or private individuals), ultimately as long as all three branches let the NSA eat our proverbial lunches and sneak under my mattress (gag orders, huge budget, sealing court records, etc), secure crypto is going to be a sisyphean at best. Obviously there are good reasons to push the stone upwards, but the fitting solution to problems like infiltration and gag orders seems like it will be a political one not a technical one.

<comment><USER9> But that's just it.

1800: The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no warrants shall issue, but upon probable cause...

2000: lol tech lets us read it all

2025: Oh no, crypto is good now? They want us to get a warrant and use non- dragnet surveillance to pursue leads? THE HORROR!

<comment><USER10> This parable from 1993 sums it up nicely.

> There was once a far away land called Ruritania, and in Ruritania there was > a strange phenonmenon -- all the trees that grew in Ruritainia were > transparent. Now, in the days when people had lived in mud huts, this had > not been a problem, but now high-tech wood technology had been developed, > and in the new age of wood, everyone in Ruritania found that their homes > were all 100% see through...

> One day, a smart man invented paint -- and if you painted your house, > suddenly the police couldn't watch all your actions at will...

> Indignant, the state decided to try to require that all homes have video > cameras installed in every nook and cranny. "After all", they said, "with > this new development crime could run rampant. Installing video cameras > doesn't mean that the police get any new capability -- they are just keeping > the old one." [...]

[https://cypherpunks.venona.com/date/1993/04/msg00559.html](https://cypherpunks.venona.com/date/1993/04/msg00559.html)

<comment><USER11> This story didn't make enough sense to really nail the issue. I'm surprised this parable is popular.

Why would you build houses out of wood if the wood is transparent?

It would make more sense if it were discovered years later that the police had special polarizing binoculars that let them see through the wood, which no one knew they had until it was too late and all the old mud huts had been phased out.

Also, describing someone as a "paint technologist" when they are anti-paint is a confusing decision for a _parable_ : a story intended to make a complex issue easier to understand. I initially assumed they were going to have a role analogous to a cryptographer, not an anti-privacy provocateur.

Perhaps having the police attempt to foil insidious flower thieves or dastardly rebel plots to undermine the government controlled potato cartel would also be more in spirit with a parable. The use of awful real life crimes (against children, even) make this a difficult one to share.

<comment><USER12> Because it's cheap. Because transparency may at times be useful to the owners. Because construction costs are lower. Because it's the fad or fashion. Because building regulations require it. Because of convenience. Because the transparency was an unanticipated side effect. Because it gives houses capabilities previously unattainable. Because the wood-house vendors have driven (by competition, monopolistic methods, patent and IP restrictions, superior lobbying, advertising) all the mud-house vendors out of business. Because ....

A parable is, by definition, metaphoric language. "Mud" and "wood" and "paint" and "tranparency" are metaphors for analogue physicle vs. digital electronic data, crypto, and surveillance.

Why do people choose, or find themselves with no alternative than digital data systems? There are numerous reasons. Many resemble, in some fashion, the list I've given above.

Reading parables overly literally is a category error. All metaphors melt if pushed loudly enough.

<comment><USER11> It feels like you are responding to a point I didn't make.

It's not so much that the metaphors break down under scrutiny, it's that they didn't really make much sense to me in the first place.

</comment></comment></comment></comment></comment></comment><comment><USER13> The way magic numbers and curves are elected is not a naive process.

The obvious backdoor in Dual EC-DRBG is a good example, and you have companies helping the NSA in very extensive ways (e.g. Crypto AG).

It's just logic, the goal of the NSA is to protect interests of the US, if it involves pushing rigged / weak algorithms for the greater "good" (at least from a US perspective), they'll do it.

It's legal, and logical.

<comment><USER14> Yeah logical if youre fine with degrading the US dtandards. Therell be nobody to spy on if nobody buys our dogshit products.

<comment><USER13> Well they are quite addictive and good products. Without SSH or TLS life would be more sad.

<comment><USER15> SSH is Finnish, originally; not American.

<comment><USER13> Wow cool, I always believed (wrongly) it was US

</comment></comment></comment></comment></comment><comment><USER16> Underestimating what an organization like NSA has the resources _and_ imagination to do, is a chronic ailment.

[https://archive.fosdem.org/2014/schedule/event/nsa_operation...](https://archive.fosdem.org/2014/schedule/event/nsa_operation_orchestra/)

</comment><comment><USER17> Meanwhile Barr (and predecessors) complain about sigintel "going dark" due to encryption... always sounded like a red herring to me.

When you manage to break an encryption method you protect your zero-day investment by encouraging everyone to continue to think you can't.

#SetecAstronomy

</comment><comment><USER18> The real question I have is where is this money going? I've looked at positions at NSA, and I know at lease one person that works there. They aren't making heaps of money.

How are they recruiting so many qualified individuals?

<comment><USER19> From what I understand: tech, mission, and tickets.

Say what you want, the NSA probably has some of the most interesting tech problems you'll encounter. Part of that is due to the unique job that they do-- by definition, they're doing things that nobody else in the US is allowed to do, so they need people to solve problems that don't exist elsewhere. Part of that is due to having a huge amassed knowledge particular to their area of work, which allows them to work on things that other people/organizations simply don't even know about.

Also: the NSA has supercomputers that make your eyes bleed. A buddy of mine who worked there says that even their power bills are classified. Back in the day, they developed a lot of highly specialized, one-of-a-kind hardware. Cray processors had a popcount instruction that was supposedly put in place at the NSA's behest. They can afford to get specialized treatment and demand specialized features from folks who build their computers. If speculation regarding their signal collection capabilities is true, then they also have to have serious signal processing and communications tech, too.

The NSA has interesting challenges and cool tech to work with. That can attract a LOT of people.

Another issue is mission. Look, you may not agree with the NSA's techniques and methods. But at least the original goal of the NSA-- breaking codes used by foreign adversaries to gain an intelligence and military advantage-- is pretty standard military fare, and not inherently evil. SIGINT played a major role in shortening WWII, and who knows may have happened since then (since it's all classified). The folks I know who work there are proud of their work, and believe they're doing the right thing. I'll note that these are GOOD people whom I respect, which leads me to believe that the NSA isn't just moustache-twirling and evil cackling. Some people work there because they believe they are genuinely serving their country.

Finally: tickets. Several of the folks I know have gone to the NSA, worked there a few years, then jumped ship to take industry jobs with clearances. Government contractors pay a premium for cleared workers, and if you show up with a TOP SECRET clearance in hand, your job interview chances just got better. It's a good way to set yourself up for decent job security and comfortable pay.

<comment><USER20> If I recall correctly, AWS will pay you an extra 10,000 a year if you have top secret clearance.

<comment> blaser-waffle If you're in tech, in Northern VA, and can get a TS you can angle for wayyy more than 10k -- from AWS or others.

</comment></comment></comment></comment><comment><USER21> [https://github.com/caprover/caprover/issues/533](https://github.com/caprover/caprover/issues/533)

</comment><comment><USER22> Crypto should aim to be secure for at least 100 years given current compute performance growth. That's one human lifetime.

At no point was that true for 1024 bit DH keys.

So why did anyone ever implement it?

<comment><USER23> At a guess, it was likely a tradeoff between security and computational cost.

I used to do freelancing for an ICT magazine and in early-to-mid 00s ran some numbers, as part of an article I did on limitations of applied cryptography. You can't do 1024-bit math on 32-bit or even 64-bit integers. Not without bignum libraries, which in turn make use of applied number theory. Under the hood the multiplication of two large numbers is an O(n^2) operation.

Performing an RSA or DH calculation with decent desktop computer in ~2003 took about 20ms with a 1024-bit number, and 80ms with a 2048-bit number. IIRC the first was expected to be theoretically breakable in a decade or so, assuming Moore's Law held true. The second was thought to be computationally infeasible for at least 100 years. These days the professionally paranoid use 4096-bit keys. (Or more recently, the nice 25519 curve which is more compact.)

So raising the security margin from "reasonable" to "paranoid", back in the day, would have required 4x the hardware investment to serve the same amount of traffic, and it would have imposed severe latency issues for everyone. We also have to consider the fact that most commercial secrets have a shelf life of years to a couple of decades. So before "E2E for everyone" became a thing, there simply wasn't widespread interest for crypto that could protect _personal_ secrets for a lifetime.

With regards to using cryptography for personal privacy, cypherpunks were well ahead of their time. It's only become a mainstream issue in the last 5 years or so.

<comment><USER22> Multiplying 1024 bits by 1024 bits the naive way on a 32 bit processor involves 1024 multiply operations. Even in 2003, they were typically pipelined with a throughput of one multiply per cycle[1], so you should be able to do that in ~1040 clock cycles. Which is 750 _nanoseconds_ on a 1999 era Pentium 3.

Since DH key exchange isn't done on all the data, only to exchange keys, and no machine then or now was setting up 1 million encrypted connections per second, I don't see this as a performance bottleneck at all.

What am I missing?

[1]: [https://books.google.co.uk/books?id=V5oACAAAQBAJ&pg=PA208](https://books.google.co.uk/books?id=V5oACAAAQBAJ&pg=PA208)

<comment><USER24> > Multiplying 1024 bits by 1024 bits the naive way on a 32 bit processor > involves 1024 multiply operations.

That's 1024 32-to-64-bit wide multiply operations. On x86, where regular mul is wide (it sets both edx and eax), that's the same as a regular operation. Some architectures that have just a MUL and a MULH instruction would make it two instructions. If you have neither, that would require 3 multiply instructions plus a few shifts.

> Even in 2003, they were typically pipelined with a throughput of one > multiply per cycle[1], so you should be able to do that in ~1040 clock > cycles.

The inner loop is _much_ more than a wide multiply. You have to load the two words you're multiplying (although one of them should already be loaded in the outer loop). Then you need to two adds-with-carry, store the results back. Next you need to handle the extra carry bit, which in the most naïve case is another load, add-with-carry, store. And finally, you need the regular loop management instructions.

That's 4 loads, 3 stores, 3 adds, and 1 multiply, repeated 1024 times. I don't know the exact port availability and timing of Pentium 3 processors, but if there's only one load /store port, and it's a 4-cycle latency operation, you're looking at probably 25-ish cycles per inner loop iteration, or about 25,000 clock cycles.

</comment></comment></comment></comment><comment><USER25> Wouldn't it be easiest to just backdoor all clients, everywhere? And ideally you'd even do some basic threat analysis at the device to save you some compute resources.

<comment><USER13> You mean "Popular software XX" auto-updating ?

It's likely already operational ;)

Silent updates are extremely dangerous. This is why you can see some Israelis, for example, refusing over-the-air updates on their phone while traveling.

<comment><USER26> Does that mean the crypto used to authenticate the updates is compromised, or that the providers (app stores?) are? In either case, why is it safer in Israel?

<comment><USER27> Perhaps a MITM attack by a foreign power.

</comment></comment></comment></comment><comment><USER28> I think in the long term, we'll move away from relying on one algorithm only, like AES or DHKE, but combine them. So for key exchange we will use DH plus ECDH plus whatever comes out of the post quantum NIST competition, and use all three as inputs for both parties to a KDF to produce the derived key. Attacks against any one of the algorithms won't turn into feasible attacks onto all of them.

<comment><USER29> Combining two algorithms is very hard and when it does it can become insecure(new attacks can be found). Even if you can combine and its secure then it becomes infeasible to use it often as the length of keys, IV, etc. increases

<comment><USER28> I didn't mean deep combination that changes how an algorithm works internally. Of course that would be a stupid idea. The algorithms would still work the same, would use separate random numbers, etc. You'd just combine them at the integration level, treating each algorithm like a black box.

Think of two servers first doing DH and then doing ECDH. You'd get two shared keys. This is inefficient because it has more roundtrips than doing the algorithm's steps in parallel, but helps with understanding.

These two secrets can then serve as inputs to your KDF which derives multiple secrets for each of the data ciphers you use. E.g. first AES with the first secret then encrypt that with ChaCha20 with the second secret. As long as your KDF is preimage resistant, you can't get from one algo to another.

And yes, length of keys and computation do increase. But I argue that this will be a cost worth paying at least in some scenarios. Especially in a time we make our CPUs slower by double digit percentages for _all_ computation in the name of security.

</comment></comment></comment><comment><USER30> Satoshi knew to use elliptic curves in 2009 for Bitcoin. Coincidence? Also perfect opsec and near perfect implementation...

<comment><USER31> Every crypto geek knew to use ECC in 2009.

Hell, the Windows Genuine Advantage system, which goes back to _Windows 98SE_ , uses ECC for its keys.

[1] [https://internetcafe.ph/forum/4-lounge/17183-all-u-need- to-k...](https://internetcafe.ph/forum/4-lounge/17183-all-u-need-to-know- about-windows-product-key)</comment></comment>


Ask HN: How big does my portfolio have to be to get a job? - <AUTHOR>

Currently I am applying for a job, I am curious as to how big my portfolio have to be to get a programming job. I am hoping to get a job as a front end developer. In my portfolio I have two games, one canvas application and a website. The website is a text editor. You create an account, then you can edit and create text document, and view them. My question is, are these good enough to get use as my portfolio and will they get me a job? <comment><USER2> Quality is more important than quantity.

Since you didn't provide links, all I can do is say that I'll always look at any provided samples/source.

<comment><USER3> This. When I review resumes and see a portfolio, I check out the quality of code. One high quality piece speaks volumes in a positive manner, whereas lots of negatives speak volumes in the bad way.

</comment></comment><comment><USER4> You don't need one. I don't use portfolios, because they are visual mediums. My work is programming. I don't want people judging the quality of my work based on the quality of the designer's work.

Upload your projects to Github, brush up on your interview questions, and keep interviewing. You will get a job.

</comment><comment><USER5> I like to see Dribbble or Behance for "front end" work. But I'll expect to also see HTML/CSS in Github (or similar). I need a small amount of Canvas work, likely with fabric.js. its a short but paid gig for a real SaaS app.

</comment><comment><USER6> 0\. You dont need a portfolio to get a programming job, there are plenty of jobs.

But you're completely neglecting to mention your work experience and education, so I'm assuming you had a formal CS education.</comment>


JavaScript Tricks: 3D Panorama - <AUTHOR> http://johndyer.name/post/2007/12/Stupid-JavaScript-Tricks-3D-Panorama.aspx

<comment><USER2> I've been experimenting with some 3D JavaScript stuff too:

<http://tlrobinson.net/misc/3d.html>

This is very very alpha and probably only works well in Safari and Firefox (but the menu might not work in Firefix, sorry)</comment>


Node.js screencasts : Nodecasts.org - <AUTHOR> http://nodecasts.org/

<comment><USER2> I still don't understand the benefit (for the user) of the screencast format for programming tutorials vs plain old text and code snippets/screenshots. In some cases, the screencast might be helpful as a supplemental format, but otherwise I find them to be frustrating. For example, if I want to study some code for a longer duration than the author allows, I have to pause the screencast. But, of course, I often pause too late and have to scrub backwards and/or rewatch portions of the video to find that point again. With a text tutorial, I can follow at my own pace, quickly find where I left off, copy+paste code, etc.

Edit: All that said, anyone who takes the time to teach others, regardless of the format, deserves a lot of credit.

<comment><USER3> _I still don't understand the benefit (for the user) of the screencast format for programming tutorials vs plain old text and code snippets/screenshots._

Emphasis on the word "I." Some people don't "get" books. Some people don't "get" e-mail newsletters. Some people don't "get" movies. Some people find in- person, live presentations useless to learn from.

Different strokes for different folks.

Video has an interesting psychological effect for many users. Most of us have grown up watching a fair bit of TV and, often, watching a lot more TV than reading books. There can be some comfort and ease with video versus reading, at least to build motivation and to "get going" with a topic. But, of course, not for everyone.

</comment></comment><comment><USER4> I generally like screencasts because they're small tidbits and I usually remember the gist of how something is done.

As an aside, you can use -O with curl to save the file as the filename, instead of having to redirect the output and rewrite the filename

So instead of this: curl <http://nodejs.org/dist/node-v0.2.3.tar.gz> > node-v0.2.3.tar.gz

You can just write this: curl -O <http://nodejs.org/dist/node-v0.2.3.tar.gz>

for the same effect.

<comment><USER5> curl <http://nodejs.org/dist/node-v0.2.3.tar.gz> | tar xzvf -

</comment></comment><comment><USER6> Nice job. A small nitpick maybe, but the sound level of the intro and outro is very disproportionate to the rest of the screencast's sound. Quite unpleasant when wearing headphones.

That said, I'm looking forward to the next one, subscribed to the youtube channel.

</comment><comment><USER7> I enjoy screencasts, but I really can't understand what Mr. Macedo is saying in his screencast.

I enjoyed the RoR screencasts because I didn't really need to watch them, I could just listen and work in another window.

This would be a great idea if Mr. Macedo spoke in better English, it's not something he can control but it's a big deal from a final product viewpoint.

<comment><USER8> Mr. Macedo speaks perfectly comprehensible English. I understood every single word he uttered. Your comment is unnecessary and hurtful. What would be a "great idea" is if you added value somewhere instead of putting people down.

Mr. Macedo keep up the great job!

</comment></comment><comment><USER9> Well done. I am excited for more. [bookmarked] (And I love the accent. The presenter speaks english very well, and the accent does not detract in the least, but it adds an interesting texture.)</comment>


Small design and usability details matter a lot more than you think - <AUTHOR> http://www.designresourcebox.com/small-design-and-usability-details-matter-a-lot-more-than-you-think/

<comment><USER2> This reminds me a quote:

> Everything should be made as simple as possible, but not simpler.

Paying attention to detail and keep things simple, not just for design but coding as well.</comment>


The Hacker News Experiment - <AUTHOR> http://hackernewsexperiment.blogspot.com

<comment><USER3> Neat. Even better if there was a Hacker News Startup Challenge, similar to Rails Rumble, where instead of mere 48-hours, you work for 1-2 months and launch, then you get reviewed by a panel of judges. This would be much more interesting to me, I guess.

It would be awesome if the winner would get a free ticket to fly to the Valley and join the current YCombinator class for one of their famous dinners, and get to present.

Wishful thinking, maybe.

<comment><USER4> This would be really interesting, especially for those of us who are struggling to meet that special someone (i.e. a co-founder). For me at least, I think being part of a competition and having external interest to keep motivation up would be helpful.

<comment><USER5> _meet that special someone (i.e. a co-founder)_

Two words for you:

1) the co-founders meetup <http://www.meetup.com/Co-Founders-Wanted-Meetup/>

2) instead of lamenting about a situation, do something about it [http://blog.fairsoftware.net/2010/06/10/will-you-be-a- great-...](http://blog.fairsoftware.net/2010/06/10/will-you-be-a-great- entrepreneur-how-i-can-tell-from-your-resume/) "entrepreneurs are the ones who do when everyone else is talking"

Literally, if you don't like something, fix it. Just do it yourself. Don't cry on HN that something needs to be done. To me, that's a tell-tale sign of entrepreneurs.

<comment><USER6> "Don't cry on HN that something needs to be done."

I read nothing in that comment that sounded like crying.

As to your first suggestion about the Co-Founder-Wanted-Meetup: Am I such a cheapskate that $65 in advance/ $125 at the door to attend a meetup sounds a bit steep? Perhaps I can't see the forest for the trees and the opportunity cost of missing a meetup like this is way greater than the attendance fee. So for anyone who has attended this meetup, is it worth the fee?

<comment><USER5> Sorry, you confused the regular co-founders meetup (price between $6 and $10 to get in), with the founder conference, a once-a-year event. Different size, different price.

The crying part: I was trying to anticipate the reaction of "but there is no such meetup where I live". Just do it.

</comment></comment></comment></comment></comment><comment><USER7> How about this? Build a general purpose "backend" interface that allows anybody trying to commercialize a web product to manage their users.

Your system should allow:

* the creation of superadmin accounts

* Map your user model to my user model

* CRUD users of my application

* Impersonate users of my application so I can see their data

* Expire / suspend / upgrade / downgrade users

* Search for users

* Notify a user via email of something

* Report top users by metric (in the mapping operation above we tell you where to look up these metrics)

* Report new signups per day

<comment><USER8> There are various Rails plugins that take care of most of this stuff. I've had great success with restful_authentication (<http://github.com/technoweenie/restful-authentication>)

<comment><USER9> You should check out AuthLogic. restful-auth's generator based approach is awkward sometimes, and it hasn't been updated in forever...

<comment><USER10> Devise has been my choice in recent times. but beware it has no roles. it's simple and bakes in everything though. so in 2 commands in the terminal you'll see a login system in your browser including forgot password feature that authlogic doesn't give you.

Making all of those features Samparicio said would be a little tough for code reuse. Engines feature was planned for Rails 3.0 beta but pushed to 3.x. That's the feature that can help code reuse. But it's possible to do this neatly on Django, which allows component-based architecture for apps.

<comment><USER9> Authlogic has no roles either, I use acl9.

Authlogic and forgotten passwords is pretty simple, though. It sort of gives it to you. Well, it gives you the tools. It's really only a tiny bit of coding.

I'll certainly check out Devise though.

</comment></comment></comment></comment></comment><comment><USER11> How about a 4chan style message board in the sense that posts expire very rapidly, but also in that only single topics are allowed for certain time intervals. For example the site could start off with a 24 hour cycle in that dialog can take place on a certain topic (such as BP oil spill) based on the first message that has come in that day. It'll need some means of aggressively pruning out (marking as spam) messages that are deemed off topic, but this can be a voluntary (karma based) or a machine learning approach that could also be tweaked or plugged in beyond the 4 week development period. The initial version would just keep topics on lock down for an additional 24 hour period, before permanent deletion. So basically there is one active topic, and one previous topic for review.

</comment><comment><USER12> This isn't strictly a web application, but if you are a Java programmer then one project I'd recommend would be integrating the Twitter Search API with FreeMind for the purpose of facilitating real time curation of tweets. Real time curation is apparently the number one request for software that the twitter people get, and FreeMind is the ideal platform for curating tweets. All that's needed is a way to intelligently get tweets into FreeMind so that they can be quickly sorted appropriate buckets, and since FreeMind is written in Java it might be a good fit in terms of skill set and project size.

To give an example of how this would be used, the project described above would reduce the time of making this from about seven hours to about an hour: <http://www.squidoo.com/Hacking_Education>

Also, here are two relevant blog posts:

[http://scobleizer.com/2010/03/27/the-seven-needs-of-real- tim...](http://scobleizer.com/2010/03/27/the-seven-needs-of-real-time- curators/)

[http://shannonclark.wordpress.com/2010/02/19/curate-for- me-a...](http://shannonclark.wordpress.com/2010/02/19/curate-for-me-an-idea- for-a-simple-web-service/)

<comment><USER13> Wouldn't this require Twitter to give you direct access to the firehose?

<comment><USER14> No, there's a streaming API [0] that allows for access to a subset of the firehose in JSON via search and filtering. I wrote a short ruby script that is a good demo of how it works [1].

0 <http://apiwiki.twitter.com/Streaming-API-Documentation>

1 <http://gist.github.com/325757>

</comment></comment></comment><comment><USER15> As someone who's been skimming "The Four Steps to the Epiphany", I note that your schedule is purely Product Development - there's no Customer Development. Since YC is about "building something _people want_ ", that second part is equally crucial. Arguably more so.

My take on "4 steps" is: do iterative/agile/RAD/MythicalManMonth development (you present a demo ASAP, so the client can tell if that's what they want or not), but to _not wait til you have a demo_. You iterate on "the customer problem you're solving" and "specs of the product". This is much faster than building a demo, which is faster again than building the whole thing - <USER2> only _then_ finding out that the "people want" part is missing. (You build the product concurrently).

What you're proposing is an engineering project - which is great! Nothing wrong with that, challenging, lots of fun, lots of learning. Just noting it's focussed entirely on that half of an _entrepreneurial_ project - a common developer approach.

</comment><comment><USER16> Are you building a business or a piece of software? It sounds like you're building a piece of software which is totally cool - I just want some clarity before I contribute.

<comment><AUTHOR> I first and foremost want to solve a real problem for someone. To do this I think that I should develop a web application which solves this problem. If solving this problem also requires a business, then that is something that I would consider. Andreas

</comment></comment><comment><USER17> Here is what I would like to see.

The Freecycle Network is brilliant - lots of stuff gets rehomed that would otherwise get dumped in landfills. People get their redundant stuff taken away, people get free stuff (computers, toasters, clothes...), it's good for the environment, it's all good. Technically speaking, it's in the dark ages though. It runs via mailing lists, which are operated by Yahoo and apply to discrete geographical areas. It works well enough, but I think it could be improved on, or at least supplemented.

I would like to see a system based around open standards. I envisage:

* A structured way of listing spare stuff - ie. hListing or some variant.

* A way of managing a network of people whose stuff you're interested in - Portable Contacts? Whatever the state of the art is, not sure. Ideally something that can be somewhat integrated with people's existing social network info. Or, screw it, just a list would do for now.

* A standard way of managing who can see your listings - OAuth?

* A web application that you can use to manage your listings (or in time any number of applications, since the end result is standards-based output)

* A web application that aggregates, filters, searches and displays other people's listings (these last two bullet points are probably functions of the same application)

This is a bit sketchy but If it's feasible, I think such a system has a number of advantages over Freecycle or the various balkanized web-based databases of free stuff. I vaguely intend to look into doing this myself at some point, but I'm hoping if I pimp the idea about a bit somebody else will do it for me (or with me).

</comment><comment><USER18> I think it was suggested by someone else here on HN but the idea is to have a widget on blog that tracks how many pages a visitor has browsed. Then simply show him a message saying 'Hey, you seem to be a loyal reader. This is your 3rd visit on the blog and you have read 33 blog posts here. Writing unique content takes time and effort, so please consider leaving a small tip to encourage me to write even more.'

Also show some sort of leader board of donators and the content they consume. Idea is to come up with guilt-ware which presents a new revenue stream for dedicated bloggers :)

</comment><comment><USER19> Regarding the use of Java, the language is dying. Maybe the languages developer base, and supporters refuse to believe it, but on the commercial end most of the major Java supporting software shops have wound down or died. Even sun is closing up development. So, if you are developing actively in Java you run the very real risk of developing a ton of unmaintainable code.

It's like the quiet little joke the industry refuses to address. Erstwhile, Google is now the only people doing any legitimate active development on a new vm... and even they aren't chaining themselves to Java.

So I ask you, do you really want your software written in a dying language? I wouldn't. Java apps were hard enough to support when the many and myriad vms were being actively worked on. I can't imagine the pain that will be brought down upon adopters now. =/

<comment><USER20> Really? - [http://www.tiobe.com/index.php/content/paperinfo/tpci/index....](http://www.tiobe.com/index.php/content/paperinfo/tpci/index.html)

</comment></comment><comment><USER21> Web-based MMS message composer. Initial features:

0) Subject and Text 1) add image (gif,jpg,png) 2) add support for more than 1 image 3) add resizing tool for images 4) add support for other filetypes (no preview necessary - just add as attachments) 5) Add support for page breaks (separate pages) 6) Simple design choices (text and image together on page or on separate pages etc) 7) More advanced design choices (move content between pages)

The output should be zipfile (one file per image, one file for text, one file for design - SMIL language). If you want to be advanced then you can also output Nokia MMS file format.

I have written some C#-code for reading Nokia MMS file format if you need that.

I can coach and give feedback if necessary. I am working in the mobile technology industry as a software developer.

<comment><AUTHOR> Interesting suggestion. What real problem would this solve for people? Sending MMS messages is expensive at the moment, so making it cheaper would proably make it more usable for people. Anything more?

</comment></comment><comment><USER22> Here's one idea: Take Open Text Summarizer (<http://libots.sourceforge.net/>) and turn it into a web application which takes in an URL and returns the same document summarized.

</comment><comment><USER23> I love craigslist as an apartment finding tool. Most of the ads for apartments include a google maps link, so I can figure out if it's really in the area I'm interested in.

But every time I move I wish constantly for a service that would let me search craigslist by actual location. My mental picture is a location and distance, but some kind of region-selection on a google-maps overlay would be even better.. or a location and a maximum travel time. A feed of those ads as they are made would be even more powerful.

</comment><comment><AUTHOR> Thanks for all the feedback and ideas so far, everyone. I would still like to challenge you to share more real problems that I could develop a web application to solve. Andreas

<comment><USER24> To people here, the ideas themselves are probably more valuable than the effort required to realize them. It might be a good idea to reach out to communities that have good ideas, but not the technical means to implement them. Having said that, check out:

<http://ycombinator.com/ideas.html> <http://openideas.eu/> <http://www.reddit.com/r/SomebodyMakeThis/>

I am reluctant to give you any of my ideas, but how about a web app for images, that particularly serves the needs of e.g. law enforcement, and allows storage and annotation related to crime scenes, cases, etc, or perhaps for the health industry, and does the same for patients with certain conditions, and you could tag them and other doctors could offer second opinions for money etc.

</comment></comment><comment><USER25> Interesting. I am open if you are considering collaboration which will give one additional man month to finish the project. I am familiar with C, C++ and Python.

<comment><AUTHOR> Hi! This could be possible. Please sende me an email with info about yourself. Contact info in profile. Andreas

</comment></comment><comment><USER26> I want inline previews (first paragraph) or the full text for every news, so that I can read the stories without leaving HN. It can be a GreaseMonkey script that adds a "show full text" button, and, when you click on it, shows the full text.

Not sure, what is the legal status of such previews, though...

</comment><comment><AUTHOR> Update: I have publised a summary of the progress so far on my blog:

[http://hackernewsexperiment.blogspot.com/2010/06/status- from...](http://hackernewsexperiment.blogspot.com/2010/06/status-from- day-1-evaluating-ideas.html)

<comment><USER27> I saw you're planning on doing something with public transit. You should check out Google's Transit Program, they have public feeds of transit info (stops, routes, stop times and what not) here: [http://code.google.com/p/googletransitdatafeed/wiki/PublicFe...](http://code.google.com/p/googletransitdatafeed/wiki/PublicFeeds)

</comment></comment><comment><USER28> Experiment Track Thyself: Make an experiment tracking database.

</comment><comment><USER29> Create a micro book summary site. I have the entire thing planned out and will realistically never get to it as much as I think I could. It's mostly standard CRUD, with some bells and whistles, you can monetize it pretty well, and I know of a good domain for you if you want to do it.

I genuinely want you to take my idea, please contact me and I will give you everything I have.

<comment><USER30> I have been thinking about this for a while. Not the app, but the fact that book summaries would be really useful. Most books tend to be too verbose. Care to elaborate a little on your idea for the app?

<comment><USER29> Basically take stackoverflow and make it for book summaries, but put a word or character limit to the summaries. So eventually, you'll have a collection of the best 500 word book summaries

</comment></comment></comment><comment><USER31> How about an open-source hacker news? Thereby destroying the same community that helped you to create it.

What? He said "the problem must not have been solved before"

<comment><USER32> "Thereby destroying the same community that helped you to create it."

Downvoted because it's silly to think that an open source implementation (regardless of whether there already was one or not) would destroy HN. As if it hasn't been done a million times before. It's the community, not the technology.

<comment><USER33> But what if the (community of) hackers can actually modify the system during runtime, using same techniques as voting stories up/down to write the code?

<comment><USER34> I've already feature-frozen v0.7, but I'm going to look into this as a plugin for 0.8 - potentially very cool idea.</comment></comment></comment></comment>


Reinteract: a system for interactive experimentation with Python - <AUTHOR> http://fishsoup.net/software/reinteract/ <comment><USER2> Looks like Mathematica notebook</comment>


Golang's Superior Cache Solution to Memcached and Redis - <AUTHOR> https://www.mailgun.com/blog/golangs-superior-cache-solution-memcached-redis/ <comment><USER2> The idea is simple but makes a lot of difference.</comment>


Several of the web servers powering phpBB.com were compromised - <AUTHOR> https://www.phpbb.com/community/viewtopic.php?f=64&t=1186015

<comment><USER3> Is it just me, or does anyone wish that compromise disclosures should be hosted somewhere other than the site that has been compromised? What if there's a persistent threat and their webserver is still hosed, injecting 0days into responses? Not that it's happening here - I still clicked it - <USER2> I was hesitant.

<comment><USER4> It is the one site you know the users will come to. I would do the new web server at old address. Hacked machines should not be put back in service.

<comment><USER5> I think what you want is the "Full Disclosure" mailing list:

      http://nmap.org/mailman/listinfo/fulldisclosure

<comment><USER4> I'm pretty sure the affected people will visit the original site, and I'm not sure they will visit the site you mention.

</comment></comment></comment></comment><comment><USER6> Other than the obvious, some things worry me.

> We have confirmed that initial entry was made via a team member's > compromised login details and not as the result of a vulnerability in the > phpBB software.

> The attackers were able to obtain access to the phpBB.com and area51 > databases, meaning that user information, including hashed salted passwords, > was compromised. Additionally, all logins on area51 between Dec. 12th and > Dec. 15th were logged in plaintext. While the hashing algorithm utilized in > phpBB will make it difficult to obtain those passwords, you should not take > any chances.

A bit of clarification should be given. The staff's login information was stolen, allowing someone to get a dump of the database containing user info. What kind of login information was stolen? Is this an shell account, was an SSH key stolen, was this an admin panel account?

Secondly, "all logins [...] were logged in plaintext". Does this mean the username and password were logged, the password hashes and sessions? What actual information was plaintext to the user?

It's great that groups are willing to own up to these kinds of events, but without specific information, it's hard to understand how broad a compromise we're talking.

<comment><USER7> The hacker probably modified the code to log all passwords.

If you logged in on the dates specified you should assume your password has been stolen.

</comment></comment><comment><USER5> PhpBB, the gift that keeps on giving. Isn't phpBB one of the most compromised pieces of software installed?

<comment><USER8> I'm pretty sure sendmail still wears that crown.

<comment><USER9> Unpatched Exim was giving it a pretty good run for a while.

<comment><USER10> Well well well. A sysadmin friend swears by exim as the safest mailserver software ever. I will enjoy ribbing him at the pub on Friday :)

<comment><USER9> Not a bad track record, but not flawless: [http://www.cvedetails.com/vulnerability- list/vendor_id-10919...](http://www.cvedetails.com/vulnerability- list/vendor_id-10919/product_id-19563/Exim-Exim.html)

The 9.3 one was world-destroying, nuke-from-orbit type bad.

"execute arbitrary code via an SMTP session" is not what you want to hear in a bug report.

<comment><USER10> Yikes!

I'm still impressed by qmail's track record: [http://www.cvedetails.com/vulnerability- list/vendor_id-86/pr...](http://www.cvedetails.com/vulnerability- list/vendor_id-86/product_id-143/Dan-Bernstein-Qmail.html)

<comment><USER9> As good as qmail is, the official release is so far behind the times it's ridiculous. The unofficial patches, made unofficial by a stubborn refusal on the part of the author to merge them in, have fixed most of these issues, but then what's the point of using qmail if you have to use the untrusted version?

Sadly qmail is a lesson of how you can be correct and completely wrong at the same time.

Imagine a completely secure operating system that only runs on 32-bit systems. Could you actually advocate using it in a serious production capacity?

</comment></comment></comment></comment></comment></comment></comment><comment><USER11> I have a Google App Engine instance, and it started getting a lot of random requests, which may be related to this. My website had 5,000 requests yesterday (normally less than 50). The logs indicate a lot of these:

        220.127.116.11 - - [16/Dec/2014:04:11:43 -0800] "GET /bbs/zboard.php?id=notice&
        no=41&PHPSESSID=98802904391cd2920f0473f7956305be HTTP/1.1" 404

Might be some kind of DNS forwarding issue, but I don't my server handling unnecessary requests. What can I do?

<comment><USER12> That's an unrelated probe for a different, surely vulnerable, script - Zeroboard.

If the attack probes disturb you, begin gathering their patterns and plonking their IPs into a black hole using something like fail2ban. Er, well, that's what I'd do on a normal system. Not sure what to do about that on GAE.

<comment><USER11> Thanks for the heads up. Didn't know about Zeroboard.

In case anybody is wondering, it is pretty easy block IPs as well.

</comment></comment></comment><comment><USER13> Can I point out that there's no need to link to a specific subforum when the same message is on the homepage?</comment>


The Relationship Between Income and Wealth - <AUTHOR> http://www.visualcapitalist.com/relationship-income-and-wealth/ <comment><USER2> I'm assuming that 'income' here only refers to income from wages, rather than return on capital. Obviously, the latter would show a strong correlation with wealth.

<comment><USER3> I guess this is why the relation is stronger in the upper right quadrant, where income from capital is significant.</comment></comment>


Harvard method to learn in 3 minutes a day via email, RSS or iPhone - <AUTHOR> http://harvardmagazine.com/2009/11/spaced-education-boosts-learning

<comment><USER2> Um, you mean spaced repitition <http://en.wikipedia.org/wiki/Spaced_repetition> which has been in use for years (decades actually) and which Harvard most certainly did not invent.

<comment><USER3> Exactly! I've been using desktop apps that do this since the 80's and online apps that do it since the mid-90's...how in the heck are they patenting it?!</comment></comment>


Hacking the Hiring Process - <AUTHOR> http://ismarc.tumblr.com/post/1458764869/hacking-the-hiring-process

<comment><AUTHOR> I don't write many things up and publish them. And I submit them less frequently. In fact, I've had this saved as a draft for some time because I wanted to come to a conclusion about a system that could improve the current process, but was unable to.</comment>


Ask HN: Any online educational games for young kids? - <AUTHOR> My 4 year old son really likes https://countable.github.io/cats-of-jasnah/ It's an enjoyable quarantine activity. Are there any similar games in terms of being educational and playable on a smartphone? <comment><USER2> check out Kahn Academy [https://www.khanacademy.org/](https://www.khanacademy.org/)</comment>


The Pierre Omidyar Insurgency - <AUTHOR> http://nymag.com/daily/intelligencer/2014/10/pierre-omidyar-first-look-media.html <comment><USER2> I come away from this thinking that Omidyar doesn't have any particular expertise or insight about running a journalism startup. He seems like a dilletante, trying to improve the world perhaps, but mostly trying to live an interesting life. Which is fine but not a recipe for success.

He'd be more effective either as a foundation giving grants to worthy journalists, or as a VC of same.

<comment><USER3> > I come away from this thinking that Omidyar doesn't have any particular > expertise or insight about running a journalism startup. > He seems like a > dilletante, trying to improve the world perhaps, but mostly trying to live > an interesting life. Which is fine but not a recipe for success.

That's for sure the impression that the article wants us to have. I certainly don't know Omidyar, but I want to read a more neutral article (or at least other viewpoints, including Omidyar's himself) about him to form a clearer opinion.

<comment><USER4> That the top level editorial staff almost went into revolt over what they perceived to be "the lack of clear budgets and repeated and arbitrary restrictions on hiring" is pretty damning. That said, this article reads like a somewhat routine profile that messily switches course mid-stream in reaction to events on the ground.

I'm interested in hearing more about this:

> There was an East Coast–West Coast feud, a divide between the journalists > and the technologists. Omidyar's loyalists out in California and Hawaii > grumbled as Greenwald traveled the world, promoting a book, picking up > awards, and speaking out of turn.

The NYT Innovation report makes the case that editorial and technology/design working closely is important not just for the primary products of the business, but for fostering trust and opening up communication between the business department and the newsroom. Seems like that'd be difficult if the company is physically separated by the whole United States (and half the Pacific in some cases).

[http://www.niemanlab.org/2014/05/the-leaked-new-york- times-i...](http://www.niemanlab.org/2014/05/the-leaked-new-york-times- innovation-report-is-one-of-the-key-documents-of-this-media-age/)

</comment></comment></comment><comment><USER5> Original source regarding the Matt Taibbi debacle: [https://firstlook.org/theintercept/2014/10/30/inside- story-m...](https://firstlook.org/theintercept/2014/10/30/inside-story-matt- taibbis-departure-first-look-media/)

kinda-sorta-disclosure: it includes a quote from a high school friend of mine, who also happens to be the executive editor of Racket:

        We were successfully working to address those
        issues when First Look once again stepped in
        to fuck things up. I regret that the world
        won't get a chance to see Matt Taibbi's Racket.

<comment><USER6> This being Hacker News...I'm really interested in hearing what people have to say about RASCI, something I had never heard about until the parent comment's link:

> _Taibbi and other journalists who came to First Look believed they were > joining a free-wheeling, autonomous, and unstructured institution. What they > found instead was a confounding array of rules, structures, and systems > imposed by Omidyar and other First Look managers on matters both > trivial—which computer program to use to internally communicate, mandatory > regular company-wide meetings, mandated use of a "responsibility assignment > matrix" called a "RASCI," popular in business-school circles for managing > projects—as well as more substantive issues._

That doesn't sound much fun for managing business/IT projects, I can imagine journalists just hating it.

<comment><USER7> The Wikipedia entry doesn't do RASCI any favors in promoting it as any sort of useful artifact from what I can tell.

It seems most like a "blame matrix."

<comment><USER8> it's not entirely worthless

if, after a meeting, you circulate a quick set of (1) what did we agree on, (2) who is the person responsible for each of (1), (3) who requires signoff on various (1) I find it quite useful. It's good to have it written down to serve as a consensus from the meeting to reduce miscommunication about who has what commitments and who must sign off.

Lots of orgs use stuff like this: github has a Primarily Responsible Person, apple has something similar.

That said, I've never had to draw out a formal rasci chart, and this can easily be taken too far. In a team of maybe 1-10 people this level of formality is way overkill.

</comment></comment></comment></comment><comment><USER9> [http://pando.com/2014/10/28/taibbi-takes-time-out-from- first...](http://pando.com/2014/10/28/taibbi-takes-time-out-from-first-look- after-disagreements-can-i-publish-our-emails-now-matt/)

<comment><USER10> Thanks for this.

I already had my suspicions about Firstlook Media, and this just reiterates them.

Secondly, I am not too impressed with the way Greenwald has been guarding the leaks and his organisation is the sole benefactor of their contents as he trickles them selectively to the public. The documents should be accessible to all. Having said that I am an admirer of his work, but would love to have seen the documents given to Wikileaks

<comment><USER7> Greenwald is not the only journalist with access to the documents: this has been explained and mentioned several times. Several news organizations had access to the cache including The Guardian, New York Times, Washington Post and others. The idea was that the professional journalists would be better at figuring out what was both news-worthy and ethical to release. There are already people claiming Snowden personally gave an autographed copy to Putin and then we have folks on the other side like you who are misinformed and . Obviously, taking people like you and the people acting like Snowden forwarded everything to the FSB/Chi-Coms into consideration, there is absolutely nothing anyone can do to release this material in a fashion that some uninformed person won't complain about.

Wikileaks have claimed that they have Russian diplomatic cables just as explosive as the "Pentagon Cables" but it's been years without any release which leads me to think that they either: a) don't have them and are lying b) have them and are not releasing them for some political reason which would be even worse. I wouldn't trust them at all to release any important information in a thoughtful manner.

<comment><USER10> I guess I phrased my comment incorrectly. I am aware that other organization have the documents, but my problems is questioning journalist/news organizations as the gate keepers to what the public should know/should not know.

>"The idea was that the professional journalists would be better at figuring out what was both news-worthy and ethical to release"

I completely disagree with this.

Can you provide some a source for the claims about wikileaks?</comment></comment></comment></comment>