Ask HN: What programming language will you learn in 2014? - <AUTHOR>

After a long research I decided to learn Haskell. It is very unlikely that I will ever be paid to use it, but I am pretty sure that after more than 10 years experience in programming, Haskell will greatly benefit my programming skills and thinking. <comment><USER2> There was a recent comment by tptacek in another thread which I agree with: you really only need to know a couple of programming languages before you start hitting diminishing returns in terms of what you can implement. We should focus instead on learning new concepts or new problem domains.

I'm trying to revisit statistical modelling and pick up some machine learning basics over the next year.

<comment><USER3> and what about domains only tangentially related to computer science, like robotics, semiconductors, or digital music?

or what about domains barely related to computer science, but where coding is an invaluable skill, like medicine/genetics, manufacturing, or aerospace?

consider how many programming languages your average person knows (zero). now consider how many you know. is it objectively worth your time optimizing around that particular dimension within your skills, or are you perhaps suffering from a latent bias you have _from_ the fact that you are a relative expert in programming?

would you rather have a carpenter who knows how to use a dozen hammers, or a wide variety of tools? is haskell a new tool, or is it just another hammer for you? with coursera you have no excuse to avoid stepping outside your comfort zone!

<comment><USER4> > would you rather have a carpenter who knows how to use a dozen hammers, or a > wide variety of tools?

There's a danger in what you're suggesting, in overgeneralizing and never learning too much about one topic. Would you rather have a carpenter who's an okay carpenter, an okay musician, an okay actor, and an okay racecar driver, or a carpenter who's _really good_ at carpenting?

<comment><USER3> well, my point is a person needs to determine on their own if learning something like haskell really makes them a better carpenter, or if they are just going leveling up their "number of programming languages" XP because that's the main XP they are familiar with.

If I had to pick a point of leverage with which to increase programming skill in minimal time, "learn a new programming language" would be far down the list if two or three for various contexts were already well mastered. "Learn Haskell", almost universally, would be near the bottom.

<comment><AUTHOR> I agree with you that it is everybody's own decision :) Although from a slightly philosophical point of view: how can one determine what levels are beyond their own knowledge, let alone what amount of effort it would take for them to get there and if it would worth it to do so. An experienced developer can tell a beginner what they could/should learn next to step up, but how do you determine the same for yourself?

On the other hand I strongly dislike the "in minimal time" condition. After let's say 10 years or more in programming (that's me in this case) and you say that the next step one could achieve is something that comes faster than learning a new programming paradigm? My gut feeling is that it will take me about 6 months with a strong programming background. I am not talking about learning Haskell (What could it be: a week or so?) but about understanding FP, knowing (and feeling) the fp design patterns. Depending on the investment in 6 months one probably can achieve that the application of those patterns come as second nature. That's my goal. Two questions:

1) What would give greater and longer-term benefits than that? Learning Reactive Extensions? Yet another ORM framework? Node.js? Those are only tools. One can learn them in some days when a project requires it.

2) What is the rush for? Do you remember the time you learnt OO programming? I would say to learn it properly, in the beginning of your career as most of us do it, required much more effort than to learn Haskell and FP when you are already an experienced programmer. Wasn't it worth to spend all that time to learn OO principles, design-patterns, tools, languages? And if you were stuck in the OO world throughout your career, then I am pretty sure that learning FP principles, patterns and language(s) have about the same effect on your future than OO had on your present expertise.

<comment><USER4> I think that saying you can 'learn Haskell in a week' is really short sighted. You can learn to parse a Haskell program and write a guess-the-number program in a week, but learning how to write _good_ Haskell is going to take months, if not years, especially if you want to do fancy things. Hell, I'd guess it'd take me a month or two just to learn the ins and outs of the lens library and I'm already a good Haskell programmer.

> 1) What would give greater and longer-term benefits than that? Learning > Reactive Extensions? Yet another ORM framework? Node.js? Those are only > tools. One can learn them in some days when a project requires it.

I think that unless something is completely and utterly trivial, you can't _really_ learn it in 'some days'. You can get enough of an understanding of it to solve a small-medium problem with it, but you can't actually learn it. If you want to learn something _really_ weird, try playing with higher-order polymorphism, type theory, dependent types, or something that's not 'yet another OO language/framework'.

> 2) What is the rush for? Do you remember the time you learnt OO programming? > I would say to learn it properly, in the beginning of your career as most of > us do it, required much more effort than to learn Haskell and FP when you > are already an experienced programmer.

Not for me. Really learning Haskell as an experienced programmer took as long as it took to learn Python as a novice, and I've heard similar reports from other people. I certainly agree that if you know, say, Java, learning C# probably isn't going to maximize your 'skill increase per time'. But saying that going from Java to Haskell, or even farther to something super-weird like Agda or Forth or Prolog, is just as easy as going from Java to C# is just wrong.

Personally, the reason I'm sticking with Haskell as my current thing-to-learn as opposed to jumping to other things is that I've hit that point in the curve where the language is really opening up to me; I had a small problem recently that I wanted to solve, and I was able to use some really cool techniques that don't really have simple equivalences in other languages (the pipes library, if you're curious) to solve it in a nice way.

<comment><AUTHOR> > I think that saying you can 'learn Haskell in a week' is really short > sighted. You can learn to parse a Haskell program and write a guess-the- > number program in a week, but learning how to write good Haskell is going to > take months, if not years.

That was exactly my point, sorry if it wasn't clear.

> Really learning Haskell as an experienced programmer took as long as it took > to learn Python as a novice, and I've heard similar reports from other > people. I certainly agree that if you know, say, Java, learning C# probably > isn't going to maximize your 'skill increase per time'. But saying that > going from Java to Haskell, or even farther to something super-weird like > Agda or Forth or Prolog, is just as easy as going from Java to C# is just > wrong.

I am not saying that the "Java after C#" learning curve is the same as "Haskell after C#". It isn't. But I believe that the general experience of abstract thinking that one learns in many years must give an advantage over a novice learner. I am not talking about a script-kiddie who spent five years hacking code, or somebody who has the same one year experience 20 times instead of real 20 year experience. I believe that if you spent your development life actively then you must get a new concept easier than a beginner. And not only that. Concepts of a paradigm or language leak into others. Linq in .Net leverages "monads". Eric Meijer, one of the creators of Linq, loves Haskell and they borrowed ideas from Haskell. Now, if one is a "too pragmatic" programmer, they can use Linq for years successfully and never get closer to understand monads. However is one takes the time and looks behind the curtains, they got closer to understand at least this one concept of Haskell. And I am pretty sure that over let's say 10 years you are exposed to many ideas in some way if you keep your eyes open.

As I said, my gut feeling (can't tell how good the estimation is) is that in about six months I "get Haskell and fp". But it's not black or white: obviously spending 6 more years in the fp world would make a difference. There must be a decision made (and here I agree with gfodor) when the further gain doesn't justify the investment. I won't stop at 6th month if I don't feel the power yet :)

</comment></comment></comment></comment></comment></comment></comment><comment><USER5> I'm heads down on golang right now and will continue to be so. I never _quite_ acquired C - wrote plenty of code in it, but it was always a struggle. Go's just above the threshold where my mind will take it wholescale (ala Python) and it gives me the ability to write simple code and generate cross-platform binaries from it.

One app: web, windows, mac, linux. I know that can be done with other tools too, but this is the one I've chosen. I like SQL too: old guys like weird tools!

</comment><comment><USER6> After programming for 30 years (and upwards of 20 languages) I've come to believe that you really only "need" to learn 4 languages to complete your Jedi programming skills and become a master. You need one each from the following categories:

"Machine" language - this is anything turing complete that's close to the hardware, ie that forces you to think about and understand the underlying circuitry. Candidates: Assembler, C.

Static/Imperative "Object" language - put this one off for as long as you can, for it is easy but not simple, and will ensnare your mind with the belief that you are special because you are among the elite priesthood of programmers who can grasp levels of complexity mere mortals dare not even dream of. Down this path lies years of frustration, all in service of the darkside. Chances are that this category will be forced upon you first, by naive, shortsighted fools who little realize the evil they are spreading. Learn only what you need to disable the tractor beam and escape with the Deathstar layout, so that when the time is right a well planned rebel assault may remove this abomination from the universe.

Candidates: there are no candidates here, as that implies choice. One of these languages will be heaved upon you whether you like it or not - C++, Java or Visual Basic (if the darkside is particularly strong in you).

Dynamic "scripting" language - this is for that category of problems where most of the needed abstractions are well understood and well tested. Using them should involve as few words as possible.

Candidates: Ruby, Python, Perl, Lua, bash (or any bourne shell derivative).

And finally, what should be every programmer's last language,

A "language" language - these are usually known as Lisps, but I think both Alan Kay's original bootstrapping Smalltalk and Forth are acceptable here. The key feature is having a small core of concepts that can be infinitely composed into higher abstraction commands that are treated no differently from the compiler's perspective. Once you have this power, all of the interesting behaviours of languages like Haskell, Erlang, Prolog, etc, are available to you.

Candidates: Scheme/Racket, Common Lisp, Clojure, Smalltalk, Lisp.

</comment><comment><USER7> Haskell.

Having learned perl, ruby and python (these are all incredibly similar), and then Clojure, I've found that I really like the functional paradigm. It helped drag my attention back to thinking about data structures and functions to act on that data a lot more than a ton of bad OOP examples ever have. I'm actually excited to program now instead of feeling like, "Okay, this mess of classes I'm making is going to pay off some day..."

One negative/positive is that I now kind of recoil in distaste when I find OOP-y code that's seemingly done for the sake of jamming code into a class instead of using generic functions and data types. It's funny that there's a large swath of not so useful monad tutorials, because there's an absolute _mountain_ of examples of classes/objects that don't make any sense at all. I didn't mean to make a tiny rant on OOP. Sorry about that.

As someone who has been using a lot of dynamic languages, I'm really interested to find out how a static type system can help me program better software.

</comment><comment><USER8> If you're learning Haskell, be prepared to feel like a beginner for a while.

I had great learning it. I usually pick up languages fairly quickly, but Haskell eluded me for more months than I'd care to admit. There is a great community of very smart and friendly people who helped me on IRC, and a couple of pretty good books -- [http://learnyouahaskell.com/](http://learnyouahaskell.com/) and [http://www.cs.nott.ac.uk/~gmh/book.html](http://www.cs.nott.ac.uk/~gmh/book.html).

I enjoyed the experience, and I certainly feel like a better programmer for it. But damn I felt daft for a few months!

<comment><AUTHOR> I am looking forward to that experience :) Besides the technical reasons (nice syntax, pure fp, strong typing, ...) I chose Haskell to learn functional programming because it has a very good community and documentation. It's like the entire Haskell ecosystem's been built to teach FP. Actually that was kind of the intention when Haskell was born as far as I know.

</comment></comment><comment><USER9> I spent the last year doing lisp as much as I could, and I've become a right convert. I've got some C and python down already.

This year, I am currently torn between:

-Haskell (to go full blown functional crazy) -Smalltalk (to go full blown object crazy) -Javascript (to finally write some stuff for the web/browsers) \- Java (to sell out and lose the will to live?)

Any advice is more than welcome. I'm probably looking for the "programming language that changes the way you think" aspect, since I've already got a paying job...

<comment><AUTHOR> You have Lisp knowledge, so maybe Haskell is not the best candidate for "a new way you think". Given your background I would say you probably would enjoy Scala more than Java (targeting the same JVM). I am not sure if one can learn enough from Smalltalk to justify the effort it takes to learn an in-practice useless language. If you don't speak JavaScript yet, that's a good candidate, especially if you use your FP experience in it and not just go the OO way most people do.

<comment><USER10> No, Haskell is very different from Lisp. It makes perfectly sense to learn Haskell.

<comment><AUTHOR> You have more experience here thanks for correcting me :) What I meant was that they are not two very different worlds. I myself picked Haskell over Lisp hoping to gain the benefits that I would get from Lisp but with some advantages. Would you also recommend the other way around? Learning Lisp after Haskell? I don't mean the syntactical differences or the real-world usage. Solely the "way of thinking".

<comment><USER10> Actually Haskell and Lisp a very two different worlds. Some basic abstractions are shared, but Functional Programming tends to be much much more advanced in Haskell. Haskell is the standard language for some branch of functional programming and has a good/great eco-system for that. It's main use seems to me to advance the state of art in Functional Programming and applications of it.

Lisp OTOH is a multi-paradigm languages with much more emphasis on OO and interactive development. Lisp is much more diverse and favors a very different programming style - slightly more pragmatic. Lisp had its main application domain in AI, but nowadays it's a bit more diverse - often it is used by individuals or small teams. One of the larger applications is the flight search engine of Google. Others are in music composition, planning and scheduling (satellites, people, logistics, ...), etc.

</comment></comment></comment></comment></comment><comment><USER11> Can someone make recommendations for me? Here's what I already know and what I've built with it:

\- Java. My first real programming language, learned in college, used for a year and a half in enterprise work and Android, got pretty good at it, but I learned

\- Objective-C for making iOS apps and I never want to write in Java again. I'm also learning C just to understand Objective-C more but I have no plans building anything with C.

Basically, my current interests/goals for learning a new language are:

\- Develop a new way of thinking.

\- Learn some great engineering practices.

\- Build products (software) that solve real-world problems. I'm not likely to learn a new language if I can't build anything useful with it, that can potentially sell and make it as a consumer startup.

\- Become full-stack. I can already easily build an iOS app (I have no interest in building responsive websites) but I find myself still having to rely on something like Parse. Which isn't so bad though because it saves me so much time.

I guess that narrows my choices down to: Ruby, Python, Go, or something else, but I'm not in a position to identify which poison is best-suited to me. I just want one that I can be really good at and meet most if not all of my goals. Any thoughts?

<comment><AUTHOR> Very pragmatic approach. C# if you are ok with the Microsoft stack, or F# if you are a bit more advantageous and serious about the "new way of thinking". Python is also a great investment to solve real-world problems. And don't forget JavaScript. It is not just a browser language any more: there is node.js for the server side and it is the common language of most mobile frameworks that are multi-platform targeted.

You cannot go wrong with any of these. So have a look at code samples and spend some time browsing the web-sites about all of them then choose the one that appeals the most to you.

</comment></comment><comment><USER12> There are so many languages I would like to learn :

\- Ada : everybody raves about it but nobody uses it ;-) \- Python : for everyday hacks, it's portable, simple and it's not Java ;-) \- Assembly : it's the root of everything \- C : my mind is overflowing with Arduino projects \- C++ : I'd love to create ISX extensions and make private bots for some MMO \- Prolog : just because

I will probably settle for Ada if John Barnes publish its book at the beginning of 2014.

</comment><comment><USER13> Gonna attempt to learn Haskell properly once AGAIN.

</comment><comment><USER14> I'd be interested in learning Rust. I've been learning Haskell last year and I'm absolutely loving it.

</comment><comment><USER15> Python - I'm doing far too much stuff in PHP just because that's what I know, seems to be fairly simple to learn as well, and quick which should help in the $dayjob efficiency.

<comment><USER16> Same boat. I started a django project to learn more about python for the web.

</comment></comment><comment><USER17> I learned Dart and TypeScript this year and both were fairly trivial to learn and use. The learning process improved my JavaScript skills because I had to think about JavaScript in new ways and got me ready for ES6 (For example, the discussions about iterators in Dart and ES6 was interesting.) Next up is ClojureScript, if I can get over the syntax.

</comment><comment><USER18> Planning on learning enough Erlang to understand BEAM and the OTP ecosystem, and potentially picking up Elixir if it makes sense to do so.

I think there's a lot of interesting ideas around high availability and fault tolerance to explore in the Erlang world, and I'd like to tap into that.

</comment><comment><USER19> I've started to play with Nimrod and I will definitively continue in 2014. Macros are not always easy to use but they are clean and powerful (I'm mostly a C programmer ...)

</comment><comment><USER20> I was surprised to have used nodejs in my work throughout the year, so now I'll skip the advanced (functional) javascript and go retro with c/c++/c#.

</comment><comment><USER21> I will learn Go and then happily ignore it in favor of HTML + JS + CSS + SVG all the time forever.

</comment><comment><USER22> Objective-C. Overdue.

</comment><comment><USER23> Cement my knowledge of Scheme as I work through SICP.

</comment><comment><USER24> haskell + scala + racket "yeah baby..."

</comment><comment><USER25> I will learn Ruby on Rails and node.js

</comment><comment><USER26> I will learn Scala and node.js.

</comment><comment><USER27> Well, definitely Powershell.

</comment><comment><USER28> Ruby, Python and Scala =)

</comment><comment><USER29> clojure

</comment><comment><USER30> clojure

</comment><comment><USER31> Kotlin and Go

</comment><comment><USER32> Ruby, iOS

</comment><comment><USER33> c++ or scala undecided

</comment><comment><USER34> Elixir

<comment><USER35> I'm picking on you, but could just as easily picked on most the other replies.

Your answer to this topic is only interesting if you explain _why_. Even a very brief explanation will do. As it happens, I've never heard of Elixir. Try to make me curious enough to google it.

In my case, I'll likely not try to learn any new language this year. But I am going to brush-up on the mathematics that has gotten rusty over the years. Partly because I used to _like_ math, but now rarely get to use anything beyond basic algebra. And partly to position myself better to help my kid with homework.

</comment></comment><comment><USER36> TCL

</comment><comment> workhere-io Go.</comment>


Ask HN: What factors determine app store success? - <AUTHOR>

A group of Media Effect students, under the oversight of S. Shyam Sundar (http://comm.psu.edu/people/individual/s.-shyam-sundar), is studying what factors determine whether an application is successful in app stores. Please complete the short survey at https://qtrial.qualtrics.com/SE/?SID=SV_eE6iDimiYgPLokB and watch for the publication of preliminary results in three to four weeks.<p>Thanks! <comment><AUTHOR> Working links:

Survey - <https://qtrial.qualtrics.com/SE/?SID=SV_eE6iDimiYgPLokB>

Dr. Sundar's profile - <http://comm.psu.edu/people/individual/s.-shyam-sundar></comment>


Show HN: TinyHelp - <AUTHOR> http://tinyhelp.net

<comment><AUTHOR> To be clear, this isn't really intended as a service for the HN crowd... just wanted to get some feedback on a quick/dirty product we put together. We're doing a writeup later about our plans for it, but the long and short is that we've built this as more of a proof of concept/market and we're going to automate some things and add features during our redesign over the rest of the year.</comment>


Never Lose Your Smartphone, Wallet, or Keys Again with Linquet - <AUTHOR> http://www.techvibes.com/blog/never-lose-your-smartphone-wallet-or-keys-again-with-linquet-2012-06-25

<comment><USER2> Somehow the name makes me think of a tourniquet...</comment>


Golang sucks - <AUTHOR> https://www.reddit.com/r/programming/comments/7ok5ty/cloudflare_golang_sucks/ <comment><USER2> Any blanket statement such as this is very off putting. Almost click baity. At some level almost everything sucks.</comment>


Ask HN: Why is HN predominated by pro-ChineseCommunistParty people? - <AUTHOR> Whenever I comment anything that is anti-CCP I get downvoted like crazy. Why have we forgotten what liberty is? <comment><USER2> I've had a quick look at your comments, including in this thread, and I think this is because you post inflammatory, unsubstantive comments.

Try to post substantive comments on what you disagree with about China and the CCP, show that you know a minimum the issues at hand, rather than "have we forgotten what liberty is" or "how to defeat the communists"...

<comment><AUTHOR> Hey thanks for your reply. Why dont you post from your main account? It seems like youre hiding your views from the public?

Also, I think theres substantive evidence everywhere online except in the great firewall of china that can be used to conclude that dictatorship and communism is bad. Am I really debating this right now?

<comment><USER3> The problem with your comments is not that there's no evidence to support your viewpoint, but that you're not telling anyone anything new. You're just telling everyone how angry you are. This site is for intellectual curiosity first and foremost, if it turns into an ideological battleground then only because we're not good at strictly following rules.

I'm not perfect either, but my recent comment history may give you an idea of what I mean by "telling others something new."

</comment></comment></comment><comment><USER4> Reading comments of random topics (e.g. [https://news.ycombinator.com/item?id=21190265](https://news.ycombinator.com/item?id=21190265)) most comments seem to not be siding with China. The HN community certainly isn't pro-CCP, but there are probably just random weibo drones browsing and downvoting anything they disagree with.

<comment><AUTHOR> I am getting spam downvoting on like a lot of antiCCP comments. Shouldnt HN deploy that feature that some platforms have where you cant mass-downvote one users comments?

<comment><USER5> I think they already do have measures to prevent mass downvoting, flagging, vote rings etc. Dang would know more.

Downvotes might be because your trope one liner put downs aren't adding much. "I thought the western world was immune to communism", "This place is dear to me and now theyre destroying it", what because we're exposed to views different to ours? Which "they"? Who is to say whatever downvotes you've caught aren't entirely from Western pro-capitalists?

As someone not of Asian heritage who has been active in Hong Kong related threads, has friends there, and supports the demonstrators, I can say to my eyes, it is _not_ predominated by pro CCP people. I've certainly had a discussion or two, disagreements, a different view of how history played out - they get their spin from media, we get ours. There's a few people with a distinct perspective. It's always useful to hear the opposing view, or evidence you're mistaken, even if you never reach agreement.

</comment></comment></comment><comment><USER6> We've looked into this at length on many occasions. I've seen no evidence that Chinese agents are manipulating HN. Rather, what's happening is that HN is a large community whose members come from many different backgrounds. Among those are quite a few users of Chinese descent who either grew up in Western countries or went there for school or work; and also many Westerners who have gone to China to work or for other reasons. As you might expect, these users have a perspective on China and Chinese-Western relations that is quite different from the majority population on HN which, though highly international, is well over 90% Western and whose views naturally reflect the majority views in their countries. This is what happens when people come from different backgrounds and have different experiences—they end up with different perspectives on things. I know that sounds like a platitude, but it's a platitude with consequences.

Many stories relating to the current upheaval in Chinese-Western relations have appeared on Hacker News in the last year, including several intense threads within the last few days. The majority perspective here reflects the Western demographics of the community, but the smaller group I've just mentioned, the users with different backgrounds and experiences in relation to China, is also participating in these threads. When they do, a grinding collision of icebergs occurs, as differing perspectives bump up against each other.

When people run into a view that is a little different from their own—say one standard deviation away or less—they tend to respond conversationally. Unfortunately, when they run into a view that is a lot different from their own, the standard reaction is to become hostile. Instead of curiosity and openness, people become suspicious and feel that the other person can't be speaking in good faith. They don't think "wow, that's a really different point of view". They think "astroturfer", "shill", "spy", "bot", "troll", and "communist agent". That's what we're seeing on HN these days.

Is it ok for commenters to hurl these accusations against other commenters they disagree with? No it is not. Doing so gratuitously, as a way to expunge discomfort or irritation at what someone else said, is poisonous to HN in many ways: it damages community, banishes tolerance, is uncurious and off topic. It also has a boy-who-cried-wolf or field-of-boliauns effect of making real abuse harder to track down.

Worse, when people single out others as targets of these accusations, we end up with ugly mob behavior, with individuals being falsely accused and even being run out of town (examples: [https://news.ycombinator.com/item?id=21195898](https://news.ycombinator.com/item?id=21195898) and [https://news.ycombinator.com/item?id=19403358](https://news.ycombinator.com/item?id=19403358)). None of us in our right mind wants that here.

The way to mitigate this is to have a simple rule of looking for evidence when concerns about abuse come up. If people have concerns about abuse, the site guidelines ask them to email us at email@example.com so we can look for such evidence. In the absence of evidence, insinuations about astroturfing, etc., are off topic, for the reasons I described.

This problem has a lot of complex dynamics that are not what they seem. For example, because the threads about China and Chinese-Western relations have become so intense and flamewar-prone, the users with minority perspectives who I described are often prompted to create accounts and jump into the threads when they have a strong reaction against something that was posted. Making a new account when you're hot under the collar isn't a great way to participate on HN, but it's not in bad faith either—quite the contrary. However, when such green accounts show up in these threads, espousing contrary views in already- irritated ways, the majority view-holders interpret this as an assault of astroturfers and paid CCP agents. After all, they are green accounts making pro-China comments—nothing could be more obvious! Actually, nothing could be more wrong. What you're most likely getting is (for example, let's say) a Chinese-Canadian Amazon or Microsoft employee, who's been reading HN for years and is suddenly hurt and dismayed by all the aggressive anti-Chinese comments that have been showing up on the site—or (let's say) a Chinese grad student who stayed in the US, got a good job and played by the rules, and back home in China is the one holding the other side of the argument, defending the US and his American friends to his family who have been hearing nasty things about them over there. Or it's (let's say) a Brit who went to China to do business, ended up forging personal connections there, learned lots of things that people in the West don't know, and is appalled by how ignorant the comments that are informed only by media sources can be.

Based on all the investigation I've done about this, that's mostly the human side behind those accounts. Of course there are always exceptions—one user, for example, has recently decided to become a serial troll and post virulent anti-Chinese comments (or are they anti-American? I forget), to wreak havoc on the commenters whose emotions are already running high. Ironically they seem to have been set off by a perception of horrendous HN bias against their own position on the topic, and that is how they've chosen to react. Another outlier case was [https://news.ycombinator.com/item?id=20236444](https://news.ycombinator.com/item?id=20236444), when an influx of new Chinese commenters showed up because a link to an HN thread was circulating on the Chinese equivalent of Quora.

But those cases are rare. From everything we've seen, the vast majority of comments on this topic are being posted in good faith. The tragedy is that so few users have a large-enough frame to be willing to believe that, and to hear conflicting information without going quickly into inflammation.

<comment><USER7> I wouldn't be so sure of that. State actors do an OK job of keeping their prints off of things.

What bugs me are silent downvotes. If someone disagrees, great! Tell me why.

Being quietly zapped into invisibility just feels like cowardly thought- policing.

<comment><USER6> > State actors do an OK job of keeping their prints off of things

No doubt they do. What are our options? We can fantasize about this and project our fantasies onto other users—or we can look for some sort of evidence, any evidence, before making claims. If you want to believe in diabolical state actors manipulating the community and leaving no trace whatsoever, how could that ever be falsified? The only thing you have to go by in that case are your own assumptions and preconceptions.

On HN, we choose the other fork of that branch and look for evidence. I'm not saying the bar is high, but there needs to be _something_. In the absence of any evidence at all, the HN guidelines ask users not to post insinuations about astroturfing, foreign spies, etc. Someone else holding an opposing view does not count as evidence. There is an epidemic of internet madness about this right now, and it's not in the values of this site to succumb. Perhaps everywhere else wants to be James Jesus Angleton in the wilderness of mirrors, but HN, barring catastrophic failure, is not going to go there.

\---

As for silent downvotes, I realize they sting and are annoying, but that's the way HN works. Users aren't required to explain why they downvote. If we had such a requirement, the threads would fill up with 10x the petty bickering about downvotes, and we have more than enough of that already. The thing to do with downvotes is to examine what you wrote to see what might have been objectionable about it. If you notice something, note the correction for next time. If you notice nothing, muse to yourself about the fickleness of homo internetus and move on. It's not worth posting about, which is why the HN guidelines ask you not to.

[https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)

<comment><USER7> " _the only thing you have to go by in that case are your own assumptions and preconceptions_ "

 _dang_ , you are not the only dude here who went to college.

In my own case, all I can say is that I have " _seen some shit_ ", and I would not feel totally comfortable or assured that this was all purely the result of personal, unpaid, opinions.

<comment><USER6> Educational credentials weren't on my mind. The point is this: if you have evidence, let's hear about it. If you don't, then please follow the site guidelines and refrain from making insinuations about astroturfers, shills, or spies. Someone else having an opposing view does not count as evidence.

[https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)

</comment></comment></comment></comment></comment><comment><USER8> They pay people to do that.

<comment><AUTHOR> Yeah, but even HN? This place is dear to me and now theyre destroying it. Its like they found my secret treehouse...

<comment><USER9> HN is actually quite popular website - SimilarWeb's estimate is 12.6 million visits a month:

[https://www.similarweb.com/website/news.ycombinator.com#over...](https://www.similarweb.com/website/news.ycombinator.com#overview)

<comment><USER6> It's more like 150M visits a month.

Edit: 147M in September.

Edit 2: I'm talking about page views, plus ajax requests like collapsing subthreads. If by 'visits' you mean user sessions, that number would obviously be lower.

<comment><USER9> Thanks! I heard their estimates can be wildly inaccurate, but I didn't think that can mean wrong by order of magnitude...

</comment></comment></comment></comment></comment><comment><AUTHOR> Now its even flagged. I simply asked a question that would probably be on the mind of a lot of users on here that value their privacy, liberty and human rights.

<comment><USER5> FYI, I flagged it as the question was "Why is HN predominated by...". That's presumption without evidence. Who says it is? A couple of downvotes?

I just answered a different comment with why I don't think your claim is anything near true.</comment></comment>


Standard for Public Code – a guide for cities and governments - <AUTHOR> https://standard.publiccode.net/ <comment><AUTHOR> Quotes from introduction:

"The Standard for Public Code is a set of criteria that supports public organizations in developing and maintaining software and policy together.

Anyone developing software or policy for a public purpose can use this standard to work towards higher quality public services that are more cost effective, with less risk and more control."

"Definition of public code

Public code is both civic code (like policy or regulation) and computer source code (such as software and algorithms) executed in a public context, by humans or machines. Public code is explicitly distinct from regular software because it operates under fundamentally different circumstances and expectations."</comment>


Lytro to launch 755 megapixel Cinema light field camera - <AUTHOR> http://techcrunch.com/2016/04/11/lytro-cinema-is-giving-filmmakers-400-gigabytes-per-second-of-creative-freedom/ <comment><USER2> So "light field" here is a marketing term, right? From the physics and computing side, does anyone know what they are really doing to measure depth fields?

<comment><USER3> No, it's actually a camera that really does capture and store "light field" data:

[https://en.wikipedia.org/wiki/Light- field_camera](https://en.wikipedia.org/wiki/Light-field_camera)

which links to:

[https://en.wikipedia.org/wiki/Light_field](https://en.wikipedia.org/wiki/Light_field)</comment></comment>


Actually I use Rdio, Not Spotify, Your Link Is No Good To Me - <AUTHOR> http://liisten.com/actually-i-use-rdio-not-spotify-your-link-is-no-good-to-me

<comment><USER2> This is exactly the problem that <http://toma.hk> and <http://www.tomahawk- player.org> are trying to solve.

Their approach: your library becomes (title, artist, album) tuples, and then songs are found at whatever provider you use when you want to listen.

The devs are mostly ex-Amarok and everything is on GitHub: <https://github.com/tomahawk-player>.

</comment><comment><USER3> URL shortener for music links that then redirects to user's preferred music service (saved for future) anyone?

<comment><USER4> Isn't that Google is becoming? Type in the title of a song and click "I'm feeling Lucky."

<comment><USER5> Probably NSFW if you are into Goregrid or something...

</comment></comment></comment><comment><USER6> I thought MusicBrainz had great potential in this area, as a common and open database of artists/albums/tracks - and Spotify _used_ to have support in their API to search based on some of those.

<http://forums.musicbrainz.org/viewtopic.php?id=3463>

Ultimately unless someone uses MB and/or other data sources to create an aggregated 'music translation' service - whether it's entirely offline translation, translation-on-demand, or some kind of mix - I'm not sure how this is going to happen with so many proprietary platforms.

</comment><comment><USER7> This is a big part of the reason why I like Grooveshark. It's totally beyond me why nobody ever mentions it in discussions about music services, it's easily the best thing around.

<comment><USER8> Because it's unlicensed and just waiting to be shut down. People who know about it try to keep it on a low profile so it doesn't get targeted.

<comment><USER9> Last I heard they were getting sued for like $15 billion by one of the Big 5, guess the cat's out of the bag.

</comment></comment></comment><comment><USER10> Good point, I also like his idea at the end, though as a browser extension instead of a twitter client extension.

<comment><USER11> I built a chrome extension that helps with this problem. It doesn't let you store a preferred service, rather you throw in a song url to and it'll spit back a few urls pointing to that song on Rdio, Spotify, Last.fm, and Grooveshark. You can try it out here: <http://goo.gl/jLocb>

</comment></comment><comment><USER12> I worked / am working on something that Tyler discusses in his follow-up article.

It's called <http://trackpile.com> and it allows easy sharing from Spotify to Rdio, and vice versa.

Would love if you guys could check it out!

</comment><comment><USER13> More importantly - the follow up

[http://liisten.com/i-dont-use-the-same-music-service-as- you-...](http://liisten.com/i-dont-use-the-same-music-service-as-you-can-we- still-be-friends-part-2)

</comment><comment><USER14> there are many free sites with music, i try to use them as long as their around , <http://cloud-vibe.com>

</comment><comment><USER15> Web Intents, the Web equivalent of Android intents. It would certainly help to solve this issue.

<comment><USER16> I was also thinking of Web Intents. This problem is not unique to music services but all kind of web application and services. I <3 Intents!</comment></comment>


Shutting down Google+ for consumer (personal) accounts on April 2, 2019 - <AUTHOR> https://support.google.com/plus/answer/9195133 <comment><USER2> Yesterday's discussion: [https://news.ycombinator.com/item?id=19040966](https://news.ycombinator.com/item?id=19040966)

</comment><comment><USER3> As usual, don't rely on any Google service to stick around long-term unless it's search, GMail, or Maps.

They'll probably shut down Google Translate any day now...

</comment><comment><USER4> And nothing of value was lost.

<comment><USER5> thats not true. there are several communities that exists happily within it and are sad to see this service go. because there isn't much of an alternative out there.

</comment></comment><comment><USER6> They should shut down Google+ for internal use as well. Looking at some of the leaks of that traffic that have come out, it's clearly having a pretty toxic effect on their professional culture.

</comment><comment><USER7> I don't know how to replace Google+, I use it as a personal social network for my family. We share stuff only in our circles. Is there something out there that could replace it?

</comment><comment><USER8> Funny how Google tends to end services we like almost overnight but this Google+ piece of crap still lingers.</comment>


Ask HN: Service that maintains a list of proxies, vpns, tor ips, etc? - <AUTHOR> Hi,
I'm looking for a service that maintains a list of proxies, vpns, tor exit nodes, whatever that could masquerade a user so that they could cheat a system.
Something that netflix employs to determine whether someone is using a VPN or not.  I hear that have been pretty good at it.
Does something like this exist, maybe someone knows a really good provider?
I know I could probably scrape a whole bunch of sites and aggregate the information.  But I really want something up to date and I don't want to spend time maintaining it either!
Oh and this isn't for advertising purposes, should you be wondering.
Thanks <comment><USER2> [https://check.torproject.org/exit- addresses](https://check.torproject.org/exit-addresses)</comment>


Show HN: Resume Generator for Software Engineers - <AUTHOR> https://gitconnected.com/resume-builder <comment><AUTHOR> This is something I built to solve my own pain - creating and maintaining a high-quality resume.

Any feedback or insight would be much appreciated.

While I wouldn't consider this in beta, it is still early in how I imagine it evolving. Additional features I plan to implement are: 1\. Entirely open source 2\. Templates (built by myself or the open source community) 3\. Custom CSS 4\. Versioned / multiple resumes 5\. Standalone offline generator</comment>


Show HN: Is My Website Taken? - <AUTHOR> http://ismywebsitetaken.com/

<comment><AUTHOR> Disclosure: I made this site explicitly as an alternative to instantdomainsearch. So far, I like my UI better (who doesn't love angry bears?), but they appear to be faster still...

</comment><comment><USER2> I think you may be overloaded so it takes about 7 seconds for me to see the result of the autosuggest.

Hence, I think you should at least have an activity indicator :)

</comment><comment><USER3> Love the overall concept!

How is this different from iwantmyname.com? Although it does lag sometimes, it still covers a wide range of TLDs.

</comment><comment><USER4> Great idea, but that name just screams "entitled". It's not _my website_ unless you actually own the name. :)

<comment><AUTHOR> The entitlement is for the user to feel! That's what the bear is for. He's angry that someone took his domain name.

<comment><USER4> Haha. Good save. :)

</comment></comment></comment><comment><AUTHOR> Also, the funny thing is that now that it's on HN, it is no longer "faster," as the footer proclaims. :(

</comment><comment><USER5> I'm fond of www.bustaname.com for combining keywords in every combination.

</comment><comment><USER6> Would never use for fear of domain snatching.

Yes, I've seen it happen.

<comment><AUTHOR> How would that happen? Like my server saves your searches and quickly registers them before you?

Wouldn't I have to have a load of money for that to be viable on my part?

<comment><USER6> You can review the domains, even automate parts of the review process.</comment></comment></comment>


DisplayPort and USB 3.0 Named Among Top Technologies of 2010 - <AUTHOR> http://blog.allion.com/displayport-and-usb-3-0-named-among-top-technologies-of-2010/

<comment><USER2> The year has barely started and we're already naming the top technologies that have come out this year?

Let's at least wait until December rolls around before making statements like that who knows what's under the radar.

Most of the entries were pretty lame anyway, the graphics one in particular.

</comment><comment><USER3> Unlikely. USB 3.0 isn't as revolutionary as it may sound with eSATA in the mix, and external storage is really the only reason most people would need USB 3.0 over USB 2.0.

DisplayPort is cool and will hopefully catch on but with HDMI and DVI-D already out there it's not at all revolutionary.

The biggest computing technology change in 2010 will likely be the growing adoption (due to increasing quality and lowering prices) of SSDs. They've been on the market for a while but the affordable ones used to be crap (slower and less reliable than a magnetic disk) and the good ones were targeted at industry and correspondingly priced out of the reach of the individual. Not to mention a few hickups along the way (such as poor wear-leveling implementations causing massive performance degradations over time). In late 2009 there was finally a convergence of all the critical factors: several key SSD quality issues were addressed, leading to higher quality SSDs; high quality consumer grade SSDs started to hit the market, which delivered the huge performance boosts that people had been expecting; and SSD prices fell into a range where they became attractive to many PC enthusiasts.

Prices will continue to fall, capacities and quality will continue to go up. In 2010 the default high-performance workstation configuration will include an SSD (at least for the OS). By the end of 2011 or so I suspect the majority of notebook models will use SSDs rather than magnetic disks (it just makes sense, not least because speeding up the process of coming out of or going into hibernation by one or two orders of magnitude huge win on a notebook).

Now, WiMax is a much more revolutionary technology than all the rest, but only very much farther down the road when it is much more widely adopted.

</comment><comment><AUTHOR> I agree with you on SSDs. There is a lot of potential for market growth in 2010. Allion has a SSD testing program in its Taiwan location and will be extending that service to our US lab soon. We are pretty excited about it and expect this to help adoption in the coming years. As for DisplayPort, its ability to support longer fiber optic cables with better signal quality is still a great improvement.</comment>


A simple No-SQL key-value db using self-modifying ruby script - <AUTHOR> http://narenonit.blogspot.in/2012/12/a-simple-no-sql-key-value-db-using-self.html <comment><USER2> Eh. A better aproach if you necessarily have to kill kittens by writing self modifying files would be to put the data in the __DATA__ field of the file. That way you get a separation between code and data and don't have to eval anything.</comment>


Tutanota enables first-ever search on encrypted data, code published open source - <AUTHOR> https://tutanota.com/blog/posts/first-search-encrypted-data <comment><USER2> If only they weren't the world's most popular place for phishing gangs to hide out and exploit cloud services with stolen credit cards.

</comment><comment><USER3> > Encrypted data must be searched locally. This has never been done before

Except, say, by every pop or imap client that caches locally, for decades?

<comment><USER4> Which mail client is capable of indexing encrypted data? Some do it, if all encrypted mails are stored decrypted on disk. That is a completely different story.</comment></comment>


Two months after FBI debacle, Tor Project still can't get an answer from CMU - <AUTHOR> http://arstechnica.com/security/2016/01/going-forward-the-tor-project-wants-to-be-less-reliant-on-us-govt-funding/ <comment><USER2> >... a few weeks earlier had canceled a security conference presentation on a low-cost way to deanonymize Tor users. The Tor officials went on to warn that an intelligence agency from a global adversary also might have been able to capitalize on the vulnerability.

This is kind of worrying. I hope the Tor Project has information on the attack is looking into ways to mitigate this. But if it's due to the protocol nature, then maybe it's time to look for a successor (we aren't using WEP anymore, right?)

As to the CMU stuff... Tokyo University has this pledge to make sure basically no military research is done on campus, which I feel to be pretty laudable.

I wonder if there's a similarly worded pledge for this sort of thing. But at the same time, universities can do a lot of good security research that can, in the end, strengthen the systems we use.

The "$1 million to target these specific people" sounds dirty, but "$1 million to do research on the vulnerabilities of Tor"... well that sounds like research to me. Pretty tricky.

<comment><USER3> > Tokyo University has this pledge to make sure basically no military research > is done on campus, which I feel to be pretty laudable.

So, you move it off-campus. See e.g. the MIT Lincoln Lab, [https://www.ll.mit.edu/](https://www.ll.mit.edu/)

<comment><USER4> I'm at MIT proper and a good portion of our team's medical device work is DOD funded. While we are primarily designing devices to be used in civilian hospitals, our diagnostic devices could also potentially be used to optimize battlefield care for soldiers, which I personally think is great.

I think a wholesale ban on military research is pretty silly; the ethical implications of projects should be considered on a case by case basis by the university.

<comment><USER5> _> the ethical implications of projects should be considered on a case by case basis by the university_

How's that work during Vietnam when the DoD dangled bags of money in front of universities?

<comment><USER4> I can't speak to that as I wasn't alive then and have not researched the topic. Care to elaborate?

<comment><USER5> As someone who wasn't alive then either, it's a rather well documented period of history, albeit mostly in dead tree form. Karnow is probably the classic ([http://www.amazon.com/gp/aw/d/0140265473/](http://www.amazon.com/gp/aw/d/0140265473/)).

To use a more modern analogy that exists on the internet, the 2010 US military research / development / testing budget looks like it was around USD$80b.

Or in other terms, roughly equal to the total of all research spending by all other branches of the US government. ([http://www.aaas.org/sites/default/files/RDGDP_1.jpg](http://www.aaas.org/sites/default/files/RDGDP_1.jpg))

Now you're a university professor / dean / president. Times are hard (they always are, you're in academia). There's a huge pie sitting right next to the one you've been fighting over, and all you have to do is work on certain technologies that may or may not have lethal consequences.

I wouldn't take the bet on many people saying "No thanks, I'll be happy giving up grant money for moral reasons."

</comment></comment></comment></comment></comment></comment><comment><USER6> The intelligence community used to value Tor. Remember where it came from. Now they don't, presumably because the primary intelligence target has shifted from fixed actors like nation states and large businesses to the general public. Now those nation states and businesses are 'intelligence partners' in the fight against the 'lone wolfs' hiding within the masses. Perhaps then it is in Tor's interests to restart some rivalry between nation states.

<comment><USER7> NSA is schizophrenic in that regard. Remember that one of the things it does besides looking in everyone's underwear drawers is it also advises US govt (3 letter agencies, military) on what crypto to use. In other words it tells Uncle Sam how to lock his underwear drawers so other agencies don't peek in there.

It is always interesting to see what they say there. Because if they know, for example, one type of crypto technique or implementation is vulnerable will they still recommend it for TS classified material storage? Will they recommend for US military or diplomatic service? If they don't, it might leave that open to attack, and they are not doing their job. If they do say "don't use this combination of AES, prime numbers, or OpenSSL implementations", that also gives something away.

I wonder if people people who make these recommendations even talk to people who discover, exploit, and actively penetrate systems? Because everything is very compartmentalized, they actually might not be able to.

That is why they are probably very interested (like we saw) in somehow subverting or weakening some algorithms and implementation so they are the only ones that have a key (Dual_EC_DRBG) , or they are the only ones that potentially have a computational capacity to exploit (DES).

<comment><USER8> NSA themselves have used Dual_EC_DRBG (which can be distinguished from a PRF even if you don't have the 'backdoor key': it's not just backdoored and slow, it's _bad_ \- and they know that). GCHQ behaves even worse and is at this point almost entirely out of control.

In either case, I feel information assurance and signals intelligence arms really should never have been the same agency: they are roles entirely at odds with each other and do not seem to even have their own governments' equities properly balanced, nor their recommendations always having been given in good faith. So be cautious drawing any conclusions from their advice.

Unfortunately, that is not the sort of 'reform' that either government is interested in, particularly my own. It's quite depressing, really.

<comment><USER7> > NSA themselves have used Dual_EC_DRBG

That actually makes sense because of the way it was backdoor-ed. What they did there is the golden standard of subverting and backdoor-ing a crypto algorithm: go through a standards body, backdoor-ed it by using a public- private key. They hold the private key. Encourage others to use the system as much as they can (which includes showing the world that they themselves use it).

NSA have been having dreams of key escrow forever. It seems since the 90s, that dream was further and further from reality. But they didn't completely give it up. Dual_EC_DRBG was effectively becoming that key escrow they wanted for all the system that used it and they got to keep the private key and thus have a high enough assurance others won't use their backdoor.

Whoever was in charge of that operation, was probably patting themselves on the back every morning after waking up.

</comment></comment></comment></comment><comment><USER9> I worry about Tor's security:

1) For security, most systems rely on their obscurity and on the fact that the assets they protect probably aren't worth much investment by the attackers. Tor can't rely on either of those circumstances: It's prominent and breaking into it is a one-stop solution to attacking many valuable targets.

2) Many organizations with large amounts of resources, from state intelligence agencies to law enforcement to security vendors to ISPs, would like to find solutions to hacking Tor security inexpensively.

3) True security is very difficult and expensive. For Tor, this is taken to an extreme by #2. Does the Tor Project have the resources to implement bug-free software (e.g., the kind that flies passsenger planes)? Certainly not. Can they find and fix bugs as quickly as the attackers described above find and exploit them? Certainly not. I'm not criticizing them; they just don't have the resources.

4) Assuming the underlying concept of onion routing is secure, there still are plenty of targets for attacks such as implementation and all the other code Tor relies on (e.g., almost all of Firefox for the Tor Browser, encryption algorithms, your OS, etc.). Attacking a Tor user doesn't seem impossible.

Based only on the theorizing above, and not knowing about Tor's actual implemenation, I fear that we're lucky if Tor still is expensive to attack. Of course, any smart attacker with an exploit will publicly complain how hard Tor is to hack.

<comment><USER10> If you look at Tor's concept. It's pretty clear that it cannot be considered secure.

Each time you use tor your packets actually go through a path of 3 different servers (or relays). If the attacker owns the two ends it's game over. How many relays are there out there? How many are owned by the NSA or other gov?

It's pretty obvious that this system just cannot work because a majority of relays are owned by the attacker.

</comment></comment><comment><USER11> This continues to reflect very poorly on CMU and CERT.

<comment><USER12> Yes, but if they're under some Kafkaesque gag order there not much they can do right?

<comment><USER13> I still find it hard to ever trust an institution that wouldn't raise a huge stink about the ethical implications of this. They don't exist to serve "national security interests", that's what the NSA is for.

<comment><USER14> > They don't exist to serve "national security interests"

Yes they do. From their website:

"The Software Engineering Institute (SEI) is a not-for-profit Federally Funded Research and Development Center (FFRDC) at Carnegie Mellon University, specifically established by the U.S. Department of Defense (DoD) to focus on software and cybersecurity."

<comment><USER15> I interpreted the parent comment as saying that _CMU_ doesn't exist to serve national security interests, whether or not there is an entity, like the FFRDC SEI, that does exist for related reasons.

On one hand, leading academic institutions are commonly understood to have a responsibility to preserve free speech (especially speech that is critical of military or government action), remain as a neutral education and research body decoupled from any specific political or military agendas, and help lead in social progress towards greater overall ethical standards in education, research, and scholarship.

On the other hand, many universities loan out the credential and status of being affiliated with them as a recruitment tactic to assist the DoD in the task of creating a diversified set of military research organizations, which from a superficial observation point of view (the view taken by many of the younger engineers duped into working for below market pay at such places) _look like_ run-of-the-mill software/science/engineering jobs while having all sorts of ethical gray areas, and the end result is to create rampant ethical conflicts of interest, questionable management practices, and many other problems.

I don't think it's as simple as just pointing out that SEI is an FFRDC and moving on. The fact that universities in general continue to perpetuate this problem -- academia-military pseudo-credible research facility affiliation and status-mongering -- _that_ is the bigger issue.

</comment></comment></comment></comment></comment><comment><USER16> From what I've gathered, TOR is pretty robust at least on paper, and when explained in an academic way it has me almost convinced that the apparatus does what its supposed to, except for the part where it catastrophically fails when put into practice, like when:

1.) Custom Firefox 'Browser Bundles' which do not auto-update and ensure latent vulnerabilities are left un-addressed

2.) Trusted 'Third Parties' running exit nodes who we hope and pray are doing their job correctly

3.) Weird and non-innocuous looking domains on the wire that do nothing more than alert the neighborhood that somebody's using TOR (Unless everyone's using it you stand out like a sore thumb)

4.) Sybil attacks in the form of people-with-more-money-than-you polluting the network

5.) ???

6.) Any number of other issues (which have since been patched in the past), but still work if the TOR user is uneducated about how TOR works (traffic analysis / correlation attacks / zero-knowledge-proof attacks, etc)

</comment><comment><USER17> > Personally, I use it maybe 10, 20 percent of the time. I know that there are > people out there that are using it a lot of the time. But for me as much as > I might hate Flash, there are times that I need to watch something on > YouTube.

YouTube has been working for me using Tor Browser for months, if not years.

<comment><USER18> That was an analogy, not a bug report.

<comment><USER19> That's an example, not an analogy. It just so happens that the example is completely false.

</comment></comment></comment><comment><USER20> In what way is this an FBI debacle? The F35 is a debacle as is the TSA. But the program the FBI was running to deanonymize TOR users? Not even close.

</comment><comment><USER21> It's two months after the FBI debacle and people still don't know the difference between CMU and CERT.

<comment><USER15> I don't think universities should get a free pass on whatever their affiliated FFRDCs might do. If the university wants to be disassociated from an unethical action, do so by severing the tie between the university and the FFRDC, and stop lending credibility and credential to the FFRDC via the university's reputation. Otherwise, accept the fair guilt by association that will follow.

</comment></comment><comment><USER22> I'm waiting for someone to build an implementation of Tor in a proof- verifiable language.

That would be pretty cool, since anyone could prove source correctness automatically.

<comment><USER23> That would help with things like the memory safety of the daemons you run, but that hasn't been the problem when Tor has failed its users.

Tor has failed its users because the idea of running a public Tor cloud with volunteer entry, onion, and exit nodes is ludicrous. It means that the entire network is under surveillance all the time, the exact opposite of what you want. There has been widespread confirmation that the data you transfer via the public Tor cloud is being passively surveilled at the endpoints and actively modified when you, for example, download software. This makes it incredibly dangerous to use, likely more dangerous than just using the regular internet.

There are many other problems (like the fact that .onion sites are a dirty hack and likely have many undiscovered weaknesses like the ones CMU found) but nearly all of them are either deployment or architectural issues, not code security issues.

<comment><USER22> Yes, I agree. When I wrote the parent comment I was thinking more about implementation detail correctness: memory safety, protocol implementation correctness, etc.

Like you said, Tor has architectural issues. Tor would be fine if it were low- profile, but it's not, and that's a major part of why the architecture is breaking down - it doesn't scale well with increasing users/publicity/nation- state-interest.</comment></comment></comment>