Ask HN: The value of ideas - <AUTHOR>

I'm new to this whole startup thing, and the one thing that keeps getting hammered at on all the websites and blog posts and expert advice I've been reading is that, basically, ideas are useless. You need a great team and great execution.
I agree that great execution is essential, but I think that the value of ideas is being unfairly put down. You need both a great idea and great execution to fully succeed. They are both necessary links in the chain of success. If one of them is weak, the chain breaks. I don't think saying one or the other is more important is correct.
For example, if you do a web search for "Ideas are a dime a dozen. The money is in the execution" you'll see tons of examples. My take: Ideas may be a dime a dozen, but great ideas are rare.
Look at Google. It was based on their idea for PageRank. Of course it required great execution, but without that idea, it would have been just another search engine, instead of the phenomenon it is now.
It is like if carpenters said that furniture design is nothing, the key is the craftsmanship. Yes, craftsmanship is necessary to make a good piece of furniture, but if no one designs a good piece, they will just make crap, and make it very well.
Another area is movie-making. Today, studios have gotten excellent at making good-looking movies. From set design, to costumes, to special effects, they can construct any scene you can imagine. But, without a good script the movie is crap.
The same thing holds for startups.
Execution in want of a great idea is sterile. It is useless. (Of course so is a great idea in want of a great execution)
Is the "ideas are useless" meme being put out there just because so many newbies to the startup culture are too enamored with their ideas and think that the idea is all that matters, and so they have to be hit hard with the "ideas are useless" to snap them out of that thinking and start valuing execution? <comment><USER3> If you take a look at successful companies you'll find that the ideas behind them are in no way unique, and more often than not they're not based on an idea but on a market. Here are the ten most profitable companies in the Forbes 1000 list and what they do:

ExxonMobil - Oil & Gas Operations

Gazprom Russia - Oil & Gas Operations

Royal Dutch Shell - Oil & Gas Operations

Chevron - Oil & Gas Operations

BP - Oil & Gas Operations

PetroChina - Oil & Gas Operations

General Electric - <USER2>

Microsoft - Software & Services

Toyota Motor - Consumer Durables

Nestlé - Food, Drink & Tobacco

Only General Electric and Microsoft seem to be based on an idea, the others adress a market and create a product to fit that market. And it can be argued whether these are successes because of the idea - Edison tried thousands of different configurations before he actually invented the lightbulb, and Microsoft bought their first hit-product DOS from Tim Paterson and became successful by selling it, not inventing it. Execution apperas to have been paramount in their success.

These examples aren't unique. Even Google, often touted as the canonical "idea" company couldn't sell their technology, even though they tried. They only created Google after futile attempts at selling the idea to among others Yahoo.

<comment><AUTHOR> "Even Google, often touted as the canonical "idea" company couldn't sell their technology, even though they tried. They only created Google after futile attempts at selling the idea to among others Yahoo."

Yes, idea+execution is what matters. But, without the great idea, the execution doesn't amount to much, at least in the high-tech area (in the industrial/manufacturing/oil business, there is not much room for new ideas, so of course execution is the primary determinant of success)

Before Google came out with their search algorithm, there were lots of companies trying to do search. I believe Altavista was considered the best at the time.

What did Google have that all these other search engines didn't? Was it execution? I doubt it. A lot of very capable people were and are working on many other search engines, and yet none has the market penetration that Google has. What Google had was a much better algorithm, i.e. a much better idea on how to rank search results.

</comment></comment><comment><USER4> Let's play a thought experiment:

I'm Paul Graham, and I've got a fantastic, knock-your-socks-off idea for a business. How much will you pay me for it?

OR

I'm Travis. I've got a mediocre idea, but have spent a lot of time learning about my customers and market. I've built a kickass piece of software that solves the pain. But, again, my idea isn't that great (think Craigslist: the idea of online classifieds isn't exactly a great one, or a novel/clever one...) Will you pay me more for this?

<comment><AUTHOR> Regarding "I'm Paul Graham, and I've got a fantastic, knock-your-socks-off idea for a business. How much will you pay me for it?":

First off, if you patented it, and I can see a lot of value from licensing the idea, then yes, I will pay a lot for it.

Second, I don't get why people are so focused on valuing an idea in-and-of- itself. Just because when some Joe says "I have a great idea" we don't attach any monetary value to that, doesn't mean that "ideas are useless".

It's like if some Joe says "I'm great at executing". Nobody will pay him for that. That has no monetary value. But that doesn't mean that "execution is useless".

It's the combination of idea+execution that has monetary value.

<comment><USER4> Ok, I agree that specific ideas have value. However, I think they're not very valuable regardless of quality, because there is little to differentiate a high quality idea from a low quality idea until they are executed. Then your differentiation takes place after-the-fact, making it useless at early stages.

If specific ideas are to have specific value, there must be a common method of differentiation. How do you tell the difference between a high quality idea and a terrible one?

Finally, if ideas have so much value, how come the market has basically been against the "idea guy", and almost entirely values execution (success = traction, revenue)?

</comment></comment></comment><comment><USER5> Ideas matter, but not that much. We'd all rather have good ideas than bad ideas, which proves theres some value in the idea itself.

But _GREAT ideas_ usually come from some form of execution and iteration. Great ideas just don't come from sitting and brainstorming what to build your startup into. Using your comparison of Google's pagerank, PageRank wasn't drummed up and perfected as an idea before it was executed. Sergey and Larry probably had a concept (born from their research and creativity) and executed it. What evolved is what we now and call PageRank. So great ideas are really only recognized after the fact.

<comment><AUTHOR> I agree with your statement "GREAT ideas usually come from some form of execution and iteration". Yes, sitting down and trying to implement something inevitably shows its weaknesses and, if you're smart, helps you improve it.

Regarding "Ideas matter, but not that much" : If they don't matter that much, why don't VCs and YC omit that part and just ask you who you are and what your track record is? If execution is the most important thing, they should not even ask what the idea behind the startup is, since if you have a great team with great execution track record, then surely you will find something to implement and execute on, right? The fact is, the ideas behind startups are asked about, because just having some brilliant executioners sitting around trying to find something to execute brilliantly doesn't make sense. Ideas do matter.

<comment><USER5> PG said something like "good ideas are evidence of how smart you are". VCs want smart people, and great ideas combined with great founders make for a great combination - _on paper_. VCs are in it to make money, so they have to play their percentages. Seeing good ideas helps validate the founders.

Ideas also change over time. Sometimes overnight. If one day you think you've got a great idea, and a few months later you've evolved into something else, then really, how great was the original idea?

<comment><AUTHOR> Did the idea behind Twitter, Facebook, Google, Wikipedia, etc change overnight?

Yes, startups do often change their idea overnight, and that shows that the original idea wasn't great, but that doesn't mean that there are no great ideas.

By the way, the "good ideas are evidence of how smart you are" is a bit BS. If all the VCs and/or YC cared about was that someone was smart, and since there are _tons_ of other indicators (where they went to school, how many other successful startups they had, other smart people say how smart these people are, etc.), then if the VCs and/or YC knew by some other indicators that a group was comprised of very smart people then they wouldn't need to know what the idea behind the startup is.

The fact that VCs and YC always ask what the idea is behind the startup before funding it, even when they know the team is full of very smart people (e.g. from multiple successful previous startups), it means that they don't just use your ideas to gauge how smart you are. They really do care what the idea is.

</comment></comment></comment></comment><comment><USER6> Let me try another tack. You're out with a friend and your friend remarks on a great service.product he/she just bought that's brand new. Yet you had the idea for that product too. You tell your friend this. Do you really expect your friend's honest reaction to be anything other than, "So what?" See, your idea never got anywhere -- while it was in your hands. The idea became great when someone brought it to market.

<comment><AUTHOR> But that doesn't at all prove that ideas are useless.

It just proves that ideas+execution is what matters. After all, the person who ultimately made the product your friend bought, needed the idea for the product before getting off his butt and executing it.

Just because some people have "great ideas" and never get off their butt to execute them doesn't diminish the value of great ideas to people who do execute.

<comment><USER7> You're missing all the actual _work_ involved in actually executing on that idea. It is only when this process begins do you develop the idea, iterate on it, and uncover new sub-ideas that actually matter or are more integral to money making or bringing it to market etc than the initial "great idea" in the first place. Looking over these comments it seems you are just unwilling to accept that execution is the process of developing an idea into something that has value. All ideas initially are worthless.

</comment></comment></comment><comment><USER6> Ideas are useless in the sense that at any one time, _many_ people could have the exact same idea. Ideas do "get in the air." So in that respect, ideas can be seen as commodities. It's getting the idea out there as something people can buy/use that _matters_. All writers understand this. It's not the story that was never written or never published that matters -- it's the story people can read or buy.

<comment><AUTHOR> Let's take "The Da Vinci Code" as an example. How many people had the idea behind that book? Not that many. Yes, Dan Brown had to sit down and write it, but it's the storyline (the "idea" behind the book) that got millions of people hooked worldwide.

From what I have read, it seems Dan Brown isn't that good of an author anyway. Thousands of other writers could have written the story better than he did, if he had commissioned them to do so.

There are tons of excellent writers out there that would write "the Great American novel" if only they could figure out what to write about. So, it's not the execution but the great idea that is a more rare resource.

<comment><USER6> >>>Let's take "The Da Vinci Code" as an example. How many people had the idea behind that book? Not that many.

There was a big plagiarism suit in England about this, so it's not the best example. Besides which, you will learn on your own that ideas are less important than _realizing_ them. It's a hard lesson to learn and it took me many, many years to see it, You will too.

<comment><AUTHOR> So what if it was plagiarized? The idea is what made the book successful. Whether that idea was Dan Brown's or he stole it from someone else says nothing about the value of the idea behind making "The Da Vinci Code" a huge hit.

</comment></comment></comment></comment><comment><USER7> The problem is ideas do not exist. It is only when they morph into a tangible reality that they can be tested, verified, iterated on, and developed.

Put another way, an idea can be as great and fantastic and beautiful and groundbreaking as you dream it up to be - but none of that matters if it exists in your head only. _Only_ when the idea enters a tangible reality can you really verify these claims. Does it work? how the hell do you know if it does not exist?

PageRank was _verified_ to be a good idea only after they built a tangible search engine to test it with. And I'd argue their initial idea was iterated upon so much through the course of these real-life tests, that you can no longer give overwhelming credit to some spark of genius that bolted into sergey's head one fine day. It's about testing and iteration _in real life_ not about mystical ideas seemingly sent down from the stars - that to me is why ideas are worthless.

</comment><comment><USER8> If you have the ability to execute on your idea to test it's validity, then it's worth a lot! Think Chatroulette...hotmail....youtube...etc. Conversely, if you can't execute on the idea then it's worth far less and you should share it widely, get feedback, and work towards building a team around the idea that can execute upon it....

I think the meme has gotten popular because it's mostly oriented to people that can't execute on their ideas....and thus it holds some truth.

</comment><comment><USER9> A lot of this is about definitions.

 _An_ idea is useless.

 _A_ piece of execution is useless.

 _Execution_ means taking an idea, any idea, trying it out _and then coming up with new ideas at the same or lower level and trying them out_.

A good high-level idea by itself? Totally worthless. A team that can take a bad high-level idea, morph it into a mediocre one, then, through trial and error pound out the thousands of little ideas that make a business hum? Awesome.

<comment><AUTHOR> As I mention below, I don't get why people are so focused on valuing an idea in-and-of-itself. Just because when some Joe says "I have a great idea" we don't attach any monetary value to that, doesn't mean that "ideas are useless". It's the combination of idea+execution that has monetary value.

Also, regarding your definition "Execution means taking an idea, any idea, trying it out and then coming up with new ideas at the same or lower level and trying them out", is this the accepted definition of "execution"?

I thought execution was (1) Using tools to build the idea, (2) Using tools like SEO optimization, web analytics, conversion tracking, Google AdWords, etc to make your site visible to the masses and make it "sticky" to users, (3) Using marketing, blogging, social networking, contacting tech media, etc, to get the word out, and (4) Adapting to user feedback to modify your main idea to make sure it is closer to what people want.

Only (4) is related to your definition, and is not the main thing I think of when I think of "execution" regarding a tech startup.

And people keep bringing up the act of morphing the initial idea into something that works. As I mentioned below:

(a) If the original idea gets scrapped, then, yes, it wasn't that great to begin with. That doesn't mean there are no great ideas,

and

(b) Did Google, Facebook, Twitter, Wikipedia, change the original idea behind these sites? Yes, the details may have changed, but I think the fundamental idea behind each of these has not changed. Most of the great hits out there are still doing what they started out to do.

<comment><USER5> Look up the story behind Facebook. Its not like Mark Zuckerberg had an idea, wrote it up, and approached investors.

He _executed_ , plain and simple.

</comment></comment></comment><comment><USER10> _Is the "ideas are useless" meme being put out there just because so many newbies to the startup culture are too enamored with their ideas and think that the idea is all that matters, and so they have to be hit hard with the "ideas are useless" to snap them out of that thinking and start valuing execution?_

I wouldn't exactly phrase it that way, but I think that does sum it up fairly well. I have spent a lot of time around the "gifted" community and I think an awful lot of extremely intelligent people are fundamentally lazy because, compared to most folks, they tend to skate through life and don't really have to work that hard.

When I was in 11th grade and a member of a college level math honor society, I tutored a mentally retarded 10th grade girl who had gotten herself into algebra. No one else in the honor society doing tutoring wanted to tutor her because it was too hard to teach her. So I always ended up working with her. She worked harder for her C's and D's than I ever did for my A's and B's. She never got in a snit over not understanding something. I learned to explain math concepts at least 3 ways without breaking a sweat and up to 12 ways if that was what it took. It was one of the most valuable experiences I ever had.

After something is built and makes a billion dollars or so, the world calls the founders/originators "geniuses". People who have the subjective experience of routinely being smarter than everyone else in the room often have trouble with certain realities and are often overconfident in their abilities in some ways -- for example, they tend to think if you disagree with them or have some criticism, you simply are too dumb to understand and can't possibly have a real point. They tend to think this because repeated experience in the real world has taught them this is typically true. So I think a lot of very smart people kind of identify themselves with the after-the-fact pronouncement of "genius" and gloss over what it took to accomplish the stuff that ultimately convinced the world this label was appropriate. And I think that is why you see this mantra that ideas aren't worth dirt, you actually have to roll up your sleeves and do the work to have anything of value.</comment>


FCC urged to investigate Verizon's statements on utility rules - <AUTHOR> http://arstechnica.com/business/2015/01/fcc-urged-to-investigate-verizons-two-faced-statements-on-utility-rules/ <comment><USER2> So, a lot of folks are missing the point, which is that the investigation asks for perjury charges.

Verizon swears up and down in FCC filings it is not a title II common carrier _FOR THE FIBER LINES_ (it always has been for PSTN). But in it's statements to state regulatory commissions and it's franchise agreement with states/municipalities state specifically that it is upgrading/building THE FIBER LINES under Title II.

This is because Title II allows them to do so without getting further permission/process from the state.

You can't tell the FCC one thing, and state regulatory agencies the other.

The rest of this filing should have been removed. Press statements/etc are pretty much irrelevant, and they should stick to the simple facts. Anything else will just be fodder for arguing over when it doesn't matter.

For those wondering about perjury, there are a number of federal perjury statutes (the most general that i'm aware of being 18 USC 1621, [http://www.law.cornell.edu/uscode/text/18/1621](http://www.law.cornell.edu/uscode/text/18/1621)).

If you tell the federal government something, and it includes the words "I declare under penalty of perjury, ....", and you are knowingly misrepresenting something in that document, you have committed a felony.

(In the case of tax returns, it's at least two felonies, since there is also a specific tax return perjury statute, and in either case it doesn't matter whether you owe the IRS money or not)

<comment><USER3> But Verizon definitely provides a Title II service over those fiber lines, telephone service. It is required to. It doesn't really advertise it, but you can buy it. In Fios areas the entire telephone system is replaced by a single FTTH. Verizon is a common carrier, Title II, telephone provider.

Currently its ISP service is not a Title II service.

The FCC common carrier rules are about services not the underlying network technology.

The statements aren't even contradictory, let alone so obviously contradictory that they were knowingly lying.

<comment><USER2> "But Verizon definitely provides a Title II service over those fiber lines, telephone service. It is required to. It doesn't really advertise it, but you can buy it. In Fios areas the entire telephone system is replaced by a single FTTH. Verizon is a common carrier, Title II, telephone provider."

Sure, but it then claims to use Title II to do upgrades to it's ISP service capacity on those licenses, which is ... contradictory.

If the agreements, etc, said "we will perform necessary upgrades to telephone service over fiber lines under Title II, all others will be under Title X", that would be different. But they don't. The claim it all falls under Title II.

So they are definitely contradictory.

</comment></comment></comment><comment><USER4> The Net Neutrality 'debate' is an example of politics I'm beginning to see all the time in the United States. A real problem is presented along with a single problematic solution from which voters, with as much or little influence they actually have, and their representatives are asked to select the 'lesser of two evils'.

The real discussion is not whether the country's big media duopoly should be forced to conduct their business model like a public utility or not, but whether a duopoly is healthy at all. If communication infrastructure requires few large investors and centralized ownership it is a natural monopoly and should be managed as such (and in fact resold on a market of small service providers a la the UK's internet and American power). If it does not, let anti-trust law hammers fall. Comcast and Time Warner consistently collect the very worst consumer reviews (Comcast was the worst of all corporations for year running). They are both larger and more predatory than Ma Bell was leading up to 1984.

<comment><USER5> You have to put the telecom debate in the proper historical context. It's not some sui generis issue. It's part of a broader debate about how much involvement government should have in regulating services. There was a time when the government told trucking companies how much they could charge for a shipment. The overwhelming trend since then has been to deregulate industries if possible, or replace heavy-weight regulations (rate setting, etc) with lighter-weight ones. Full-on Title II represents 1970's-style regulation that neither party wants to go back to, which is why the debate is between no action at all or "Title II with heavy forebearance."

People talk about regulating telecom like the power company, but the trend over the last 30 years has been to deregulate the power companies as much as possible.

NB: The UK example is a poor one. British Telecom was originally a government entity, and was "privatized" under agreements that made clear that they would be subject to constraints. In contrast, since 1996, the telecoms have invested tens of billions of dollars in capital under the premise that the industry was deregulated.

<comment><USER6> Regulation, in this and many cases, is a way for the government to ensure that companies don't use the privileges granted to them by the government (such rights to lay cable lines) as an anti-competitive tool - which they naturally will try to do. The privileges have to come with restraints - else bad things happen.

<comment><USER5> The premise of your contention is false. Websites like Ars have perpetuated this misconception that the cable companies have exclusive rights to put wires in the ground.[1] But I have not been able to validate this idea with my research. Every franchise agreement I've read makes clear that it isn't exclusive.

Which is exactly how Congress chose to deal with the possibility of companies abusing exclusive rights to put wires down on public rights of way--by making it illegal for municipalities to give them exclusive privileges.

[1] E.g. [http://arstechnica.com/information- technology/2013/08/snubbe...](http://arstechnica.com/information- technology/2013/08/snubbed-by-google-fiber-mad-at-comcast-baltimore-seeks-its- own-fiber). Ars talks about how Baltimore's franchise agreement with Comcast "effectively makes the company the exclusive cable television provider in the city." (Quoting the Baltimore Business Journal). If you actually read the 2004 franchise agreement, it clearly says it's not: [http://www.baltimoregrassrootsmedia.org/PublicAccessTV/Franc...](http://www.baltimoregrassrootsmedia.org/PublicAccessTV/FranchiseAgreement/FranchiseAgreement.html) ("City hereby grants to Franchisee, subject to the terms and conditions of this Agreement and the Franchise grant ordinance, _a non-exclusive Franchise_ with the right, privilege and authority to construct, operate, repair, maintain, and reconstruct a Cable System on, over, under upon, across, and along the Public Ways within the Franchise Area in accordance with the City's specifications and this Agreement.")

<comment><USER7> In your research, how many other companies has built a Cable System in Baltimore? If its non-exclusive only on paper, and in practice a monopoly, what actually effects does it have on quality, service, and price?

<comment><USER5> You're changing the goal posts. We were talking about companies using "privileges granted to them by the government (such rights to lay cable lines) as an anti-competitive tool." Comcast is a near-monopoly here in Baltimore (though, I'm one of the lucky ones who has FiOS that Verizon managed to sneak in when the city wasn't looking), but it's not because they abused their privileges.

Ars makes it seem like Comcast bamboozled the city into signing an exclusive franchise agreement, but in reality nobody else wants to build here for the same reason Google didn't want to build here. Large parts of the city are a burned-out husk, a quarter of the population is below the poverty line, and it's unacceptable in the eyes of the city for anyone to just build-out to the parts of the city that might be able to afford fiber service.

<comment><USER7> My goal posts is not to vilify Comcast as a company in bed with government, but to find an explanation to why there is a near-monopoly. If a company has poor service, bad quality, and high prices, there should be competitors that are willing to earn revenue by competing with better service, better quality and lower prices. This is basic theory of the market, and as it goes, only government intervention allows for a monopoly in that environment.

So what is it. No person willing to fund a company in Baltimore? No investors willing to spend the _same_ price as Comcast, or less if a smart founder can out-perform the past production cost?

If you can explain the monopoly without invoking government intervention, I am all ears.

<comment><USER5> First, you said the issue was: "companies ... use[ing] the privileges granted to them by the government (such rights to lay cable lines) as an anti- competitive tool." Now you're saying the issue is: "explain[ing] the monopoly without invoking government intervention." Do you not see how those are two different contentions?

The Ars Technica narrative is that we need to regulate the telecom companies because they abuse their privileges to keep out competitors. But what's keeping out competition is, e.g., Baltimore forcing companies to build fiber service to the 25% of the city that's below the poverty line as a pre- condition for building anywhere in the city. It's Bill de Blasio turning FiOS deployment into a civil rights issue.[1] It's not clear to me how these requirements are the result of telecom companies abusing their privileges. And it's not clear to me how the solution to a problem created by over-regulation is imposing even more regulation.

I'm not a anti-regulation type. If a telecom company is digging under roads in a way that's hazerdous to public safety or the environment, that should be regulated. But this is an issue that turns mainstream liberals into Nader-ites espousing thoroughly discredited regimes like Title II. For god's sake Kushnick thinks the government should be in the business of telling companies _what prices they can charge._ As someone too young to remember the 1970's, it comes across as insanity.

[1] [http://www.speedmatters.org/blog/archive/new-york-mayor- bill...](http://www.speedmatters.org/blog/archive/new-york-mayor-bill-de- blasio-rags-on-fios) ("If you can't afford to feed your family by the end of the month, you can't afford $75 a month for the broadband service. And that's what we have to fix.")

<comment><USER8> >But what's keeping out competition is, e.g., Baltimore forcing companies to build fiber service to the 25% of the city that's below the poverty line as a pre-condition for building anywhere in the city.

Why is that pre-condition supposedly preventing companies from building infrastructure? It's not as though the City has also demanded that they operate at it a loss, merely that they build out service to the entire city as opposed to building service out to the choicest bits. And, isn't that exactly what a city government _ought_ to do?

<comment><USER5> See the math here: [http://bits.blogs.nytimes.com/2008/08/19/a-bear-speaks- why-v...](http://bits.blogs.nytimes.com/2008/08/19/a-bear-speaks-why-verizons- pricey-fios-bet-wont-pay-off).

It costs you $1,000 just to pass a house, even if they don't subscribe, and you have to maintain that infrastructure too. If 40% of passed houses subscribe (Verizon has been struggling to hit that number for years), you pay $2,500 per house that does subscribe. This is the "uptake ratio" and a fiber provider lives and dies by that number.

Build-out requirements tank your uptake ratio, because you spend a bunch of money passing houses where people can't afford to subscribe. It increases how much you need to make on all the other houses to recoup your costs.

But your other subscribers don't give a shit about your costs. They're willing to pay, e.g., $100/month for triple play, and they don't care if your per- house cost is $2,000 or $4,000. If you raise your prices to recoup your costs, they'll just stick with the incumbent, again tanking your uptake ratio.

A small ISP may be willing to ask for a $10 million bank loan to wire up a yuppie neighborhood like Fells Point, with the prospect of seeing how it goes and building out from there. Nobody will ask for a $250 million bank loan to wire up the whole city of Baltimore.

<comment><USER7> I do not take it that Comcast is charity, so either they made a horrible deal and lost significant amount of investment, or the narrative is lacking some details. I personally doubt we will find a $250 million investment in Comcasts books regarding the city of Baltimore however, as I find there is simpler narratives that would match in how cities like Baltimore gets fiber into peoples homes. It would also explain why some cities has has semi-monopolies and others don't.

A city that wants fiber has the obvious choice to subsidize the investment of a large ISP, say Comcast, thus severely reducing the investment cost. The permission to build is of course non-exclusive, but the subsidizing is not. Once built, the ISP gained a government granted advantage, and thus a monopoly is born.

Alternative, a city can create a government bid for administrating and building a city fiber network. On paper, this mean that the city owns the fiber, and the ISP that builds it has to sell access on equal ground with competitors. The ISP do still get an advantage in operation knowledge, some payment for doing the administration, and first mover advantage. This tend to result in healthy, if somewhat constrained, competition.

Ars Technica narrative talk about how the cable division paid little or no construction costs. That is very different aspect than if the permission to construct, operate, repair, maintain, and reconstruct a Cable System is non- exclusive.

<comment><USER5> > A city that wants fiber has the obvious choice to subsidize the investment > of a large ISP, say Comcast, thus severely reducing the investment cost. The > permission to build is of course non-exclusive, but the subsidizing is not. > Once built, the ISP gained a government granted advantage, and thus a > monopoly is born.

Cities don't subsidize cable companies. Indeed, they extract concessions from them. E.g. every time Comcast re-ups the contract in Wilmington, DE, where I used to live, they have to kick in a random couple of million to government programs.

> Ars Technica narrative talk about how the cable division paid little or no > construction costs.

Who cares what division within the ISP paid the construction costs? At the end of the day, the money came from the company's paying customers, not the municipalities.

<comment><USER7> If that is true, we will see Comcast try to sell off its losses in the coming years, and if that fails, go bankrupt. No company, no matter size, can keep a failing investment indefinitely.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> It seems like the issue is that regulated utilities are not really private companies, though we like to pretend they are. The segment of Verizon that provides voice service is effectively a government agency, and if they make money, the rest of the company is not allowed to use it for something else. I'm a pretty free-market guy, but this seems worse than having phone service just be publicly run. This is the worst of both worlds.

</comment><comment><USER10> Abraham Lincoln was not just a great president, but could probably be considered a psychic in many circles:

"I see in the near future a crisis approaching that unnerves me and causes me to tremble for the safety of my country. . . . corporations have been enthroned and an era of corruption in high places will follow, and the money power of the country will endeavor to prolong its reign by working upon the prejudices of the people until all wealth is aggregated in a few hands and the Republic is destroyed."

<comment><USER11> It is a fake quote:

[http://www.npr.org/templates/story/story.php?storyId=1251690...](http://www.npr.org/templates/story/story.php?storyId=125169095)

[http://www.snopes.com/quotes/lincoln.asp](http://www.snopes.com/quotes/lincoln.asp)

<comment><USER10> On the other hand, here is contrary reference: [http://www.ratical.org/corporations/Lincoln.html](http://www.ratical.org/corporations/Lincoln.html)

Not interested really in figuring out the real source. There's enough substance to the quote that I think it stands on its own.

<comment><USER11> The Ratical source has been debunked, see the snopes link.

 _Pedigree for this quote is often asserted by pointing to the 1950 Lincoln Encyclopedia, compiled by Archer H. Shaw, which "authenticates" the quote by citing a purported 1864 letter from Lincoln to one Col. William F. Elkins found in Emanuel Hertz's 1931 book, Abraham Lincoln: A New Portrait. However, this source is fraudulent: the Elkins letter reproduced by Hertz was a forgery, and Shaw, a sloppy compiler, added the bogus letter to his encyclopedia (along with several other pieces of Lincoln apocrypha) without verifying its authenticity. As historian Merrill Peterson, author of Lincoln in American Memory, noted of Shaw's work: Read more at [http://www.snopes.com/quotes/lincoln.asp#TmQ2MSs5eXjUah3P.99...](http://www.snopes.com/quotes/lincoln.asp#TmQ2MSs5eXjUah3P.99*)

<comment><USER10> I guess I have no stake in it one way or another, but it's an interesting problem nonetheless...

It's honestly too bad none of us have real time to put into digging up and verifying this stuff on our own. The snopes source says "was a forgery...added the bogus letter to his encyclopedia (along with several other pieces of Lincoln apocrypha) without verifying its authenticity" but doesn't give reference to how this is known, or by whom it was confirmed to be a forgery.

The only other point made is that given the author's (Merrill Peterson) knowledge: "Nonetheless, Peterson concluded, even Lincoln's wartime experience and pro-labor credentials don't justify the attribution of the 'money power' warning to him".

And the other reference 'W.J. Ghent' is an article in a newspaper where he's giving what appears to be an opinion. According to his wikipedia page, he was not a historian: [http://en.wikipedia.org/wiki/W._J._Ghent](http://en.wikipedia.org/wiki/W._J._Ghent)

It's hard to read the article given that it's scanned copy of the newspaper from 1905, but here it is: [http://goo.gl/Qfsqry](http://goo.gl/Qfsqry)

So we have an argument that the letter was fraudulent without references to who asserts this, and we have the author's own authoritative "spin" as justification that the letter wasn't real.

I'm no historian, but if the "forgery" claim is based on the fact that they can't pin the handwriting to Lincoln's own, is it out of the question that the letter was transcribed?

On the other hand we have a reference which claims to contain a letter written by Lincoln, the original of which may or may not still be in existence. Who knows how far down the rabbit hole we could go just to figure this out. Instead perhaps it's best to leave it to the internet to argue the point further if they decide to.

</comment></comment></comment></comment></comment><comment><USER12> I mentioned the same thing the other day [1]. I don't quite get why telecoms providers who are running ISP services over their lines are not already regulated by the same standard. A phone call is an analogue audio message sent over phone lines - guaranteed transit. An early modem was also an analogue audio message sent over phone lines - guaranteed transit. Nowadays, we simplify a few phases and have pure digital IP telephony and internet access - not so guaranteed. But it's still the same thing...

[1] [https://news.ycombinator.com/item?id=8857793](https://news.ycombinator.com/item?id=8857793)

</comment><comment><USER13> They should do the same with AT&T:

[https://www.techdirt.com/blog/netneutrality/articles/2015010...](https://www.techdirt.com/blog/netneutrality/articles/20150108/10422129635/att- plays-legal-pattycake-with-ftcfcc-jurisdiction-common-carrier-law-just-so-it- can-pretend-limited-data-service-is-unlimited.shtml)

</comment><comment><USER14> I for one think we should put this off for another 5 years minimum. I've been seeing lots of little guys pop up around my area, and I know network equipment is about to get a lot better. I'd rather pay more for my internet than fuck up an entire tech sector.

<comment><USER15> They need to at least stop ISPs from manipulating smaller state agencies and local authorities into keeping competition out. There needs to be some blanket policy opening up fiber laying to anyone capable and willing, in addition to the dissolution of (I'd prefer all) spectrum ownership to enable more wireless deployment and adoption.

</comment></comment><comment><USER16> But those aren't contradictory statements at all? Title II let Verizon charge more for phone service which was used to fund broadband. Verizon also says that Title II for broadband would harm additional investment for broadband. Both statements can easily be true. (emphasis _can_ ) There's nothing "red- handed" about this.

<comment><AUTHOR> The alleged red-handed part is that Verizon used Title II to build out fiber lines under the guise it was improving its telephone service, but was actually using the fiber for broadband services which it does not want regulated under Title II. Sounds like the proverbial "having your cake and eating it too".

</comment></comment><comment><USER5> Unsurprisingly, it's Bruce Kushnick that's doing the urging: [https://www.google.com/search?q=kushnick&sourceid=ie7&rls=co...](https://www.google.com/search?q=kushnick&sourceid=ie7&rls=com.microsoft:en- US:IE-Address&ie=&oe=&rlz=&gws_rd=ssl#safe=off&rls=com.microsoft:en-US:IE- Address&q=kushnick+rayiner+site:news.ycombinator.com). [1]

The irony of the article is that it's kind of right in a way that really undermines the whole premise of the argument. Suppose that Verizon did use "Title II money" (i.e. revenues from rate increases on wireline subscribers) to fund FiOS deployment. That may very well not be kosher according to the rules, but that just goes to show that the rules are ridiculous. Should we launch a federal investigation to see if Apple subsidized iPhone development by increasing Mac prices?

I like Ars, but they've been beating an anti-telco trumpet recently that's totally detached from reality. Ars paints telecom service as this cash cow, but the fact of the matter is that nobody in the U.S. is making money on fiber on deployments of any substantial scale. It's not clear that Verizon is even earning a positive return on the thousands of dollars per household it has invested in FiOS in many markets: [http://www.businessweek.com/magazine/content/11_13/b42210461...](http://www.businessweek.com/magazine/content/11_13/b4221046109606.htm) (In the PNW: "He estimates the project will end up having cost Verizon $4,000 per connected home. Moffett calculates the present value of acquired subscribers at $3,200 each. That would give FiOS a negative $800 net present value per customer.")

Wall Street wants Verizon to get out of the wireline business entirely, and it's precisely because there's little return on the billions in required investments, coupled with the regulatory swamp that is Title II.

[1] Kushnick's whole shtick is that there's some rate that's okay for a telecom carrier to charge, and any price increase beyond that rate is a "subsidy" from the public to the carrier. Hence, Verizon raising rates on its _own customers_ to pay for its fiber network is some sort of questionable act. Applying Kushnick logic to another industry: if Apple raises prices on Macs and uses that cash to bankroll iPhone development, well that's something that requires a federal investigation.

<comment><USER17> >Verizon raising rates on its own customers to pay for its fiber network is some sort of questionable act.

No, his point is that using Title II status to legally enforce rate increases under the guise of telephone upgrades and then using that money to invest in a completely different business (cable and broadband) is a questionable act

And further, to take advantage of this status as Title II to increase capital investment and then turn around and claim that Title II decreases capital investment is glaringly hypocritical.

I do agree, however, that Ars is on an anti-telco hunt these days.

>Ars paints telecom service as this cash cow, but the fact of the matter is that nobody in the U.S. is making money on fiber on deployments of any substantial scale.

This is a really misleading sentence. I agree that fiber deployments arent a big money generating enterprise, is any capital investment? They make money off of subscribers, not capital investment and they certainly are raking in plenty of cash doing so (over 120 billion revenue in 2013 for verizon)

edit: added the phrase 'questionable act'

<comment><USER18> Anti-telco hunt? They're on a pro-consumer hunt, and we should be thanking them for it. If the incumbent's have their way we'll be stuck paying per MB for _ALL_ data while the rest of the world laughs away.

<comment><USER5> It was the last generation of "pro-consumer" types that got us into the current mess to begin with. Because at the end of the day, Verizon and AT&T may not like Title II, but they have the legal horsepower to deal with it. It's the smaller potential competitors who can't deal with the extra taxes to fund rural deployment, or having to build out to neighborhoods too poor to subscribe to fiber service, or having to petition rate authorities to set their prices.

<comment><USER19> > smaller potential competitors who can't deal with

Ok, you've got my attention

> extra taxes to fund rural deployment

Well, no, the small guys don't have extra (federal) taxes imposed on them, unless they're interstate.

"Every telecommunications carrier that provides interstate telecommunications services shall contribute, on an equitable and nondiscriminatory basis, to the specific, predictable, and sufficient mechanisms established by the Commission to preserve and advance universal service." S.254(d)

On the other hand, even if they are interstate,

"The Commission may exempt a carrier or class of carriers from this requirement if the carrier's telecommunications activities are limited to such an extent that the level of such carrier's contribution to the preservation and advancement of universal service would be de minimis." S.254(d) continued

They may, however, have extra (state) taxes imposed on them:

"Every telecommunications carrier that provides intrastate telecommunications services shall contribute, on an equitable and nondiscriminatory basis, in a manner determined by the State to the preservation and advancement of universal service in that State." S.254(f)

But that same section limits what kind of additional regulations states can impose:

"A State may adopt regulations to provide for additional definitions and standards to preserve and advance universal service within that State only to the extent that such regulations adopt additional specific, predictable, and sufficient mechanisms to support such definitions or standards that do not rely on or burden Federal universal service support mechanisms."

> having to build out to neighborhoods too poor to subscribe to fiber service

Well, yes.

That's kind of what the universal service fund is _for_.

> having to petition rate authorities to set their prices.

That's what that whole forebearance thing is about. Nobody wants to put that kind of rate control on ISPs. (I'd be all for putting that kind of rate control on backbone-tier ISPs, though)

<comment><USER5> I don't get your point. Are you saying that small carriers should be exempt from a tax big carriers have to pay? And that this solution is better than just getting rid of the stupid tax in the first place?

> That's kind of what the universal service fund is _for_.

No, USF is mostly for rural areas. I'm talking about build-out requirements in franchise agreements, which makes building in poor neighborhoods a prerequisite for building anywhere in the city. We'd see a lot more small fiber companies if they were allowed to operate only in expensive neighborhoods where they could sell a premium service at a premium price.

<comment><USER19> > I'm talking about build-out requirements in franchise agreements

Which section of Title II defines that?

<comment><USER5> Who said it was in title II? I said it was the result of well-meaning "pro- consumer" types who have created a thicket of requirements that makes going into the telecom business highly undesirable.

See, e.g., Google's blanket rejection of such requirements as a pre-condition for deploying Google Fiber.</comment></comment></comment></comment></comment></comment></comment></comment>


Mozilla to Certificate Authorities: no subordinate CAs for traffic interception - <AUTHOR> http://blog.mozilla.com/security/2012/02/17/message-to-certificate-authorities-about-subordinate-cas/ <comment><USER2> I think CA's are problematic nevertheless because they involve a third party I never invited. I would much prefer to have a ssh style public key fingerprint that you must verify and accept for one site, and know that once I've decided to trust them, nothing can come between me and them unlike with SSL certification chain. I would prefer to receive my bank's public key on paper when signing up for online banking and verify that it equals what I see when I first connect to their servers.

This reduces the MITM to the initial handshake. This could be worked out _to a degree_ with some p2p scheme or a set of DHTs for popularity count. Fingerprints would be submitted to a public service that accumulates submissions from different users, identified by the same public key used to sign the submissions. Trustworthiness would be weighted based on the history and age of the users' submissions: someone who has used the same public key and submitted fingerprints for five years is likely to be a real user that you can trust instead of a bot that generates new identities in order to submit false fingerprints to launch a MITM. There are numerous ways to implement this.

One positive thing would be to bring the same attention to trustworthiness to people's minds that they must employ in "real" life as well, i.e. offline. A website that's never fraudulent or genuine (unless you got it in writing) but shades of trust more reflects the interactions we encounter in real life (can I trust this guy because my friend said he's ok?).

<comment><USER3> > This reduces the MITM to the initial handshake.

Mostly. No matter much you trim your certificate chain, there's nothing preventing Google/your bank/Amazon/etc from sharing their private key with, say, Uncle Sam. However, the backdoor admin access that the gov't gets to sites like TwitterFace and Gmail probably makes that a pointless effort.

Confidentiality/Authenticity are pretty much impossible to guarantee unless you control everything on both ends.

<comment><USER4> Um, that's not MITM then is it?

I mean yes, if you're paranoid enough you probably should build an underground bunker in the mountains and grow your food, but objectively there is a huge security difference between whatever shenanigans a trusted partner may be up to and a large body of auto-trusted with potentially leak able-to-who-knows- where subcerts.

</comment></comment></comment><comment><USER5> Suppose you visit <https://mail.google.com/> from inside a corporate network.

Assuming ideal scenarios no one can snoop on your traffic between you and Google because of SSL.

If a company wants to monitor you they have lots of options. One option is to try and record all traffic between you and Gmail. However if the try to do that your web browser will pop up a warning saying mail.google.com is pretending to be someone else.

To get around this a company can create fake certificates that are trusted by your browser. Then they need to intercept the traffic and basically pretend they are gmail all the way recording you.

Ignoring the fact that companies already have a lot of rights to snoop on whatever you do this is just bad precedent.

<comment><USER6> See dektz's reply. Companies create their own CA cert (you can do that using e,g. openssl) and use domain policies to install it on every machine they control. Then they can setup a proxy that takes the CA cert and dynamically generates certs for each domain that is accessed over HTTPS (Squid can do that).

<comment><USER7> So this article is suggesting that this practice is wrong and will not be tolerated or that the root CA authorities should not be the ones to generate the certificates?

<comment><USER8> No.

There is nothing wrong with creating your own CA root certificate and installing it on computers you use. People do this all the time. For instance, web testing proxies all synthesize a fake CA root cert, because otherwise they wouldn't be able to run tests against HTTPS sites.

What happened here was, a company didn't want to go through the (significant) bother of installing something in thousands of computer systems. So they did an end run around the system and got a complicit CA to in effect add them to the _global Internet CA root system_ , which they had no business being a part of. Since the certificate they minted in this process appeared to browsers to be a real, signed, chained-from-the-roots CA=YES cert --- something nobody can make for themselves, not being able to do that being the whole point of SSL/TLS --- they didn't have to install anything. On any computer. Anywhere on the Internet.

</comment></comment></comment></comment><comment><USER9> Awesome news, finally someone stands up to the blatant misuse of trust. I work in such a company where SSL mitm is a part of day-to-day development. It is disgusting that the security of SSL is broken for the sake of corporate control over its workers.

<comment><USER8> Mozilla was faced with what appears to be the worst possible abuse of the privilege of being a Mozilla CA root. The abuse happened for commercial purposes. The transaction that occurred was on its face abusive of the CA system. The CA hasn't (and probably can't) name the company that was given illegitimate CA privileges.

In response to this, Mozilla sent out a letter. That letter doesn't even instruct CAs not to sell subCAs! It says, "don't sell them for MITM purposes".

I think Mozilla is between a rock & a hard place here, but there is no spin I think you can put on this story in which Mozilla stood up against abuse of trust.

<comment><USER10> > Mozilla is between a rock & a hard place here, but there is no spin I think > you can put on this story in which Mozilla stood up against abuse of trust

I'm not sure it's worth our energy to be so disappointed in Mozilla here. That "they're between a rock and a hard place" precisely _is_ the spin within which they stood up against abuse of trust.

They have sent out a letter _so far_. One of your worries appears to be that it sets the precedent that companies who do what Trustwave did can expect (only) letters in the future. But (iirc, and perhaps even in the bugzilla thread) one of the stated purposes of the letter is to set the opposite precedent: to publicly warn commercial CA's that future bullshit will result in distrusting.

I happen to think Trustwave had plenty of warning without the letter, but this particular hard place is particularly thorny because Mozilla is such a central policy hub. That's a problem you touched on above, that we agree needs a fix, but it's the way things are today.

The other half of the hard place is that before Trustwave pulled this BS, they issued a whole lot of legit commercial certs to a predominantly innocent user population. And you know, they can and should all go acquire certs from someone else, but they can't do that overnight. So if we really want Trustwave to get distrusted, I feel like we should focus our energy on a) telling people that Trustwave sucks and urging them to migrate, and b) paying attention/effort to initiatives like the one you mentioned from MM.

<comment><USER8> I'm mostly with you. But Mozilla could issue a blanket moratorium on the issuance of CA=YES certs to external organizations; Verisign would, during the moratorium, only be allowed to issue chained CA certs for Verisign properties.

They could do that today. Nothing would break.

Then they could spend some time --- spend as much time as they like, really --- coming up with a policy that allows extraordinarily trusted companies to sponsor and sign subCAs.

But they didn't do that. It's not just that they only issued a letter; it's that the letter is comically weak.

</comment></comment></comment></comment><comment><USER11> For the uninformed, what does this mean? (Btw, I did read the post; I just didn't understand it.)

<comment><USER12> Apparently some root certificate authorities have been issuing certificates that lets others generate their own, valid certificates at their own discretion. Sounds these subordinate CA certificates are being used for SSL man-in-the-middle attacks (<http://en.wikipedia.org/wiki/Man-in-the- middle_attack>). So say your employer wants to monitor everything you're doing at work. In order to get around the fact that a lot of your network data is encrypted, they put in a device between your network connection and the internet that looks at all your network traffic. For any connection that is SSL encrypted (like https pages), it will forge its own valid certificate, and use it to prove to your web browser (etc) that nothing is wrong with the connection. Meanwhile, its logging the content of your Gmail, etc.

<comment><USER13> This is the unfortunate flaw with SSL and TLS. The certificates are bound only to the "domain name" which is a wobbly concept at best without DNSsec to validate your DNS responses.

Anyone clever enough to create a DNS redirector that turns paypal.com into 10.0.0.2 on their closed network could also create an accompanying SSL certificate that they own for paypal.com and you'd be none the wiser as they proxy all of your traffic through their server, logging every bit of it.

<comment><USER8> Wait, what? No they can't. The whole point of SSL/TLS is that you _don't_ trust the DNS.

The only way an attacker can redirect DNS for Paypal _and_ have a valid- looking CA for Paypal is if they compromise a CA root certificate. That's the point of SSL/TLS.

Before you suggest "but we can't trust the CAs", note two things: (1) if you don't trust the CA, SSL/TLS isn't doing anything for you anyways, and (2) DNSSEC also has a hierarchical PKI in which you are required to trust commercial enterprises --- or governments, explicitly.

<comment><USER13> SSH has more robust security than SSL seems to if only because once you've established a connection with a remote host, whereupon their public key is displayed and validated, it can be saved as "trusted".

The same principle doesn't seem to apply for SSL in browsers where, so long as it's signed by a "trusted" authority, there's no question the certificate is valid.

There has to be a better way than this.

</comment></comment></comment></comment></comment><comment><USER8> This is being read as good news, as Mozilla sticking up for its own users by enforcing a new control on its CAs. But what it actually reads like to me is a surrender. For once, I'll line up with the howl- at- the- moon crowd and say that, excepting the fact that Mozilla might have been boxed into a corner here, this is a bit of a travesty.

What you're not getting in this story is the following set of facts:

* A Mozilla-approved CA appears to have sold one of its customers a CA=YES cert --- in other words, they sold one of their customers the ability to be a CA.

* The customer wanted the cert to implement a "data loss protection" system. These are systems that either sit on the network or on everyone's machine and scan traffic to make sure people aren't exfiltrating company secrets. DLP systems want to see inside of SSL/TLS traffic.

* You don't need a CA cert to look inside the SSL/TLS traffic of your users. What you're meant to do is, create your own self-signed CA root certificate and _install it yourself_ in all your users' browsers. Yes, this is painful.

* So instead of incurring that pain, this particular company got a CA to, in effect, _install that certificate in the browser of every computer on the Internet_. That they didn't intend to MITM the traffic of every one of those computers is beside the point.

* Instead of the exact audit and certification process used by Mozilla to add new CAs, this chained sub-CA was audited by the CA itself. But: before you say, "well at a minimum you'd hope the CA audited them!", you should know: _the primary business of this particular CA is auditing_.

* The CA didn't appear to have told anyone this for a long time (I want to be careful to point out that I don't know exactly what the timelines are here; from the CRLs, it doesn't look great).

* Something happened that caused the CA to announce that they had issued the cert.

* A long discussion happened on Mozilla Bugzilla, under a critical security blocker bug that more or less requested that the CA be removed from Firefox.

* Publicly, the policy response from Mozilla was, "they came forward, and removing their cert from the roots is an extreme punishment". I think behind the scenes, getting rid of this CA was problematic for other (valid) reasons.

* So instead, stern letter to all the CAs. Yay! The Internet is safe again.

I don't know how much more cut-and-dry an abuse of the CA system you can get than selling your CA status to random unnameable companies so that they can implement MITM systems.

But more than that: it is simply batshit crazy that CAs are allowed to sell CA=YES certs at all. I don't get it. Maybe someone working at a browser vendor can reply to this comment and explain to us why any one company is trusted to make a decision like that for the entire Internet?

I am a vocal and public fan of SSL/TLS, and I've even on occasion stuck up for X.509 (horrid as this certificate format is). But this stuff here is the part of the SSL/TLS system that the privacy zealots are right about. I'm hopeful that we'll see adoption of a system like Moxie Marlinspike proposed with "Convergence", where instead of blindly accepting Mozilla's policy decisions (and updating our policies once- in- a- blue- moon), we'll have end-user- selectable trust roots and thus an incentive for someone (maybe the EFF) to do a good job running such a root. I'm also hopeful that at some point we'll manage to figure out a UX for website trust that is better than what we came up with in 1997.

<comment><USER10> Many great points; some more perspectives in the bugzilla thread here:

<https://bugzilla.mozilla.org/show_bug.cgi?id=724929>

There are a number of choice quotes, but my two favorites are from Jacob Applebaum (@ioerror if you aren't already following him):

"TrustWave needs to be congratulated and as a reward, I think they should have their CA distrusted."

And another commenter 'Philip' (sorry I don't lurk there and don't have more detailed identity info for him...his words more than stand alone though):

"Trustwave appears to issue certificates directly from its root - this is not good practice. The root should be kept offline and never - ever - have a path to the internet." ... "the trust chain was broken at the root level, so that is where this branch, and all leaves, must be pruned"

So I guess this is where I break slightly from tptacek's opinion: I'm not yet 100% convinced that the issuance of CA=YES certificates by public CA's is an abusive practice.

Installing organization-specific self-signed roots in all company devices is more than just 'a pain'; it's fundamentally impractical for any organization that wants to let employee-owned or public devices onto its network. So just don't do that? Or just put all the uncontrolled devices onto some airgapped public network? Well, airgapped according to whom, and as of what last physical audit date? Should all organizations that implement DLP have physical security measures similar to DoD installations, where a guard with a gun makes it clear that your iPad should be left locked in your car in the parking lot?

Not saying everything's cool, just saying "it's complicated." What _is_ clear is that Trustwave added at least a couple extra layers of supreme jackassery in this case.

Trustwave's issuance of a CA=YES certificate _directly from their topmost root_ is the most distressingly unprofessional method they could have chosen. That choice alone, in my view, is a coherent argument for why a) their root should be distrusted, and b) they deserve (at minimum) a long cool-down period before an alternative Trustwave root CA becomes a candidate for addition to the default trusted set.

<comment><USER8> Companies already do device-by-device interventions for all sorts of other security policy issues, from making sure machines aren't going to spread malware to ensuring that USB drives can't be used to exfiltrate data. If a company's employees want to bring their own devices on-site, they can have the company's root cert installed; that's the cost of using your own device on the company's network. That's not an unprecedented policy.

<comment><USER14> ...and it doesn't even _matter_ if the employee-owned devices don't have the employer CA certificate installed; their traffic still gets MITMed and DLPed just fine. It's just that they don't get an (incorrect) indication that their session hasn't been MITMed, which if it is a problem at all, is a problem for the employee.

<comment><USER8> There are lots of applications that use HTTPS under the covers that will break if certificate validation fails, so not having the root cert installed does "break" those devices.

(There are unfortunately even more apps that use HTTPS under the covers that appear not to care whether certs validate).

<comment><USER14> Sure, but that falls right into the category of "a problem for the employee". The traffic still gets MITMed, so the employer shouldn't care.

</comment></comment></comment></comment></comment></comment><comment><USER15> First of all .. are they going to enforce this? Indeed, _can_ they enforce it? Is it possible to detect such certificates and will Mozilla remove root CAs.

Secondly, this doesn't do anything for the fundamental broken design of CAs which is that any CA in the world can issue a certificate for any website. Firefox ships with dozens of certificates for such eminent organizations as "OISTE WISeKey Global Root GA CA" (who they?), basically anyone who can stump up the fee and fill in a form on Mozilla's website. Any of these could issue duplicate or fraudulent certificates, and any of them could be attacked.

<comment><USER16> It can be enforced, because the certificate chain will indicate that the x.509 cert has been signed by an intermediate CA

<comment><USER15> Such certificates are allowed in general, just not if the site is a 'global' site (whatever the definition of 'global' would be). That's why I don't think this is enforcible.

<comment><USER17> Where are you getting this "allowed in general" thing from? I can't see anything in there at all that would imply that.

<comment><USER18> Many certificates that you can buy today are issued by legitimate resellers of bigger CA's. That's done by the big CA (which is in the list of trusted roots) handing out a CA certificate to the reseller.

We'd probably want to keep this as is or the already way too big list of roots in the browsers becomes totally unmanageable. Or we move back to the days of only a handful of roots, which probably means also going back to the old prices ($500+ a year for a non-ev one)

<comment><USER8> We're kidding ourselves, totally kidding ourselves, that we have made the CA system "manageable" by allowing CAs to sell subsidiary CAs to other companies. Yes, those certs aren't cluttering up our 2 terabyte hard disks. _That's a bad thing_ , because they're still out there, and they work whether your browser tells you about them or not.

</comment></comment></comment></comment></comment></comment><comment><USER19> I would feel a lot more confident about actual compliance if Chrome came on board with this as well.

<comment><USER20> For historical reasons (viz. NSS), Mozilla maintains its own list of trusted CAs. Chrome uses whatever is provided by the OS, so they aren't in a position to make the same sorts of demands.

Not that I disagree with the sentiment -- there's just a very specific reason why Mozilla is involved, and it's not simply because they write a web browser.

<comment><USER21> Chrome could still maintain a blacklist of roots.

<comment><USER22> One was written after the DigiNotar incident: <http://code.google.com/p/chromium/issues/detail?id=94673>

</comment></comment></comment></comment><comment><USER23> So did they decide what to do with the TrustWave-case? Are they forgiven for their confession? That seems to be the implication of this announcement.

<comment><USER3> Makes you wonder what actually happened with TrustWave (there's obviously more to it than "Oh, this was an ethical dilemma so we stopped."). Probably their customer found a way into the intermediate CA private key and was being naughty with it.

What I think sparked Mozilla is TrustWave's claim that this kind of thing is widespread and commonplace among CA's. That's shouldn't surprise anyone, though.

</comment></comment><comment><USER24> Thank you Mozilla.

</comment><comment><USER25> Should we remove Trustwave from our personal browsers? Or as admins from our users' browsers?

</comment><comment><USER26> Time to eliminate CAs altogether. I don't see why my trust in them should be assumed:

<http://convergence.io/details.html>

</comment><comment><USER27> They have ruined security for everyone by allowing government agencies (they didn't even bother to setup a front) and other questionable entities on that list. The correct response is not to send out a nice letter asking everyone to please give up crucial business information, but to kick everyone off that list and start over.

Mozilla was compromised, not the CAs.</comment>


Ask HN: How did you hack anxiety? - <AUTHOR> Some of us have crippling anxiety and since we are all hackers in some form or another I find it would be helpful to hear from others out there that have dealt with it. I've had anxiety starting at around age 20 and have found numerous ways to deal with it, depending on the circumstance. I wouldn't say mine was crippling so I'd like to hear from others that have had to deal that circumstance. Maybe we can help a few people move in the right direction. <comment><USER2> I have three ways: I pull out a piece of paper and do simple 4th grade math problems over and over till I am completely bored. By the time I am done, I don't even care what I was anxious about. The "angular gyrus" portion of the brain (look it up) is used for number processing and also helps us maintain attention. Anxiety for me is worrying about the future or my mulling over severe regrets about the past. The math puts into the "NOW" section of the timeline.

Two: Mindful meditation 2-to-3 times a week. this gives the ability to direct my thoughts better. UCLA page has guided meditations on MP3s that are amazing for stress reduction.

Three, I stay active: I am in a masters swimming program (2-to-3 times a week) and I take hour long walks.

<comment><USER3> I'm also doing a masters swimming program (3 times a week). It definitely helps, I've never taken proper swimming lessons so it's a nice activity to focus on and improve.

</comment></comment><comment><USER4> Anxiety is a symptom, not a root problem. The root problem is uncertainty about the things that are important to you. What are you uncertain about? If you suddenly knew it, would you still feel anxious? If not, what else are you worrying about?

Now that you've got a list, try figuring out how you'd learn about those things, and what you'd do differently if you knew. If you wouldn't do anything differently, try being okay with not knowing. If it's straightforward to find out, figure that stuff out.

The overall goal of this is not to fight anxiety, but to use it. You have emotions for important reasons. Trying to fight emotions without addressing the underlying reasons is an unnecessary battle against yourself.

<comment><USER5> Thank you. This is the best advice/explanation on this subject I ever read. This is why I read HN.

</comment></comment><comment><USER6> Cognitive behaviour therapy is effective for many people who have anxiety disorders.

Seek a registered therapist (in England you can get access via your GP; or you can self refer to your local IAPT talkig therapies; or you can use your company's occupational health services; or you can get a private therapist. BACP are a reliable registration body for psychological therapists).

The Australian website "Mood Gym" provide online CBT. [https://moodgym.anu.edu.au/](https://moodgym.anu.edu.au/)

Sometimes anxiety disorders interfere with day to day life - they can become quite disabling. Early intervention helps and it might be useful To talk to a doctor, and to push the need for treatment.

</comment><comment><USER7> If you're talking about anxiety as in a diagnosed or suspected anxiety disorder (i.e. not in the sense of the normal emotion), the way to go would be:

Treatment [0] - as with any other health problem - and a generally healthy lifestyle.

Last I checked, talking therapies like CBT [1] and ACT [2] yielded favorable results in research [3].

[0]: [http://www.nimh.nih.gov/health/topics/anxiety- disorders/inde...](http://www.nimh.nih.gov/health/topics/anxiety- disorders/index.shtml#part_145337)

[1]: [http://en.wikipedia.org/wiki/Cognitive_behavioral_therapy](http://en.wikipedia.org/wiki/Cognitive_behavioral_therapy)

[2]: [http://en.wikipedia.org/wiki/Acceptance_and_commitment_thera...](http://en.wikipedia.org/wiki/Acceptance_and_commitment_therapy)

[3]: [http://www.ncbi.nlm.nih.gov/pmc/articles/PMC3263389/](http://www.ncbi.nlm.nih.gov/pmc/articles/PMC3263389/)

</comment><comment><USER8> I had a massive blow out after something I was working on did not work out, something I flew a thousand miles, leaving behind a family, to work on. The fact that I did that tells you I was the most fearless daredevil you could ever meet, and I did not know what anxiety was!

Firstly this is NORMAL, accept it. I dont know how long I struggled to accept it. Everyone is anxious, some more than others, because of either human nature or the way they are from the beginning or due to some life changing events.

Secondly I cant stress the importance of breathing exercises enough. Anytime you feel anxiety coming on(and you will eventually start to recognize it with some physical or mental symptoms) do the 4..7..8 breathing exercise

\-- Exhale completely through your mouth, making a whoosh sound.

\-- Close your mouth and inhale quietly through your nose to a mental count of four.

\-- Hold your breath for a count of seven.

\-- Exhale completely through your mouth, making a whoosh sound to a count of eight.

\--This is one breath. Now inhale again and repeat the cycle three more times for a total of four breaths. TRUST ME ON THIS. THIS IS THE HACK YOU ARE LOOKING FOR

Thirdly be mindful of your thoughts, step away every time you are anxious and see it like you were someone else advicing you, what would you say to someone else who was going through this?

Fourth - Be active! Physically. Gym, Run outdoors!

I was slightly iffy on Swimming, because although it helps physically, I always felt slightly more anxious underwater because it left me alone with my thoughts initially. But then eventually once I controlled my anxiety enough, and learned to be more mindfulness I thought it was great too!

This is how I hack anxiety and in my opinion is more than enough.

</comment><comment><USER9> There are lots of different kinds of anxiety. Procrastination is a form of anxiety. The only way to really get started in dealing with it is to see a doctor and get into a system that is tailored to your specific needs.

</comment><comment><USER10> I stopped eating anything with any carbohydrates and instead ate more fat. This means I mostly only eat meat. (And I drink a lot of water.)

It knocked out my anxiety and depression so well that, recently I've had a lot of stressful things happen in my life, but I don't feel any anxiety at all.

I've also lost 35 lbs in 2 months.

[http://www.ketotic.org/](http://www.ketotic.org/)

[https://www.youtube.com/watch?v=YJ3C0mrZ3ZY](https://www.youtube.com/watch?v=YJ3C0mrZ3ZY)

</comment><comment><USER11> There seems to be a big resistance to a pharmacological solution to mental health problems on HN. That's how I "hacked" my anxiety. I tried various dietary changes, various physical activity routines, meditation, etc but in the end found the best solution was a visit to a professional and get a prescription.

I used to be more resistant to medicating mental health problems in that way until it worked for me. I went from an almost nonfunctional wreck to a thriving, functional person again. YMMV.

</comment><comment><USER12> I've had terrible anxiety at certain times in my life. I've found that it doesn't just 'go away' on its own, so it's great that you're asking for help.

Two things have helped me quite a bit: Exercising and meditating. Exercising helps flush out nervous energy, that knee-tapping, pencil-chewing, frenetic buzzing that tends to keep me up worrying at night. It also helps get me on a regular sleep schedule, and I tend to stay calmer when I'm well rested. Meditating has helped me quiet the noise. When I have a lot going on it can become hard to even decide what to focus on...meditating helps me clear that up and set my mind on single objects/tasks at a time. It also helps me accept the things that I can't change, and learn to acknowledge and move past my own failures (like missing a deadline) without freaking out or panicking.

Hope that helps.

</comment><comment><USER13> I... smoked a lot of weed.

<comment><USER14> Indica hopefully. Sativa is the more uppy-thinky one.

</comment></comment><comment><USER15> Count to 10, deep breathing and then just do it.

It also works on calming too!

</comment><comment><USER16> today is not equal tomorrow if you do something</comment>


The art of starting a project - <AUTHOR> http://blogs.harvardbusiness.org/demaio/2009/05/the-art-of-starting-a-project.html?cm_re=homepage-051309-_-secondary-1-_-headline

<comment><USER2> This actually makes some sense. I've been meaning to write a paper for the last few weeks. Last night I hammered out a "junk" version that I could improve later. And here I am working on it now.</comment>


Direct3D to OpenGL abstraction layer - <AUTHOR> https://github.com/ValveSoftware/ToGL <comment><USER2> For the interested, google's Angle is the opposite : [https://code.google.com/p/angleproject/](https://code.google.com/p/angleproject/)

<comment><USER3> Now someone needs to start a project to find a large, documented subset for which ANGLE(ToGL(x)) = x so we can all get rid of this historical two- standards-that-do-exactly-the-same-thing nonsense.

<comment><USER4> All that reminds me of is this: [https://xkcd.com/927/](https://xkcd.com/927/)

<comment><USER3> Yes, one must be careful not to define a _new_ standard, but rather to _observe_ a strict subset of both for which that "equation" holds.

</comment></comment></comment></comment><comment><USER5> Valve covered how these tools are used in their Porting Source to Linux: Valve's Lessons Learned talk: [https://www.youtube.com/watch?v=btNVfUygvio](https://www.youtube.com/watch?v=btNVfUygvio)

slides here: [http://adrienb.fr/blog/wp- content/uploads/2013/04/PortingSou...](http://adrienb.fr/blog/wp- content/uploads/2013/04/PortingSourceToLinux.pdf)

</comment><comment><USER6> Not sure here but don't all major engines already support OpenGL ootb ? Basically any engine thats runs on PS3/PS4 does like UnrealEngine, Cryengine, idTech, Unity and most indie/open source engines are OpenGL anyway. All engines that target Android/iOS are OpenGL too. Even for things like XNA which was Xbox/DirectX only there is MonoGame to port it to *nix platforms easily.

So if you have rolled your own DirectX-only engine this is awesome of course, but do people really do that?

<comment><USER7> PS3/PS4 commercial games do not use OpenGL and never have. This myth needs to die.

[http://scalibq.wordpress.com/2010/05/15/sony%E2%80%99s-plays...](http://scalibq.wordpress.com/2010/05/15/sony%E2%80%99s-playstation-3%E2%80%99s-main- graphics-api-is-not-opengl/)

<comment><USER8> "the advantage of a console: hardware is fixed". YEP! Why use an abstraction layer when you can just code to the metal.

<comment><USER9> Many games run on multiple consoles.

<comment><USER10> Still a pretty small number (2-8 max?) compared to all of the PC configurations you have to worry about in DX and OpenGL land.

</comment></comment></comment></comment></comment><comment><USER11> This is huge, really huge for anyone who write DirectX games and want to make them run on OSX/Linux. This is basically what a part of Wine do, am I wrong?

<comment><USER12> Wine is a bit different, I'm not 100% sure but it's more like a reimplementation of native calls than anything.

But yeah, this is awesome. As a side note, developers who want to make games run on OSX and Linux should just stop targeting DirectX. This is good for already-existing games and port them over, but in 2014 if you're still writing games in DirectX, you're most likely doing it wrong.

<comment><USER13> >> _but in 2014 if you 're still writing games in DirectX, you're most likely doing it wrong._

No, you are not. There is no wrong and right, it's just a stupid statement. OpenGL is years behind D3D (not DirectX, it's not comparable!) in many areas, and writing using the whole DX stack can be much nicer than setting up a GL stack with a lot of different libraries.

<comment><USER14> >>OpenGL is years behind D3D (not DirectX, it's not comparable!) in many areas,

Explain please?

<comment><USER15> Complete lack of multicore rendering.

You can practically issue render commands only from one thread. And there is no way to save bunch of commands anymore as display lists were deprecated. Also it's still very much state machine based. So you have to do a lot of individual calls to set everything up for actual draw call.

I personally love OpenGL and use it on my work. However this is one of the biggest drawbacks on OpenGL currently.

<comment><USER16> No clue what multicore rendering D3D offers, but 'complete lack' is an overstatement.

OpenGL has context sharing, which means several contexts in different threads sharing the same objects. You can issue commands as long as you synchronise access to objects yourself. In practice, that means filling buffers, rendering to an off-screen framebuffer, etc. from other threads.

<comment><USER17> Multithreading in GL does not work consistently. If you ask the driver vendors (AMD, NVIDIA, etc) they will tell you it doesn't work at all or across platforms. If you ask engine developers (like Valve) they will tell you in talks that it doesn't work across platforms.

<comment><USER16> What's cross platform? I guess what matters in this specific argument is feature parity with D3D on all the platforms it can compete on.

If it works on Windows, then I wonder if it really matters. I've seen a lot of games (e.g. Team Fortress 2) still offer multithreading as an option in the UI, so there's already two code paths there.

<comment><USER17> I have been told by driver vendors that GL multithreading does not work on windows, yes.

D3D multithreading works (even, to a lesser extent, with D3D9!), and this is one of the reasons why our D3D9 renderer is dramatically faster than our GL one - we can offload a subset of rendering work to helper threads instead of keeping it all locked on the thread that owns the window.

TF2/etc do offer a multithreaded rendering option, but IIRC on Windows their engine still uses D3D. Also, note that it's an _option_ , because the feature used to be very unstable (still might be, actually) - I suspect people using the GL version of those games may have to disable it on certain hardware/driver configurations.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER18> In a thread not too long ago, I asked why CS:GO might have such terrible performance in OSX, and olegoandreev hypothesized that it might have to do with poorly compiled shaders. Maybe with enough eyes on the code, this can finally be fixed? We already know that the OSX port of the Source engine can have close-to-Windows performance based on benchmarks done in Parallels, and yet it's still shamefully only half as performant.

[https://news.ycombinator.com/item?id=7303753](https://news.ycombinator.com/item?id=7303753)

</comment><comment><USER19> _Limited subset of Direct3D 9.0c_

<comment><USER20> Now that I'm reading that ... isn't _every_ subset of a finite set itself finite (and thus limited)?

<comment><USER21> I'm not a native English speaker, but I think in colloquial terms, "limited" means "smaller than you might want" or something like that.

<comment><USER22> A limited subset would not be a complete implementation, yes.

</comment></comment></comment></comment><comment><USER23> kind of preaching to the choir, no?

i mean, there are more open source games that use OpenGL than DirectX, and are already cross platform as a result. similarly, i would imagine if a AAA game studio wanted to do such a thing, they would roll their own (or just use GL in the first place).

perhaps i'm being too cynical (but this _is_ hacker news..)

<comment><USER24> So far most AAA games are still developed for DirectX only. Those are the games that make or break a platform. Doom 95 was arguably the kind of killer app that established Windows as the primary gaming OS. In the context of Valve's SteamOS strategy it makes perfect sense to encourage more major developers to build games on a portable API like OpenGL or possibly AMD's Mantle by making it as easy as possible. If they fail at this, SteamOS, Steam Boxes and gaming on Linux in general won't have a chance at mainstream success.

<comment><USER23> sorry if i wasn't clear, but i am aware that most AAA games use DX. the same is not true for open source.

there are already DX->GL compatibility layers, although most of them are in house, by companies that produce ports (ala Feral Games).

yes, i entirely agree with you.. almost. ideally, i'd like DirectX to.. go away, forever. proprietary APIs that result in lock in to a software or hardware platform are seriously holding back computing in general. and i'd never recommend anyone use AMD's Mantle for the same reason (which is a massive waste of everyone's time)

<comment><USER25> Well there are possibly smaller studios and devs who perhaps don't have the resources to roll their own translation layers, for whom this might be a tipping point towards supporting SteamOS and/or Linux.

Since Valve has already written this for their own purposes, it'll cost next to nothing for this to be published if they can stop people expecting support, and they might get a few bug reports into the bargain.

</comment></comment></comment></comment><comment><USER26> This is a good start, I'd also like to see a Dotnet and VCRUN conversion to Linux libraries like Mono and GNU C++ to help port even more Windows games to GNU/Linux and Mac OSX.

</comment><comment><USER27> Nice. Does this mean that developers can start porting their existing (pre 2013) games over to Linux? Or are we missing a DirectX to SDL translation layer?

<comment><USER23> well, SDL will do the job of getting a window from the OS. when used with GL (in the way valve do), it doesn't really do much else.

<comment><USER27> It handles sound, input and a bunch of other stuff which DirectX also handles besides window management and rendering.

</comment></comment></comment><comment><USER28> This seems like a new version of this previous effort:

[http://en.wikipedia.org/wiki/Cedega_(software)](http://en.wikipedia.org/wiki/Cedega_\(software\))

<comment><USER29> Not really. Cedega is a version of Wine.

This is a library, intended to be used in your application in lieu of calling the APIs directly. You cannot take a full application and ask this library to run it.

<comment><USER30> WINE does however contain a DirectX -> OpenGL translation layer that can be used separately from the rest of it.</comment></comment></comment>


Obsessed with "experts" who say we could have a vaccine in 12 to 18 months - <AUTHOR> https://twitter.com/stuartathompson/status/1255802418811420676 <comment><USER2> There is a good reason why you don't compress testing of the vaccine. These "non-experts" pushing fast timetable would expose millions of people to new vaccine before long term effects are known.

It would be horrible thing to discover that vaccination triggers autoimmune disease in 0.1% of the population after you have vaccinated millions of people.

In principle you can compress manufacturing time required by starting manufacturing large quantities before final testing is done. If the vaccine does not work, you just destroy it.</comment>


Microsoft pulls the plug on its Silverlight.Net site - <AUTHOR> http://www.zdnet.com/microsoft-pulls-the-plug-on-its-silverlight-net-site-7000008494/

<comment><USER2> While Silverlight seems to continue under the umbrella of MSDN, it never took off and basically remained a mere nuisance, so I'm not surprised to see it being "shifted" out as a product.

Silverlight was (implicitly?) positioned to compete with Flash and just like Flash, it was mostly an obscure piece of proprietary technology and mostly just a nuisance. What made Flash matter was video streaming and YouTube: suddenly all those who had been avoiding Flash because of stupid games and stupid Flash advertisements had to get Flash to view videos on YouTube. This never happened on Silverlight _to a major_ extent; it always remained a weird alternative to Flash.

Curiously, Flash got killed too. I consider Flash dead in a similar manner that I consider Microsoft dead. They will both churn along for years but their supply of momentum is running out.

What practically killed Flash was the highly excretory nature of the Flash codebase. With the huge installation base induced by video streaming the Flash plugin had great opportunities per se but their codebase barely ran on a fast PC, and mobile Flash never materialized for real. First it was slow and when mobile devices got faster, it was a battery hog. So Flash got stuck in remaining the de facto web video player device and that space is slowly eaten out by various HTML5 based video technologies.

I hope we can ditch first Silverlight and then finally Flash in the shortest order of time.

<comment><USER3> > Curiously, Flash got killed too. I consider Flash dead in a similar manner > that I consider Microsoft dead.

Game developers beg to differ

<comment><USER4> They can beg. Meanwhile the casual games audience is moving on.

<comment><USER3> Really?! I haven't noticed it.

<comment><USER4> Who's playing all the iOS app store games, then?

<comment><USER3> You know that Flash nowadays also compiles to native code, right?

[http://help.adobe.com/en_US/air/build/WSfffb011ac560372f-5d0...](http://help.adobe.com/en_US/air/build/WSfffb011ac560372f-5d0f4f25128cc9cd0cb-8000.html)

<comment><USER4> Yes, and fair point.

</comment></comment></comment></comment></comment></comment></comment><comment><USER5> Lesson I would get out of this is: developing in Microsoft technologies where they don't already have a strong or dominant position in a market is risky. These days their embrace extend extinguish tactic isn't working so well. What's included in this? Winphone? Surface? Don't really know what else.

<comment><USER6> Exactly. Other than Netflix, what well-known applications did Silverlight back? None come to mind for me.

<comment><USER7> There are a lot of private enterprise applications built on it. Its strength was that you could build complex tools relatively quickly. For example, I know of a local company that builds law enforcement software on it. I believe Netflix only uses a small portion of the 'Smooth Streaming' technology in Silverlight.

</comment></comment></comment><comment><USER7> I've been a .Net dev for many years and I'm generally optimistic and excited about many Microsoft products but I warned everyone to stay away from Silverlight from day one. I knew that couldn't be the future of the web. I think I can safely thank those years of being Flash developer for that. One day Microsoft will realize they can't 'own' all the technology between the server and your monitor. I do think they're doing a great job embracing open source and web standards these days.

</comment><comment><USER8> When these kinds of articles come about, I never understand the big deal. The release of the iPhone 5 doesn't suddenly make my iPhone 4s a useless piece of junk. I can continue using it until it dies and I need to replace it. Similarly, if you're doing SL work, your stuff isn't going to suddenly stop working. Your current copy of VS won't magically stop compiling SL code. Continue to use SL if it works for you. SL seemed to only have mild success as an intranet technology, so my suggestion above is valid.

This problem doesn't go away with open source, since projects can die and non- backwards compatible versions can be released. No one is forcing you to convert all your Python 2 code to Python 3

</comment><comment><USER9> One thing good about Silverlight is that you don't have to use Javascript.

Has anyone here successfully developed a JS app with a quarter million lines of code? And maintained it?

<comment><USER10> Err.. Gmail.

You're grossly underestimating JavaScript.

With JavaScript its possible to break your code into logical abstractions, either functional or object oriented or a hybrid of the two.

What's stops you from writing maintainable JavaScript apps is perhaps the quality of devs.

<comment><USER11> Gmail is written in java and compiled to javascript via gwt. Doesn't count.

<comment><USER12> Gmail's backend is written in Java.

The frontend is written in Javascript, it has nothing to do with GWT.

<comment><USER13> Sorry, you are incorrect. GWT writing javascript is the whole point.

<http://css.dzone.com/news/understanding-gwt-compiler>

From the article: "The GWT compiler is really a Java source to JavaScript source translator."

<comment><USER14> Gmail is written using the Closure library:

<https://developers.google.com/closure/faq#gwt>

</comment></comment></comment></comment></comment></comment><comment><USER15> Seems pretty absurd to think that they'll be actively supporting a product for another decade without putting out any new releases... then again Microsoft and I have never seen eye-to-eye about how to sunset and subsequently retire software.

<comment><USER16> IIRC, they have a written (or maybe unwritten) rule that they will not drop support right away. It's probably to encourage adoption of Microsoft's standards and software by enterprise. If a major company adopted this and Microsoft gave them a 6 months notice, they'd be pretty upset and less likely to do business with them again.

</comment></comment><comment><USER17> Silverlight team (or more precisely, Silverlight management) is weak. Was weak from the beginning. Delivered poor product.

As a result - Silverlight failed to get enough traction. Now Silverlight and Silverlight team is getting abandoned by MS.

</comment><comment><USER18> what about netflix? they are still using silverlight

<comment><USER6> Let's hope this means they start moving away from it.

<comment><USER19> Agreed. I've never watched a Netflix program on my laptop because I refuse to install Silverlight. Flash it bad enough, but, for the most part, I have to tolerate it thanks to its huge market presence. Silverlight never had that, and I certainly wasn't going to help make it.

</comment></comment></comment><comment><USER20> Web developers everywhere break down in tears...

</comment><comment><USER6> Hip hip...</comment>


Modernized time.h for ISO C (1998) - <AUTHOR> http://www.cl.cam.ac.uk/~mgk25/time/c/

<comment><USER2> Why does TAI start with an offset of 10 seconds? 1972-01-01 is before any leap seconds.

Edit: I can see it matches the right value but I can't figure out why. There have been 25 leap seconds but there's a 35 second offset...

Edit 2: Apparently the clocks ran at _different speeds_ for a decade, and the difference got rounded to 10 in 1972.

<comment><USER3> I find that extremely interesting. Can you cite this for the lazy?

<comment><USER2> [http://en.wikipedia.org/wiki/Leap_second#History](http://en.wikipedia.org/wiki/Leap_second#History) last paragraph of the section

</comment></comment></comment><comment><USER4> `struct xtime` and `xtime_get` were added in C11 as `struct timespec` and `timespec_get`:

[http://port70.net/~nsz/c/c11/n1570.html#7.27.1p3](http://port70.net/~nsz/c/c11/n1570.html#7.27.1p3)

[http://port70.net/~nsz/c/c11/n1570.html#22.214.171.124](http://port70.net/~nsz/c/c11/n1570.html#22.214.171.124)

There are some differences though. Not only the name and types differ. But also `timespec_get` is only required to support `TIME_UTC` and the specification is not as detailed.

<comment><USER4> Also, some proposed conversion specifiers are part of C99: %z and %l / %L as %Z.

</comment></comment><comment><USER5> As a reminder of how painful and complicated dealing with time is, here is an excellent essay by Erik Naggum:

[http://naggum.no/lugm-time.html](http://naggum.no/lugm-time.html)

<comment><USER6> I feel like Tom Scott did a great job summing up the frustrations dealing with time (zones) in his Computerphile video:

[https://www.youtube.com/watch?v=-5wpm- gesOY](https://www.youtube.com/watch?v=-5wpm-gesOY)

</comment></comment><comment><USER7> Not about C, but IMO the way that Go handles time is very convenient. Time zones are pretty well-encapsulated in the Time struct and that makes for really nice function interfaces. Also, there's this gem:

` These three considerations—choose an epoch as early as possible, that uses a year equal to 1 mod 400, and that is no more than 2^63 seconds earlier than 1970—bring us to the year -292277022399. We refer to this year as the absolute zero year, and to times measured as a uint64 seconds since this year as absolute times. `

[https://golang.org/src/pkg/time/time.go](https://golang.org/src/pkg/time/time.go)

<comment><USER8> I like the higher resolution of Windows' FILETIME epoch better (microseconds since 1601, positive and negative, or about 30000 years in each direction). I'd rather have the resolution than be able to reference years the universe didn't even exist in and only be able to do it in seconds.

<comment><USER9> It's actually 100ns granularity, not 1µs

<comment><USER8> Yep, absolutely right. I stand corrected.

</comment></comment></comment></comment><comment><USER10> Summary of article: It's about fucking <time.h>!

</comment><comment><USER11> So, is this still a draft?

</comment><comment><USER12> haha, no.</comment>