Why Johnny Still Can't Encrypt: Evaluating the Usability of a Modern PGP Client - <AUTHOR> http://arxiv.org/abs/1510.08555 <comment><USER2> Backwards compatibility is the killer.

The whole design of PGP is to be the envelope to make email private, versus the plaintext postcard that everybody can read. It works with existing servers and existing mail clients.

The biggest Snowden revelation is the importance of metadata. Just knowing whom you talk to, when, is frequently enough to compromise the parties involved. You might be doing something legal now, but you can't tell when some despot takes over and makes your activity illegal. When data can potentially last your lifetime, you need to consider this sort of thing. Illustration: Using Metadata to find Paul Revere. [1]

So, we need a new mail transmission protocol that limits the amount of metadata that can be seen. Something like Dark Mail [2]. I don't think Open Whisper Signal hides the metadata.

The problem is that Dark Mail needs to be developed and its security reviewed, and people need to adopt it. It needs new servers and clients, and the prevalence of Windows shows just how difficult that problem is. Also, any new messaging program these days needs a story about web and mobile.

In practice, I heard someone say that the biggest improvement in people's privacy has been use of Gmail. The clients connect to it with SSL certificates controlled by Google; Google promotes 2-factor authentication and access tokens; and Google's legal team challenges subpoenas. As long as you are not leaking national security secrets, I think this is adequate until a better system is deployed.

[1] [http://kieranhealy.org/blog/archives/2013/06/09/using- metada...](http://kieranhealy.org/blog/archives/2013/06/09/using-metadata-to- find-paul-revere/)

[2] [https://darkmail.info](https://darkmail.info)

<comment><USER3> SMTP with TLS doesn't leak any metadata except the connecting IP address. And with DMARC you can mandate it.

Calls for whole new protocols for email are usually made by people who don't understand the email ecosystem as it currently stands.

<comment><USER4> Can the TLS be enforced by the sender all the way through the chain to the destination mailbox?

<comment><USER5> The sender (the sender's service provider or organization) decides when to use TLS while the message bounces around internally, then (this is the typical long hop) the recipient's server and the sender's SMTP client negotiate, and then the recipient gets to decide.

The sender may have opinions, but as soon as the message is handed over to the recipient's server, that's it. That's the end of the sender's influence, and that's how it has to be on a global internet. People can connect without having their infrastructure approved by anyone else.

</comment></comment></comment></comment><comment><USER6> I think of it like this: usability can be a security feature.

If you build a "perfectly secure" piece of software, but it takes a very high level of skill to use it, your users will use something else that is easier to use, but less secure. And then how has your ideologically perfect piece of software helped improve their security?

If you make tradeoffs for usability, you will raise the bar because people will actually use what you make.

<comment><USER7> Fork Thunderbird or some such client, also make a web client available. Make a new service which offers only encrypted e-mail by default (with a new e-mail address that includes e-mail hosting for your own domain) and provides the key server and everything else. Advertise it as something different from e-mail like encrypted e-mail. Set a new precedent, create a new industry.

<comment> mike-cardwell Unless they can check their email on their phones, it wont take off. Mobile email clients are much more important than desktop nowadays IMO.

<comment><USER8> Most "users" don't care about end-to-end encryption and instant messaging has already become the "better e-mail" on phones. The only way I see of breaking into this space is to make something for companies, because they still have reasons for a "better e-mail" and value encryption.

</comment></comment></comment></comment><comment><USER9> I see two major barriers to mass adoption of any crypto system that requires a UI.

1\. Abstraction. For the non-expert, the only metaphor that works for PKI is that of physical security. The concept of a "key" as a series of characters or a file that must be protected must be replaced by an abstraction that allows users to protect it in the same way they understand how to protect a key or a wallet.

So long as the "key" continues to appear to be an enormous password, people will continue to treat it that way, along with all the crazy worst-practices in the world. Not to mention the huge host of problems that accompanies key security for the layman.

I don't know what the answer is, but I do think that a physical token of some sort is the right start.

2\. At the end of the day, the vast majority of people are not interested in the trade off between better security and convenience.

There is a learning curve, however shallow it can be made, and those that genuinely want or need better security are motivated enough to do the learning. For everyone else, it's like optional homework.

I would add to this that most everyone I know who cares about security is _quite comfortable_ with a large array of APIs and software to do all sorts of cryptographic gymnastics. The bar is quite low already -- it has been for some time, IMO.

<comment><USER10> I've been using GPG since a while now, to sign my outgoing mail. I don't encrypt it as I don't know anyone who uses GPG. I'm still happy to use it, to get used to it, and to see alternative uses. Signing is in my view a big improvement, to make sure nobody has messed with the messages. I always use HTML, so the receiver gets an attachment with the signing hash in it, and no strange text in the mail. I use a signature with a link to my public key and a link to the PGP page on Wikipedia. Everybody can read my mail, and if they want they can validate it.

<comment><USER11> The idea of including a link to your public key and a link the wiki on PGP is great! I'm going to do this as well. Would you mind showing me how you link to the above mentioned?

<comment><USER10> Here's the code that I used in Thunderbird. I make it small and light in color.

This message is signed using PGP](https://en.wikipedia.org/wiki/Pretty_Good_Privacy">PGP). Public key: ) ABCD1234

I see the link in the code is not closed properly, so you need to fix this.

</comment></comment></comment></comment><comment><USER12> Real secure encryption is and always will be not user friendly because it means only you can know the private key. This means no "Forgot my password" functionalities, no fancy powerful cloud AI analyzing your data and suggesting cool stuff, no free hosted full text search of your data, no open directory of friends to search on etc. So basically, no gmail, icloud, facebook, dropbox etc. It would require a complete new paradigm, sure there are interesting techs such as ethereum and bitcoin but they are not user friendly, and don't scale much to the regular user (downloading the whole blockchain is a no-no to most people for example) but most importantly, current solutions are too convenient and work really well (bar privacy and security issues most don't care about). So you'd need a tech that not only is way better, more efficient and smarter than current ones (gmail, google, facebook, icloud etc) but also secure and decentralized. Not happening any time soon but hopefully not impossible either.

<comment><USER13> Because I have no interest in memorizing keys, I store them on disk protected by a passphrase. I don't know if this counts as "Real secure encryption" but it's sure a lot more secure than more typical use of email.

<comment><USER12> You can store it on disk protected by a passphrase but that's still not user friendly as way too few people would be willing to or capable of doing so which was my main point. My point is that secure encryption is by definition impractical, inconvenient and not user friendly which makes its adoption by mainstream users very unlikely at least in the foreseeable future.

</comment></comment></comment><comment><USER14> I think it's easy to pick on a weak example, but much progress has been made since the original "Why Johnny Can't Encrypt".

A recent example: Textsecure / Signal has been very, very smooth for me and I doubt it'd be much more difficult for laypeople either: [https://whispersystems.org/](https://whispersystems.org/)

<comment><USER15> Although, like mentioned in above comments, Signal does not hide metadata, which can be as valuable to attackers as the contents of the messages themselves.

Also, in terms of adoption, it's still hard when everyone has phones that use iMessage or SMS by default. iMessage is end-to-end encrypted, but not compatible with Signal, and Android has no equivalent baked in. Using Signal requires two extra steps for the user 1) downloading/installing Signal 2) knowing about it and caring enough to use it in the first place.

</comment></comment><comment><USER16> PGP does have a legitimate use case, namely Edward Snowden: he's technical, the NSA is his main threat vector, and it makes sense for him to spend lots of time reasoning about the web of trust, signing keys, double-checking fingerprints, and creating 12-minute explainer-videos for people he needs to communicate with (for reference: [https://vimeo.com/56881481](https://vimeo.com/56881481)).

Here's the problem: not everyone needs the stringent encryption guarantees that Snowden needed. There is value in crypto systems that are less demanding than PGP, especially if they come with vast increases in usability.

iMessage, I think, is what most people need in their everyday life. It's end- to-end encrypted, and although it has a central key-server, it is backed by Apple, which has publicly announced their commitment to user privacy. Yes, a central key-server means that you can't verify the fingerprints Apple gives you, but again, that's not what iMessage's encryption was designed for. If you need that level of certainty, use Signal.

<comment><USER17> What a non-sense.

We live in the information era, information nowadays is the ultimate power. Democracy depends on the balance of power between the people and the government. If the government has all the data, it has all the power.

</comment></comment><comment><USER18> Hey HN, I'm one of the authors on this paper. I'd be happy to answer any questions.

<comment><USER19> Given the usability and technical problems with PGP, do you think it's worth saving?

<comment><USER18> For those who value security enough to take the pains to learn the system, yes, it's useful. For your average netizen, we feel a progressive approach would be more effective. Start out with a key escrow service and if the user wants more security, they can ratchet up to PGP.

</comment></comment></comment><comment><USER20> Should be considered with moxie's piece: [http://www.thoughtcrime.org/blog/gpg-and- me/](http://www.thoughtcrime.org/blog/gpg-and-me/)

</comment><comment><USER21> This paper should be titled: Why Johnny Still, Still Can't Use Mailvelope: Evaluating the Usability of Mailvelope.

<comment><USER18> Yes, we probably would have gotten better usability scores if we developed our own PGP client with a better UX and tutorials. We selected Mailvelope because it was rated highly on the EFF's secure messaging scorecard [1] and we were exploring how the state-of-the-art in PGP software actually performed with end users.

[1] [https://www.eff.org/secure-messaging- scorecard](https://www.eff.org/secure-messaging-scorecard)

<comment><USER22> There is a _lot_ wrong with that scorecard, and it's dispiriting to hear that it is actually influencing research.

<comment><USER18> Interesting; I'd really like to hear what issues you have with that scorecard.

<comment><USER22> Matthew Green and I had a bet for the last year, which just ended, over libotr's security; I bet him that nobody would find a sev:hi flaw in it all year, and, of course, won, because at this point all the low-hanging fruit in libotr has been shaken out.

That bet was a reaction to the release of the EFF scorecard, which at the time gave Cryptocat(†) a perfect score but dinged ChatSecure, which is a libotr client, for not having an audit done.

I told Matthew Green I'd write up something about the bet, and what did get reported to me about libotr; I'll probably spend a few thousand words critiquing the scorecard there. A brief outline, though:

* There are places where the scorecard is factually misleading. For instance: there seems to be no coherence to what "source code available for inspection" means; it still lists Telegram as being open source!

* It's oversimplified in misleading ways as well. Systems which technically have the capability of verifying peers are given big green checkmarks even when that feature is so broken as to be useless. And, of course, there's the "been audited recently" checkmark, which, as anyone familiar with software security auditing will tell you, means absolutely fuck-all (again: ponder the fact that libotr, which has been a high-profile target for something like a decade and is more or less frozen stable, was counted as "not audited", while projects that got a 1-week drive-by from a firm specializing in web security got a big green checkmark).

* What does "security design properly documented" even mean? Where's the methodology behind the chart? A few paragraphs of text aimed at laypeople isn't a documented methodology! The one place they eventually did add documentation --- "what's a good security audit" \--- tries to explain a bunch of stuff that has almost nothing to do with the quality of software security inspection, and then throws up its hands and says "we didn't try to judge whether projects got good audits". Why? Why didn't they consult any named outside experts? They could have gotten the help if they needed it; instead, they developed this program in secret and launched it all at once.

* The project gives equal time to systems that nobody uses (at one point, Cryptocat was near the top of the list, and ChatSecure was actually hidden behind a link!), and is ranked alphabetically, so that TextSecure, perhaps _the only trustworthy cryptosystem on this list_ (with the possible exception of the OTR clients) is buried at the bottom.

* If the point of this chart is to educate laypeople on which cryptosystem to use, how is anyone supposed to actually evaluate it? They don't really say. Is it ok to use Jitsi's ZRTP, despite missing the "recent audit" checkbox? What about Mailvelope, which is missing the forward-secrecy checkbox? Can anyone seriously believe it's a better idea to use Telegram or Cryptocat, both flawed ad-hoc designs, than TextSecure or ChatSecure?

I guess I can't be brief about this after all. Grrr. This scorecard drives me nuts.

I am _not_ saying that these flaws in any way impacted your particular research project.

 _PS: an old thread on this:[https://news.ycombinator.com/item?id=8557654*](https://news.ycombinator.com/item?id=8557654*)

† _31580544b27c10736ebe1bdd05a56d96c486823d563d4493c317548976c3d8db _

<comment><USER23> What would be a better way to produce such a scorecard?

Is there already any collection of common criteria established by computer scientists and accepted by experts and / or any kind of standardization of requirements for secure software that was produced by leading security capacities that allows to extract data for a compact visual comparison like the eff scoreboard?

Would you like to provide or show me a link or any material that compares "the security" of products and offers an understandable and "industry-accepted" categorization?

Isn't it a bit strange that a small organization of non computer scientists produce something that was painfully missing for at least 50 years? Isn't it clear that a first approach to such a thing must fail and that this can only be a prototype for a process that should be adopted and worked out by people who understand what they are doing?

Isn't it a bit strange, that there is no such thing as that scoreboard produced by an international group of universities and industry experts, with a transparent documentation of the review process and plenty of room for discussion of different paradigms?

The eff scoreboard demonstrates painfully the obvious omissions of multiple generations of security experts who failed to establish a clear definition of what security exactly means, how to discuss it and how to find an acceptable approach to establish a thing that would allow to be named "review" in the scientific meaning of the word.

It is totally clear that Apple and Microsoft have very different ideas about security than OpenBSD developers, but it would still be of great value to have a space where people could follow that discussions and compare the results of different approaches and solutions to security related problems.

The eff scoreboard carries the embryo idea of a global crypto discussion, review, comparison and knowledge site that could also serve as a great resource for non-crypto people and students to learn a lot about that field. The highly valued information you and other experts are dropping here and there in HN threads and/or on various mailing lists should be visible in a place that collects all that stuff and allows for open discussion of these things in the public, so people can learn to decide what security means for them.

If such a thing exists, please show me.

If not, please build it.

<comment><USER22> There is not. Software security is a new field, cryptographic software security is an even newer field, and mainstream cryptographic messaging software is newer still.

The problem with this flawed list is that it in effect makes endorsements. It's better to have no criteria at all than a set that makes dangerously broken endorsements.

</comment></comment></comment></comment></comment></comment></comment><comment><USER24> It's worth mentioning, the original paper [0] recently won the USENIX Security 2015 Test of Time Award [1], which highlights papers at least 10 years old, that have made a lasting impact on their field.

[0]: [http://www.gaudior.net/alma/johnny.pdf](http://www.gaudior.net/alma/johnny.pdf)

[1]: [https://www.usenix.org/conferences/test-of-time- awards](https://www.usenix.org/conferences/test-of-time-awards)

</comment><comment><USER25> What ever happened to Google's "End-To-End" Chrome extension? [https://googleonlinesecurity.blogspot.com/2014/06/making- end...](https://googleonlinesecurity.blogspot.com/2014/06/making-end-to-end- encryption-easier-to.html)

<comment><USER26> It's still being worked on. Turns out, getting these things right from a crypto and a UX perspective is hard.

</comment></comment><comment><USER27> i'm not entirely sure this is worthy of a paper... its pretty much a common sense conclusion to reach if you've ever tried to use these things that the UX is usually terrible - even by the standards of a technical user.

too many manual efforts need to be made, even after setting up software that is purely designed to make this sort of thing easier.

mailvelope is a good example though - i've tried using it, but its not very clear what to do with it, and even once you get to the point of having the button appear in your gmail or whatever you have to then go and do even more things before you can actually send something that is encrypted. optimising this workflow should be trivial... a lot of this stuff can be done for you, e.g. by automatically enabling for common webmail sites, automatically generating some keys for you etc.

</comment><comment><USER28> I think we should start with an EXTREMELY simple app that does not attempt to do any fancy e-mail client integration, but is aimed at making it possible for non-nerds to send one-off secure mails and files in a way that is at least SLIGHTLY fun.

Keybase, GPGTools, and all of these things have different features and menus and all kinds of stuff which makes them EXTREMELY intimidating.

My mom is a teacher of computers, she is an expert at Excel and basic Windows things and Twitter and mail and she's even somewhat into Bitcoin, but crypto makes her instantly freeze into "oh my god what is happening I am terrified and confused" mode.

Today she needed to send some encrypted JPGs to verify her identity for some Bitcoin wallet thing. The support asked her to please encrypt her stuff with our public key.

When she opened that public key it came up in Notepad++ as a huge intimidating block of random characters. That was probably enough to put her in a bad mood. After that she wasn't very receptive and I guarantee that every single guide or tutorial or program would be WAY too nerdy, boring, and complicated for her to follow step one.

Anyway I just did it for her on my Mac and I explained my thoughts as I did it and she said "see I understand the concepts but it's just too much stuff to know about to actually do it myself."

I said "yeah, that's what Snowden keeps saying, these things are just too difficult for normal people. Even Glenn Greenwald, that journalist you know, apparently he sucks at computers and it took him months to even install the crypto app."

So I wish I could have said "just go to crypto.express" (random made up available memorable domain) and follow the easy steps and you can encrypt your zip file pretty easily with just drag and drop and it's totally made for newbies but still Snowden-level secure.

I don't really think people in general relate to the paranoid wish to encrypt all your mail. They probably think more in terms of specific secrets that they care about protecting. So you could get them started on use cases like sending passport photos, passwords, codes, credit card numbers, or dick pics or whatever it may be.

Once they have some tiny bit of successful experience with using private/public keys that one time, and it wasn't super impossible like they thought, they might be more open to learning more sophisticated ways of using crypto, such as automatically encrypting and signing mail.

<comment><AUTHOR> What do you think of this?

[https://github.com/Spark-Innovations/SC4](https://github.com/Spark- Innovations/SC4)

<comment><USER28> I just tried it and it seems like a pretty good start!

It doesn't seem to have launched publically yet but I hope they will have a landing page with utterly clear copy in a large font written with the mindset that for example this sentence

"Once you have entered your email address, SC4 will automatically provision you with a set of random keys."

is terrifyingly incomprehensible gobbledygook.

...actually I might be confused right now but even I (a total smartypants guy) can't seem to figure out how to paste in somebody else's public key in there. The default option is to encrypt for myself, and I see no way to input another key, only a text box for the message...

Edit: oh, maybe the text box is for the keys, and the thing I want to encrypt should be drag and dropped? Either way, the UI as it is right now is difficult to understand, but I suppose it is a prototype.

<comment><USER29> Keys are stored in local browser storage. How does this work when browser cache is cleared?

<comment><AUTHOR> Cache is separate from localStorage. Clearing your cache should have no effect on your SC4 keys. (Also, if you're running one of the two standalone versions, your key is stored in a file.)

<comment><USER30> At least in Firefox, clearing cookies (not an unreasonable thing for users to do once in a while) will also clear localStorage.

<comment><AUTHOR> That's true. There are limits to what one can do when running in a browser. If you have a better idea for where to store keys, I'm all ears.

</comment></comment></comment></comment></comment></comment></comment><comment><USER31> I mean using (Keybase) [https://keybase.io/](https://keybase.io/) is pretty easy

<comment><USER12> I created an account there and never used it ever again, same for most people I know. Even the rock stars featured there don't seem to be using it. Also, in what world is a cli tool with a git-like interface "pretty easy" outside of the tiny world of computer programmers?

<comment> mike-cardwell Same here. I set up a Keybase account and never used it. And I'm somebody who actually uses PGP every day.

</comment></comment></comment><comment><USER32> I personally have started to use enigmail in Thunderbird a lot more since it has its newer, much more intuitive interface.

</comment><comment><USER33> If someone could use your public SSH from say Github and send you a private message that would be great. From my understanding that is not possible. You need to generate and exchange PGP keys before, a major UX issue. Allow SSH public keys to be used and we'll be a lot closer to fixing the secure email issue.

<comment><USER34> Also Facebook (which has an official onion site to help if your internet connection is suspect) has GPG as a standard part of all user profiles. This would be a much more normal person directory than GitHub or MIT ( yes someone on HN suggested MIT as a mainstream PGP directory)

</comment></comment><comment><USER35> It's unrealistic to expect naive subjects to learn how to use GnuPG in an hour. It takes longer than that to learn a new game! People need at least to know what public-key cryptography is before trying to use it. But unfortunately, the Wikipedia entry is rather intimidating.[0] The GnuPG FAQ (at 7.1) is clearer, but not so easy to find.[1]

[0] [https://en.wikipedia.org/wiki/Pretty_Good_Privacy](https://en.wikipedia.org/wiki/Pretty_Good_Privacy)

[1] [https://www.gnupg.org/faq/gnupg- faq.html](https://www.gnupg.org/faq/gnupg-faq.html)

<comment><USER36> You said "People need at least to know what public-key cryptography is before trying to use it." I think this is untrue. People really just need to know how to work with the technology, not understand what it's actually doing. Trying to explain the underlying principles makes it more confusing and thus, less safe.

<comment><USER35> I mean basic stuff. Users need to know that they have both public keys and private keys. That public keys allow other users to encrypt stuff to them. So they need to share them. That private keys allow them to decrypt stuff encrypted to their public keys, and also to sign stuff. So they need to protect them, keep them private. Failure to get those basic facts accounted for much of the craziness and confusion in the cited study.

</comment></comment></comment><comment><USER37> This is something that the UX people of gnome could actually be useful for..

<comment><USER38> But they've made gnome worse, not better.

<comment><USER39> Worse for some people and better for other. My mother (58) and my grand mother (82) love how easily is to do what they usually do contrasted to the windows 8 experience.

I don't know if that is a common case or not, but at least it's not a definitive "worse" or "good". And for me, it's great as I never got a call to ask me where is something anymore.

<comment><USER40> Well, my little sister (12) and my dad (56) love KDE Plasma, as it's "simpler than windows".

</comment></comment></comment></comment><comment><USER41> Hi guys,

Maybe you should try Jumble (www.jumble.io) for email encryption - works with Gmail, iOS and MS Outlook.

Jumble manage key pairs for users and encrypt the private key with the users password so they don't have access, this ultimately simplifies the whole process for the end user and frees them from the key management aspect which is the major pain-point with PGP-based solutions. Also, it integrates on top of existing emails clients so no need to change your email address or how you interact with emails.

Full disclaimer: I'm a co-founder of Jumble

</comment><comment><USER42> At this point the only way for PGP or really any user-based encryption to get widespread use, gmail, yahoo and microsoft need to adopt it and integrate it into their webmail client, possibly as a semi-mandatory feature that's opt-out instead of opt-in.

Anything less will fail as no one is interested in getting a new email address.

Anecdotally, I've tried three of four times to learn how to use PGP and integrate it into my workflow and failed each time, so it definitely needs work (at least if they want me on board :))

</comment><comment><USER43> Our approach here is to make security usable to developers via a programmatic interface/API, so users' data is better protected without them having to do anything at all.

[https://www.trycryptomove.com](https://www.trycryptomove.com)

Eventually if/when we think about making consumer-facing wrappers to CryptoMove, the key is going to be usability. Security will need to be as easy/fun as consumer applications. Easier said than done though.

</comment><comment><USER44> I think GPGTools for OSX does a great job of a client.

<comment><USER15> I've been pretty happy with it, but I'm also a programmer with interest in and knowledge of why it's important and how it's useful. I can see non- technically-inclined family and friends being very confused by it.

</comment></comment><comment><USER45> A lot of baseline configs can be implemented to setup opportunistic crypto, for what Ben Brookes calls 'starbucks hacker bob' [https://brooksreview.net/2013/06/encrypting-stuff-against- st...](https://brooksreview.net/2013/06/encrypting-stuff-against-starbucks- hacker-bob/)

</comment><comment><USER46> I have a budding idea that involved using a blockchain to manage cryptographic credentials, but I'm having trouble finding proper blockchain libraries. Any recommendations?

I'd prefer Python or Go, since that's what I'm mostly using these days, but at this point I'll take brainfuck if that's my only choice...

</comment><comment><USER47> For occasional pgp use, a webapp is as easy as it goes. [https://ssl.ba.net/util/pgp/](https://ssl.ba.net/util/pgp/)

No need to store or remember keys, just create a new key for your conversation.

All encyption / decryption is done client-side with open source code.

</comment><comment><USER48> PGP's UX is so dismal I could almost believe the whole project operates under an NSA false flag.

<comment><USER49> The problem is a lack of funds. It was concieved for nerds by nerds and never got enough funding for UX.

A common state in the FOSS universe.

<comment><USER50> That's not funding. That's boredom or perhaps ideology. Most FOSS developers don't bother thinking about UX or even implementing a UI because it's boring. They're interested in the high-tech stuff that their software can do and hope somebody else will put a front end on it. But usually nobody does - at least not an open source front end - because all other FOSS developers are also more interested in the specific technical thing their software does.

I make money developing a front end for a popular but absolutely unusable piece of FOSS software. Other companies do too. It sometimes feels a bit wrong that the open source guys have done the biggest and hardest job for free, while I profit just slapping some windows and dialog boxes over the top of it. But they really don't want to do that part of it and have openly said they think their UI is fine and that people would benefit from learning to use a command driven interface.

</comment></comment></comment><comment><USER51> Isn't there a firefox extension that can just do some PGP stuff with some right click in gmail ?

<comment><USER52> Yep! [https://www.mailvelope.com/](https://www.mailvelope.com/)

<comment><USER53> Did you guys read the paper, or even the abstract? This whole paper is about Mailvelope and the difficulty people had using it.

<comment> slipstream- Maybe that's the joke.

</comment></comment></comment></comment><comment><USER54> This doesn't solve the problem of email encryption, but I made a (web-based) file encryption app with the goal of usability: [https://hypervault.github.io/](https://hypervault.github.io/)

</comment><comment><USER55> Johnny can't even select, download, use, or configure an email client.

<comment><USER56> ...not to mention that in most cases, Johnny doesn't even really know what encryption is, let alone believe he's capable of it.

Try asking someone to encrypt something, anything before sending it. The looks you'll get range from sideways or merely confused to fearful and panicked, to are you fucking kidding me?

</comment></comment><comment><USER10> Given the fact that [https://protonmail.com](https://protonmail.com) is still offline after several days of attacks, will secure mail ever get a chance?

</comment><comment><USER57> Here is a list of steps to send a signed e-mail:

[http://davidjarvis.ca/dave/tech/privacy.shtml](http://davidjarvis.ca/dave/tech/privacy.shtml)

Once signing is in place, you can send an encrypted e-mail:

[https://support.mozilla.org/en-US/kb/digitally-signing- and-e...](https://support.mozilla.org/en-US/kb/digitally-signing-and- encrypting-messages)

Here's the response from Robert Hansen on why Enigmail has such a complicated process:

> Here's the heart of the problem: "Modifying the wizard to account for > average users" works _only if you can define an 'average user'_. And you > can't, the same way that I can't. Please don't misunderstand me, it's not my > intent to slight you or your willingness to do a lot of hard work. (Quite > the opposite: I really hope you're willing to do it!) But we have to start > by looking at the realities, and the reality is the the GnuPG-using > community is incredibly fractious and prone to declaring holy wars over the > most trivial and irrelevant of details.

> If you set key generation to default to 4096-bit keys, a lot of people will > roll their eyes and accuse you of subscribing to key length fetishism. If > you leave the default at GnuPG's default of 2048-bit keys, a lot of people > will scream that you're not providing enough security.

> If you default to inline PGP, international users and people who love HTML > mail will complain the default doesn't work for them. If you default to > PGP/MIME, people who post to mailing lists will scream that your change just > broke their communications. (Not a joke, incidentally: there are a lot of > mailing lists that strip all attachments as a security measure... which has > the side effect of completely breaking PGP/MIME.)

> The reason why we ask so many questions in the wizard is not because we're > afraid of losing existing users, although that would definitely be a > consequence if we were to go with your more simplified way. The reason why > we ask so many questions is because _we cannot know_ which option a user > will demand to use and will think should be enabled by default.

> If we can't come up with a default that will work just fine out-of-the-box > for 95% of our userbase, then we're not going to make it a default. We'll > ask the user for their preference. And that's the reason why our wizard asks > so many questions: we ask questions when there is no clearly correct > default.

I think he's wrong. Flexible software would have a default wizard for basic users and an advanced wizard for users who care about the difference between 2048- and 4096-bit keys. It's one question at the start of the install process, "Would you like to tweak encryption settings?" \-- Yes, No, and "What does tweak mean?" are possible answers. Or install with default settings and guide power users to tweak the parameters post-install. Encrypted e-mail should not require over 90 steps.

<comment><USER50> When I use my phone to pay for things in a shop, there's surely a lot of complicated security going on, and a bit of ugly technology is even exposed when it displays a QR code for the cashier to scan. But nowhere ever did it ask me any questions that required me to learn any weird technical concepts. I never had to choose a number of bits or know anything about what a "key" is. As soon as a user sees these things, they have to either make a random guess or go off for hours teaching themselves what it means. It's a complete fail.

The words "PGP/MIME" should never appear on a PGP email plugin! When you send a regular file attachment, you don't have to specify the MIME type. It's all silent and hidden.</comment></comment>


What's New in Create React App - <AUTHOR> https://facebook.github.io/react/blog/2017/05/18/whats-new-in-create-react-app.html <comment><USER2> I can't emphasize how useful and important create-react-app is for the ecosystem.

The first and obvious benefit is being able to quickly create new projects without having to think about build infrastructure, which is honestly the most painful part of building a modern React project. create-react-app makes all the hard choices for you and gives you a reasonable set of defaults to work with. It's convention over configuration, kind of like Rails. It's a huge game changer.

The less obvious benefit is that it forces developers to fall into the pit of success by making it easy to do the right thing. Flow is supported out of the box, so adding type checking to your app is trivial. Jest is set up for you out of the box, so you have no excuse to not add tests. This new version includes support for code splitting, so there's no reason to ship bloated JS bundles to your users. Building a PWA is easy, so you start thinking about offline-first right at the start of your project.

I can't thank the team behind this little tool enough for making it so easy and so much fun to build React applications!

<comment><USER3> This sounds really good.

Quick question, does it include an option for client side routing?

I really want to start using React, but every time I get overwhelmed by the sheer amount of options (paralysis analysis) and go back to AngularJS (which is starting to show it's age). Personally I'm not sold on Angular2/4.

Cheers

<comment><USER4> They don't load a routing solution with this, but the most used router (and my favorite) is React-Router [0]. To get basic routing setup takes less than an hour, and has great docs.

[0]: [https://reacttraining.com/react-router](https://reacttraining.com/react- router)

<comment><USER5> If you're using redux I would recommend you stay far away from react-router. Using redux-little-router has been a pleasure to use in comparison: [https://github.com/FormidableLabs/redux-little- router](https://github.com/FormidableLabs/redux-little-router)

<comment><USER6> (Disclaimer: I work at Formidable)

Can confirm, I absolutely love `redux-little-router`. It feels so natural to dispatch Redux actions to change routes rather than dealing with the song and dance of conditionally rendering <Redirect /> components or trying to figure out when in the lifecycle to call `router.push(url)`.

I especially like pairing it with `redux-saga`- with a little bit of effort, you can end up writing mini-applications for each route which start and stop as the user navigates.

<comment><USER7> Any example repos of this? This sounds fantastic.

</comment></comment></comment></comment></comment></comment><comment><USER8> I've been watching the PR for the error message overlay[1] off and on for several months, and it has been a stellar example of OSS community working together to make this feature possible. There were PRs spanning multiple projects, contributions from many users, and it ended up in a fantastic feature that seriously helps all users from novice to expert.

This feature really puts React on the next level, in my book. The CRA team is doing a wonderful job making React accessible to new users.

[1]: [https://github.com/facebookincubator/create-react- app/pull/1...](https://github.com/facebookincubator/create-react- app/pull/1101)

</comment><comment><USER9> They should finally acknowledge the existence of typescript and not push everyone to their flow. Second of all: reduce the size of this starter kit. Other than that I really like the features.

<comment><USER10> See [https://news.ycombinator.com/item?id=14373433](https://news.ycombinator.com/item?id=14373433) \- Microsoft have just released an official starter kit which uses create- react-app. Not tried it myself yet but it looks great and is well documented

<comment><USER11> That's pretty sweet, especially because they do so without having to eject.

Direct link: [https://github.com/Microsoft/TypeScript-React- Starter](https://github.com/Microsoft/TypeScript-React-Starter)

<comment><USER10> Yeah sorry, I linked to the post in the hope that this gains a bit of traction as really want people to be aware that getting started with TS and React is a whole lot easier now! I have a fairly popular blog post on the topic of setting up TS and React that I'll update to point to the Microsoft repo to help spread the word.

Here's the package that adds the TS functionality to create-react-app FYI: [https://github.com/wmonk/create-react-app- typescript](https://github.com/wmonk/create-react-app-typescript)

<comment><USER11> No problem, I use TS+React too and definitely support this becoming less of an oddity. Luckily, it's moving in that direction already, with e.g. Jest being far easier to use with TypeScript since Jest 20.

</comment></comment></comment></comment></comment><comment><USER12> I would be interested if anybody has tried both CRE and Neutrino.js ([https://neutrino.js.org/](https://neutrino.js.org/)) and could share their experience with Neutrino? Was it worth it? I'm thinking of using Neutrino.js for my next project (because with CRE you're running against walls if you need just one simple customization from the given defaults, which means to eject)

</comment><comment><USER13> I had to go to the release note to see what version this applies too. But as usual in JS-land, it's not that easy: This applies to version 1.0.0 of the create-react-app uber-project, whereas if you install/update your create- react-app npm, you'll see version number 1.3.1, as that's a separate sub- package.

Naming that setup after a Greek monster seems apropos.

<comment><USER14> The 1.0.0 version is for the `react-scripts` package that `create-react-app` puts in your project. That's the dependency that anyone who's actually using `create-react-app` in a project is actually interested in (since projects created with `create-react-app` don't actually depend on `create-react-app` – it's just a simple CLI). `react-scripts` is the bulk of the project.

<comment><USER15> Yea, sorry this gets confusing. There are good reasons for why we do this, but it can be annoying in blog posts.

Here is an explanation:

[https://github.com/facebookincubator/create-react- app/blob/m...](https://github.com/facebookincubator/create-react- app/blob/master/packages/react-scripts/template/README.md#updating-to-new- releases)

</comment></comment></comment><comment><USER16> I'm currently evaluating using create-react-app. Could someone please confirm the following for me: (1) Without ejecting, it's not possible to use 'styled- components' (2) Would need to eject to do server-side rendering (3) There's no hot module reloading

Not saying these things are deal breakers at all, create-react-app is really great. Just making sure I've got my pros and cons list correct! Thanks for any help

<comment><USER17> styled-components works fine with unejected create-react-app, I use this combination all of the time. Server-side rendering would probably still need ejecting, though, for access to the Webpack and Babel configuration. Same for hot module replacement, which in create-react-app is only enabled for CSS files as far as I know.

<comment><USER18> Webpack's HMR (hot reloading) of JS _does_ work with create-react-app, but only if you use an external state store (like Redux), see [1].

The 'React Hot Loader' [2] module, which maintains local React component state is not included yet.

[1] [https://github.com/facebookincubator/create-react- app/issues...](https://github.com/facebookincubator/create-react- app/issues/93#issuecomment-278625166)

[2] [https://github.com/gaearon/react-hot- loader](https://github.com/gaearon/react-hot-loader)

</comment></comment></comment><comment><USER19> It's nice to see built-in offline caching support with service workers. Can anyone explain how this cache gets invalidated when a change is made to the code?

<comment><USER20> After the app is loaded, the registerServiceWorker.js is executed. It checks for updated sources and updates the cache then. For the user to actually see those changes, the user will need to refresh the page. The relevant lines are here [0].

[0] [https://github.com/facebookincubator/create-react- app/blob/m...](https://github.com/facebookincubator/create-react- app/blob/master/packages/react- scripts/template/src/registerServiceWorker.js#L18-L27)

<comment><USER19> Awesome, thank you!

</comment></comment></comment><comment><USER21> Why do you need a service worker for caching? I thought the browsers did this by default.

<comment><USER22> This is offline cache, you can run your application even without internet connection.

<comment><USER21> What are some examples where offline works for a web app? It seems like the utility is really niched so I don't understand why they make this default. None of the things I've made would make sense using offline (completely anecdotal but still).

<comment><USER11> An example is a webmail client, where in offline mode you can schedule new emails to be sent as soon as you get online again, and where you can still read the emails you've read before.

<comment><USER23> Isn't it the case that the offline resources are considered "caches" and thus might be cleaned up if there's not much storage left?

<comment><USER11> Yes, as far as I know, storage space is still limited, so you wouldn't want to be storing GBs of offline emails. I'm not sure how enforcing works nowadays - it used to be that old offline data would be culled (I think that was for AppCache), but that might work differently with Service Workers.

</comment></comment></comment></comment></comment></comment><comment><USER24> With PWA by default, does it mean react app will be mobile friendly by default and react native is no longer needed to build mobile apps?

<comment><USER8> React Native is for building native mobile applications, React is for building (mobile) websites. So, no, not exactly, but it does make it simpler to create a nice mobile experience for users if a native app is not required.

<comment><USER25> Maybe he means (if OP thinks like me): can I have the app on the home screen like real apps? The answer is probably no, you still would be the "Add to desktop" which most users won't use, and the app won't be on the app store..

</comment></comment></comment><comment><USER26> I have found a bug in it, which was in there in its inception. Should I submit this issue, or simply make a pull request with fix?

<comment><USER15> As you like.

<comment><USER26> I have never done this before, so thought should ask.

</comment></comment></comment><comment><USER27> A little aside - does anyone know what's the colorscheme / theme of the editor in that blogpost?

<comment><USER28> I think it's the Atom default dark theme, or similar to it. The font used is Operator. [https://www.typography.com/blog/introducing- operator](https://www.typography.com/blog/introducing-operator)

<comment><USER15> Operator Mono + Sublime with Spacegray + Oceanic Next

<comment><USER28> Awesome, thanks for the correction. For the gp, if you haven't seen the base16 stuff there's a lot of similar themes to choose from to get the right one for you.[https://chriskempson.github.io/base16/](https://chriskempson.github.io/base16/)

<comment><USER27> Oh cool thanks! useful link too

</comment></comment></comment></comment></comment><comment><USER29> love create-react-app, to get up and running but I've never liked keeping it that way.. I've found ejecting and forging forward from the base react app is best.

<comment><USER30> Curious: What makes you need to eject?

<comment><USER29> having access to the webpack config to set things up the way I like and such. I've also had issues with getting SCSS to work before I eject as well pretty continuously through the versions.. not sure why.

<comment><USER30> What things in create-react-app are not the way you like? Maybe we can make them better for everyone. :)

<comment><USER31> First class typescript support instead of having to rely on [https://github.com/Microsoft/TypeScript-React- Starter](https://github.com/Microsoft/TypeScript-React-Starter)

</comment></comment></comment></comment></comment><comment><USER32> Damn, we just ejected!

<comment><USER33> Looks like you ejected prematurely

</comment></comment><comment><USER34> Shameless plug but we are hiring React Native developers at Dave.com in Los Angeles if anyone is looking. Email email@example.com

</comment><comment><USER35> Off topic, but whenever I see an animation of someone writing an import- statement in Javascript by hand I cringe a little.

This stuff costs so much time, use an IDE or some auto-import plugin for eslint.

<comment><USER36> When I see overeliance on IDEs I cringe a lot.

If the thing that slows down my programming is writing import statements by hand, then I have worse QA issues than that.

<comment><USER24> Writing import statements actually slowed down my angular 2 development by a lot. I was trying to break down functions into tiny components and composite them together and ended up with lots of components in separate files.

Modularity is good and all, but explicitly declaring each single dependent component (external libraries and other internal components) when writing new components and adding new ones as you need more dependencies is quite painful and tedious.

<comment><USER36> > _Modularity is good and all_

Up to a point though -- "break[ing] down functions into tiny components" doesn't seem to be on the good side of modularity, but more like the lpad npm fiasco.</comment></comment></comment></comment>


Zibaldone, the 14th Century's Answer to Tumblr (2016) - <AUTHOR> https://www.atlasobscura.com/articles/how-to-keep-a-zibaldone-a-13thcentury-answer-to-tumblr <comment><USER2> Discussed at the time (in 2016, not the 14th century): [https://news.ycombinator.com/item?id=12405810](https://news.ycombinator.com/item?id=12405810)

<comment><AUTHOR> Hey dang, thanks for pointing that out.

I'll take the opportunity for two quick comments:

1) When posting a link, it would be useful if HN would tell me that it has already been posted - besides what already happens when someone posted it recently.

2) Is there a guideline on how frequently can something be posted and discussed, and what's an "appropriate" time to wait before reposting something that has already been discussed in the past?

Thanks!

<comment><USER2> Yes, it's in the FAQ:

 _If a story has had significant attention in the last year or so, we kill reposts as duplicates. If not, a small number of reposts is ok._

[https://news.ycombinator.com/newsfaq.html](https://news.ycombinator.com/newsfaq.html)

<comment><AUTHOR> Thanks!

The problem though is that if I post frequently, it would be very useful to know that what I am posting is a repost. Do you think this is a feature that could be implemented?

<comment><USER3> If the URL is the same, no new submission is created, but you're redirected to the former submission (and that gets an upvote, I think).

Every now and then you also get "This story has been previously submitted". No idea when exactly, but it seems to be a newer development.

This is not foolproof, of course, many articles are reachable from many URLs, especially if some social media tracking thing is embedded.

<comment><USER4> I would add that nowadays a number of URL's have some parts "variable" at the end and so searching for "your" URL might not give results (but a previous submission with the same "main" URL but a different suffix does exist nonetheless).

</comment></comment></comment></comment></comment></comment><comment><USER5> > Aristotle had suggested his students keep scrolls of notes from their > studies, organized by subject, so that they could return at will to any > topic's "place." Renaissance-era teachers resurfaced this idea, and by the > 17th century, students at Oxford were required to keep "commonplace books," > organized notebooks stuffed with useful texts from elsewhere.

I do organize by topic/title with Bear App, previously I was using simplenote, both use plain text, but Bear has markdown and it is beautifully implemented.

Just to give an example, I have a "page" with a "Postgres" title filled code snippets, URLS, articles, hyperlinks to other "pages" and my own notes. From time to time I came back to these notes, to add or read content.</comment>


Programming with pcap (2002) - <AUTHOR> http://www.tcpdump.org/pcap.htm

<comment><USER2> I was recently trying to write my own TCP stack to solidify my networking knowledge, similar to Julia Evans's efforts [1]. I got frustrated working with raw sockets on my mac, because they don't provide the same level of control as raw sockets on linux [2]. Is pcap a better level of abstraction that is cross- platform? I don't really care about windows, but it would be nice to work on linux and osx.

[1] [http://jvns.ca/blog/2014/08/12/what-happens-if-you-write- a-t...](http://jvns.ca/blog/2014/08/12/what-happens-if-you-write-a-tcp-stack- in-python/)

[2] [http://stackoverflow.com/questions/6878603/strange-raw- socke...](http://stackoverflow.com/questions/6878603/strange-raw-socket-on- mac-os-x)

<comment><USER3> If you only care about OS X, bpf(4) provides a very similar but nicer API for intercepting and sending raw packets. You could even go zero-copy without the hell that is Linux's 3 differently broken AF_PACKET mechanisms. I made a small example program[0] which just intercepts all packets and prints out statistics. The pthread stuff is only there to asynchroniusly handle signals without having to check every syscall for EINTR. Makes it possible to get statistics at run time by pressing control+T, however.

[0] [https://github.com/thasenpusch/bpf- example/blob/master/main....](https://github.com/thasenpusch/bpf- example/blob/master/main.c)

<comment><USER4> pcap is an abstraction over bpf; in fact, the two were originally developed in tandem.

</comment></comment></comment><comment><USER5> I've found libpcap to be a very simple API to use given the power of what it's able to do. However, if you're trying to work with things like TCP streams, writing the reordering logic can be a huge timesink.

The only non GPL solutions I've found are libntoh[1] and libtins[2]. Both are nice, but libtins is much more powerful out of the box, taking care of the pcap code as well. There's one or two things I don't like with the API of libtins, but overall it's a pretty nice library if you want to capture / inject packets.

[1] [https://github.com/sch3m4/libntoh](https://github.com/sch3m4/libntoh) [2] [http://libtins.github.io/](http://libtins.github.io/)

<comment><USER4> Vern Paxson taught me a very simple trick to implementing TCP reordering:

For each TCP flow (each side of an open connection), open a file. Remember the initial sequence number (ISN) for the flow. Now, when a new segment comes in, use its seqno delta the ISN to seek to the correct offset in the file; write the segment contents to that location.

This is, like, 10 lines of code.

Naturally, in a production application, you won't really use FILE-stars or fds to track connections. But it's very straightforward to build an array-based ADT that provides the open/close/read/write/seek semantics of a file --- much simpler than TCP. Meanwhile, you get to start with working code to test against.

<comment><USER6> This reminds me of David Clark's interesting algorithm for datagram reassembly. It puts information about the remaining holes in the datagram into the spaces themselves.

[http://tools.ietf.org/html/rfc815](http://tools.ietf.org/html/rfc815)

</comment></comment></comment><comment><USER7> libpcap is a lot of fun to play with.

Writing a simple protocol dissector, starting with IP, then TCP, then app- level protocols is a good project. I had to do something similar many moons ago. You'll get a sense of what's actually being put on the wire, and what your networking stack is doing for you behind the scenes.

<comment><USER8> With the exception that you don't learn about the OS glue that's used behind the scenes by libpcap. Working with the sockets themselves will get you more intimate with the systems you're programming for versus just the protocols. (For embedded systems without libpcap this may be a requirement)

<comment><USER7> Sometimes the trick to pet projects is scoping them just so. You can always start with pcap and then peel it off later.</comment></comment></comment>


Show HN: iPhone dock that sits on iMac stand + new responsive & interactive site - <AUTHOR> http://www.ocdesk.com/products/ocdock-mini

<comment><USER2> Minor niggle, the slide to unlock is a little off. It's neat and all, but the font and size of the slider look strange.

<comment><AUTHOR> It's responsive to screen size. Best viewed at higher resolutions where the site has space to expand to its full content width, the slide to unlock gets a bit squeezed together on smaller screens and I haven't been able to fix it properly.</comment></comment>


Ask HN: Freelancer's – what is the ideal client - <AUTHOR>

I have a project that has grown to the point I am seriously thinking about hiring someone to pick up some of the dev load I can't find time for, but it is nowhere near fulltime, at most a few months work.
There have been a number of threads about working as a freelancer: what about hiring one?
From a freelancer's perspective: what does the ideal client look like; what should they do; what do they provide (other than $$$!)
Do you provide standard contracts, or does the client propose them; what about NDAs; how long ahead due you typically book (or would consider booking)
Any insights that would make the experience easier on both sides? <comment><USER2> An ideal client is one that understands what they're looking for - too many opt to change specs right before delivery and figure that they change just amount to pressing a button here or there.

Clients should also agree to a schedule for deliverables; don't expect a finished product 27 minutes after the contract has been signed. Conversely, a freelancer should know when to expect payment and due dates.</comment>


Ask HN: Cheap VPS providers, how did you start? - <AUTHOR>

Hi everyone,
I was wondering how do new cheap VPS providers start their business nowadays. It seems there are more and more new providers popping in this world everyday, and with super low prices.
What challenges are you facing ? Also, do some of you launched a business as a part-time job ? I'm currently employed in a company as a software engineer, and I'm wondering about the feasibility of launching such a business using outsource client support as well as outsource network administration (which, for a small business, can cost as low as $50/month for a few servers and few clients).
Thanks for your answers ! <comment><USER2> WebHostingTalk[1] would be a better place to ask this question. There are certainly plenty of companies there that will help you create a turnkey business, but personally I don't think the budget hosting market is very lucrative - if you look at the VPS Hosting Offers forum[2], there are literally people offering VPS hosting for <$2/mo.

[1] <http://webhostingtalk.com>

[2] <http://www.webhostingtalk.com/forumdisplay.php?f=104>

</comment><comment><USER3> They probably don't want more competition</comment>


JP Morgan files for anonymous online payment system - <AUTHOR> http://www.bbc.co.uk/news/business-25326289

<comment><USER2> I would think BBC would do some fact checking. I posted this comment in another blogger's article. [1]

"The author's entire premise is off. The recent filing is a continuation of an application filed on Feb 3, 2000 (see patent 6,609,113). So, Chase wasnt taking a 'swipe' at Bitcoin because the original application was filed 13 years ago."

[1] [https://news.ycombinator.com/item?id=6878442](https://news.ycombinator.com/item?id=6878442)

<comment><USER3> Patent applications filed before the end of 2000 were not published. You can in effect file a continuation as many times as you like, and rewrite the patent substantially as you do. This leads to a tactic called submarine-ing, where you keep filing continuations on a patent that is repeatedly rejected for being overly broad. Then once a concrete target appears on the horizon, you narrow the patent to cover it before prior art, etc is well established.

It's no longer possible to do this with patent applications filed after the end of 2000 due to reform. The period the patent is in force no longer shifts forward with the continuations. But previous applications were grandfathered in.

</comment></comment><comment><USER4> Bitcoin is continually referred to as "anonymous" in the press, but it is just the opposite [1]. Maybe confusion over what cryptographically secure identification is? Some simple network analysis on the public ledger can reveal a whole lot of "identifying" info ...

[1] [http://bitcoin.org/en/faq#is-bitcoin- anonymous](http://bitcoin.org/en/faq#is-bitcoin-anonymous)

<comment><USER5> To a layman, anything less than "know your customer" is "anonymous".

<comment><USER6> This is a dangerous oversimplification that can lead to gross misunderstandings.

</comment></comment></comment><comment><USER7> Here is a article I read earlier today talking about how they are basically trying to patent BitCoin's features

[http://letstalkbitcoin.com/jpmorgan-chase-building- bitcoin-k...](http://letstalkbitcoin.com/jpmorgan-chase-building-bitcoin- killer/)

</comment><comment><USER8> Owning anonymity is an attack on privacy. It means if i want to set up a system where people pay for things without being tracked i have to pay the guys who are tracking all purchases.

Theoretical full ownership of all anonymous payment processes means consumers cannot own their own behaviors without paying a tax on doing so.

If i can hold on to my anonymity i can actually own and even sell my own behaviors. As one example, I could prove to someone that a bitcoin wallet was my own.

</comment><comment><USER9> Can people read? The patent claims are very distinct from Bitcoin: claim 1 requires 2 institutions with customers at each. Bitcoin has no such institutions.

<comment><USER10> Call me paranoid but sounds like they're trying to stop institutions adopting bitcoins as payment to each other otherwise they'll sue? What's the definition of institution anyway? If it's got customers then isn't it the same as a company/business?

</comment></comment><comment><USER11> I guess they are trying to take control of all Bitcoin/digital currency payments by patenting a payment system, and making it as broad as possible.

<comment><USER12> Would their patent be enforceable? Their claims include anonymity. How do you know who to sue if the payments are anonymous?

<comment><USER13> You sue any company with a "Bitcoin accepted here" logo.

</comment></comment></comment><comment><USER14> You just know the anonymous part will never fly; our survellence overlords won't allow it.

<comment><USER15> Which, to me, makes this extremely suspect.

</comment></comment><comment><USER16> Hands up who trusts JP Morgan

</comment><comment><USER17> Patents? No thanks, especially not from some greedy bank.

</comment><comment><USER18> Very interesting, thanks for sharing</comment>


When the Lights Went Out: A History of Blackouts in America - <AUTHOR> https://thereader.mitpress.mit.edu/blackouts-terrorism-history/ <comment><USER2> Ctrl+F "Enron" \- I was surprised not to see it mentioned with respect to blackouts in the US. They had a huge role in California's blackouts in 2000-01. [0]

The story of Enron is fascinating, and there's a great documentary on it, "Enron: The Smartest Guys in the Room". [1]

[0] [https://en.wikipedia.org/wiki/Enron#California's_deregulatio...](https://en.wikipedia.org/wiki/Enron#California's_deregulation_and_subsequent_energy_crisis)

[1] [https://en.wikipedia.org/wiki/Enron:_The_Smartest_Guys_in_th...](https://en.wikipedia.org/wiki/Enron:_The_Smartest_Guys_in_the_Room)

</comment><comment><USER3> I've written about one of those that I got caught up in:

[https://jacquesmattheij.com/a-world-without- power/](https://jacquesmattheij.com/a-world-without-power/)

</comment><comment><USER4> A distributed system like a power grid needs to be __fault tolerant__. It's impractical to protect every portion of it, to have maximum security everywhere. Instead built in redundancy (reliability paths), monitoring (read only, but remote sites can react), and automated responses that validate and mitigate failure modes should be the goals.

Also, the article fails to conceptualize how little resources might be required to cause actual disruption. A bomb might cause a lot of damage on it's own if lobbed in to a substation or a transformer yard at a power plant, but some common conductive cable and a javelin in a potato launcher cross my mind as a ghetto version of the military device mentioned knocking out most of a nations power grid.

<comment><USER5> The grid was built and operated on n minus 1 redundancy. Any single transmission line or substation transformer can fail and there should not be an outage. But if the other transformer in the same substation fails then you are in the dark. Underinvestment has also led to a loss of redundancy: the substation or redundant transmission path operates over 50% capacity some of the time.

Building power lines takes a lot of land, a long time, and is expensive. Redundancy and excess capacity is going to decrease. The system will continue to become less reliable.

<comment><USER6> > Any single transmission line or substation transformer can fail and there > should not be an outage.

That is not always correct. There are numerous radial lines where the failure of a single transmission line caused numerous downstream substations and customers to experience outages...also, not every substation has 2 transmission/distribution Xfmrs with a Tie...I've seen numerous substations with only 1 Xfmr.

> Redundancy and excess capacity is going to decrease. The system will > continue to become less reliable.

You're absolutely correct on this point...</comment></comment></comment>


QuickBooks Bitcoin Payments - <AUTHOR> http://intuitlabs.com/labexperiments/quickbooks-bitcoin-payments

<comment><USER2> Is anyone spending Bitcoin anymore, now that it is considered a taxable event by the IRS?

<comment><USER3> The whole point is the IRS can't see the transaction, as long as you are careful. Of course, sending BTC to a registered business is probably a good way to expose transactions.

<comment><USER4> Oh, really? You want to affirm the notion that Bitcoin is for fraudsters only.

</comment></comment></comment><comment><USER4> Shoot! Now all the fanatics will find an opportunity to annoy us with their "To the moon!" again and again!</comment>


Ask HN: How do you limit liability for side projects? - <AUTHOR> So I'm thinking of putting up an online service as a side project.  However, since it will be storing customer data, I'm concerned about liability.  Since this is just a hobby for now, I don't currently have funding to incorporate, or have a lawyer draw up bullet-proof terms of service.  Should I just sit on my project until I can put some money to it, or just take my chances? <comment><USER2> Disclaimer : I am not a lawyer, I am only a developer, computer scientist and computers lovers :P

First of all, warn your users what you will store and for what purpose. Example : on your registration page

"Email are stored to identify you and to send notifications if you want to (configuration in your profile page). Password will be stored salted and encrypted, but don't forget to pick different ones for different sites. All personal informations that we store will only be used to our purpose and not selled anytime, ie not now neither ever."

Make clear your site is a side project, a beta, an alpha; that bugs may occur; that is possible to create apocalypse and kill kittens (cf disclaimer of VLC beta on Android).

More, if you keep private informations only to identify users, you can tell that all informations will be deleted (and you will) when your project will be full. (beta to production deletion).

</comment><comment><USER3> I want to augment this with the question what is the level of data that id considered private? If you store emails usernames and passwords? Real names?</comment>


Why every user agent string start with "Mozilla" - <AUTHOR> https://webaim.org/blog/user-agent-string-history/ <comment><USER2> How much bandwidth is wasted by this?</comment>


Software flaws used in hacking more than double - <AUTHOR> http://www.reuters.com/article/us-cybersecurity-flaws-idUSKCN0X907N <comment><USER2> Security firms announces more work by security firms needed.</comment>


SCiO: A Pocket Molecular Sensor For All - <AUTHOR> https://www.kickstarter.com/projects/903107259/scio-your-sixth-sense-a-pocket-molecular-sensor-fo?ref=discovery <comment><USER2> For several years I worked in spectroscopy. It's REALLY tough to take a sensor out of a controlled lab and into the uncontrolled real world and get clear, unambiguous results like this video shows. Usually the absorption signal you're trying to measure is tiny compared to changes due to background fluctuations, etc. Things tend to only work well for special types of materials that have very distinct absorption properties. There are massive unknowns here and I would never fund them unless they opened up about what spectroscopic technique they're using.

<comment><USER3> I wrote this elsewhere in this comment section but it is directly relevant to your sentence.

It is probably very similar to how Ubisoft made Just Dance using the Wii controller. The Wii controller was really horrible in terms of what you could read from it (it had no clue what your body position was), but if you stored what measurements you got from people dancing properly you could score people against that. Basically there was enough degrees of freedom to identify decent dancing to a degree and if you hid what was actually going on people though it sort of worked. Although the Wii-based Just Dance is horrible compared to the XBox version that used the Kinetic.

The key is to hide the intermediate results and profile a lot of things using the same crap sensor and then do fuzzy matching between the bad results. This works if there is enough discernible degrees of freedom.

</comment></comment><comment><USER4> Some thoughts from an organic chemist who has a decent amount of experience using IR spectroscopy.

\- IR spectroscopy is _one_ of several methods used _together_ to determine the structure of a molecule. It's certainly not definitive by itself.

\- Some functional groups in molecules will give very specific signals (1700 cm^-1 for carbonyl functional groups, C=O), but for a lot of other functional groups, you get very weak signals that can sometimes be hard to distinguish

\- IR works pretty good for pure compounds, but when you start to measure mixtures, the overlapping signals can get very difficult to isolate and identify

\- As rjdagost mentioned, taking a sensor out of the lab will lead to all sorts of issues. Any stray light will likely cause any readings to look like garbage

I could see this technology being useful to identify different types of plastic. You have a limited universe of possible materials along with some pretty specific functional groups that are either there or not.

To use it as a "molecule sensor for all", seems a big problem to try and tackle.

And how the hell does it determine the ripeness of a avocado through the skin?

<comment><USER5> If your only exposure is analytical lab work (where by definition the work is difficult), you may not be familiar with the breadth of field utility of near- IR.

Some application examples: [https://news.ycombinator.com/item?id=7699186](https://news.ycombinator.com/item?id=7699186)

> And how the hell does it determine the ripeness of a avocado through the > skin?

eg: [http://ucanr.edu/datastoreFiles/234-347.pdf](http://ucanr.edu/datastoreFiles/234-347.pdf) and [http://www.aseanfood.info/Articles/13004404.pdf](http://www.aseanfood.info/Articles/13004404.pdf)

[edit: removed LMGTFY link - sorry, that was rude. But please don't pull the expert card outside your area of expertise: NIR has been used to assess fruit ripeness for _decades_ ]

<comment><USER4> _The optical and internal quality data were then merged and a PLS regression analysis was conducted using the NSAS software package (NSAS, 1990)._

My comment wasn't that you couldn't test the ripeness of fruit using near-IR, it was that you could reliably doing it using a handheld consumer product.

There is a BIG difference between running a lab analysis using near-IR and making a consumer friendly product that can accurately produce the same data.

<comment><USER5> There are multiple manufacturers making NIR-based fruit quality sensors used quite far from laboratory conditions, as well as portable NIR sensors.

(See my other comments in this thread)

<comment><USER4> By "lab setting" I mean someone who can run controls, and do the statistical analysis to arrive a decent data, not just portable equipment.

I guess if they are willing to measure ripeness with a margin of error of +/-50%, that'll work.

<comment><USER6> +/\- 50% wouldn't work in a consumer setting, but +/\- 5% would work great. If you're in a lab, +/\- 5% might be a disaster.

</comment></comment></comment></comment></comment></comment><comment><USER7> There doesn't seem to be any mention of what exactly new technology is this. I would expect all the patents filed at this stage and this information be public - unless there is something fishy or they are going trade-secret route which would be very difficult.

They say the device can detect materials of 1% concentration. But what kind of materials? Spectroscopy is hard, precise measurements are even harder.

Also why are they running $200K campaign? It seems they already have significant staff and $200K would be peanuts as a goal.

<comment><USER8> I managed to come upon a couple interesting pertinent articles. One about other, similar Kickstarter projects that turned out to be scammy[1]. And another article, written by the same journalist about scio[2].

[1] [http://pando.com/2014/04/04/revealed-healbe-isnt- indiegogos-...](http://pando.com/2014/04/04/revealed-healbe-isnt-indiegogos- first-giant-medical-scam/)

[2] [http://pando.com/2014/04/30/consumer-physics-kickstarter- cam...](http://pando.com/2014/04/30/consumer-physics-kickstarter-campaign- shows-that-not-all-crowd-funding-has-to-be-a-dishonest-mystery/)

<comment><USER9> Hopefully it wasn't a "Clever Hans" type of demonstration for the second one. IE, someone watching on camera and then manually entering data into the interface from a different room.

</comment></comment></comment><comment><USER10> Very cool idea, but I hate that it must have data connectivity to work. Not only that, they won't actually give users the raw scan results! You have to transmit them and then get the analyzed results only.

Reality is that many such services inevitably go under, and then your device is useless. Especially when the service is as compute intensive as this one sounds.

<comment><USER11> It's very likely that the Bluetooth protocol will be reverse engineered very shortly after launch anyway.

<comment><USER12> Unfortunately this did not happen with most fitness trackers. There's no successful reverse engineering of Fitbit's, Misfit's or Jawebone's Bluetooth protocol yet. Although the user base and interest may be much higher than that of spectrometers.

I joined the work on reverse engineering Fitbit's protocol but the encryption isn't hacked yet.

</comment></comment></comment><comment><USER13> I see a sort of structural flaw. They seem to be matching measurements against known materials and then reporting that. But where is the utility? Figuring out whether a pill is asprin or tylenol? I'd be interested in identifying characteristic of -new- materials unknown to the database. That's where the raw information is really crucial.

<comment><USER14> This seems like it could be pretty useful to, say, the blind. Also a great educational tool, a notion which isn't just limited to children (one of the primary drivers of change is consciousness raising -- e.g. a dieter monitoring their food intake may find this tool useful).

</comment></comment><comment><USER15> Previous discussion: [https://news.ycombinator.com/item?id=7668156](https://news.ycombinator.com/item?id=7668156)

<comment><USER16> That discussion wasn't very extensive, and there have been several substantive comments in this thread, so we won't bury it as a dupe.

</comment></comment><comment><USER17> Does anyone have an email address to contact them directly? I'm concerned this might be a scam and I want to ask them a few in depth questions and I'd rather not be forced to do that through kickstarter or twitter.

<comment><USER18> Knowing the people behind this, I don't think it's a scam. They have a good staff, so I think they are certainly trying to make this a reality. Are they "hustling their MVP" in startup speak? Maybe, I don't know, I never saw the product (nor did I ask to). Are these people scammers? Absolutely not, to the best of my knowledge.

<comment><USER19> So if you know these people, why not give their e-mail address to InclinedPlane? :).

@InclinedPlane, if you get any response from them I (and probably many other HNers) would be interested in reading both the questions and the answers.

</comment></comment></comment><comment><USER20> Interesting that the first comments are slating this for being cloud-based; in this particular case I think that's like slating Google for being cloud based. The raw data will make sense to very few people without the very large database of "known" things to match against. And that large database will be continually updated as people try new things.

Having said that, I'm not sure who the target market really is. It's basically a Cool Science Toy. Educational use? But in that case maybe it would be nice to show the raw data just to give an impression of how it works.

<comment><USER19> The problem is not with being based on external database - the problem is with that database being privately owned by startup, which is almost certain to disappear within a year or three, at which point the device you bought will be useless.

I'd personally be fine with cloud-based recognition if the database was open, free to copy and host locally.

That, and also not giving access to raw data pretty much kills 90% of possible uses for the devices, turning a cool piece of tech into another pretty much worthless gizmo.

</comment></comment><comment><USER21> Could be good for drugdealers. What pills are these? Do I need to water my plants? Is this avocado "just right" for me...

<comment><USER22> Could be very very good for drug _users_. Being able to find out 'what pills are these' would dramatically change the nature of that marketplace, I think.

</comment></comment><comment><USER23> Taste and smell are already pretty good at this in the noisy background that we live in. I'd really like to see how this works out in practice and if they achieve any degree of accuracy. Labs are labs for a reason, it's to reduce the number of variables you have to contend with while trying to read experimental data from sensors.

</comment><comment><USER24> Looks like another cloud-dependent app.

<comment><USER4> I'm imagining it would have to be. A raw near-IR spectra isn't going to be much use unless you can try and match it up with a database of near-IR spectra of known materials.

</comment></comment><comment><USER25> If this can scan for carbs/sugars, this could be a real winner within the Diabetic community. I would love to be able to eat out and be able to scan my meal and know for sure how much insulin I should take.

Maybe this could even be used in conjunction with an insulin pump and some sort of sensor to determine the amount of food consumed and, BAM, artificial pancreas. (It's that easy! LOL)

</comment><comment><USER5> Here are some links to background information, existing products, and applications of the underlying technology. They could be exaggerating the capabilities of their particular miniaturized sensor, but as far as I can tell they are not making up any new science. Spectroscopy is useful and widely used - but also occasionally oversold, so some skepticism is certainly warranted. The concrete applications they cite have been previously demonstrated (links below).

SCiO uses near-infrared spectroscopy (as clearly stated on the kickstarter page: "How does SCiO work").

Wikipedia: [http://en.wikipedia.org/wiki/Near- infrared_spectroscopy](http://en.wikipedia.org/wiki/Near- infrared_spectroscopy) Scholarly review: [http://www.odin.life.ku.dk/news_letters/Q2_Q3_2005/news001.p...](http://www.odin.life.ku.dk/news_letters/Q2_Q3_2005/news001.pdf)

There are products on the market that do what SCiO claims to do - in field conditions, but generally with a larger form-factor, and at much greater cost. For example:

[http://www.asdi.com/products/fieldspec- spectroradiometers/ha...](http://www.asdi.com/products/fieldspec- spectroradiometers/handheld-2-portable-spectroradiometer)

[http://www.jdsu.com/ProductLiterature/micronir1700-spectrome...](http://www.jdsu.com/ProductLiterature/micronir1700-spectrometer- ds-co-ae.pdf)

[http://www.bruker.com/products/infrared-near-infrared-and- ra...](http://www.bruker.com/products/infrared-near-infrared-and-raman- spectroscopy/ft-ir-routine-spectrometers/mobile-ir/overview.html)

[http://www.ahurascientific.com/material- verification/product...](http://www.ahurascientific.com/material- verification/products/microphazirpc/)

Some NIR application examples:

Agriculture, plants and soil quality assessment:

[http://blog.cimmyt.org/pocket-sensors-for-precision- agricult...](http://blog.cimmyt.org/pocket-sensors-for-precision-agriculture- to-reach-ethiopian-farmers/) [http://www.hindawi.com/journals/js/2012/582028/](http://www.hindawi.com/journals/js/2012/582028/) [http://pubs.acs.org/doi/abs/10.1021/jf201468x](http://pubs.acs.org/doi/abs/10.1021/jf201468x) [http://www.mdpi.com/2072-4292/2/1/290](http://www.mdpi.com/2072-4292/2/1/290) [http://www.sciencedirect.com/science/article/pii/S0016706112...](http://www.sciencedirect.com/science/article/pii/S0016706112003412)

Agriculture, meat assessment:

[http://rd.springer.com/article/10.1007%2Fs12161-013-9611-y#p...](http://rd.springer.com/article/10.1007%2Fs12161-013-9611-y#page-1)

Drug molecular composition (and counterfeit detection):

[http://www.ncbi.nlm.nih.gov/pubmed/18703302](http://www.ncbi.nlm.nih.gov/pubmed/18703302) [http://irvinepharma.com/pdf/A_comparison_of_near_infrared_me...](http://irvinepharma.com/pdf/A_comparison_of_near_infrared_method_development_approaches_using_a_drug_product_on_different_spectrophotometers_and_chemometric_software_algorithms.pdf) [http://www.americanpharmaceuticalreview.com/Featured- Article...](http://www.americanpharmaceuticalreview.com/Featured- Articles/37319-Near-Infrared-NIR-Spectral-Signature-Development-and- Validation-for-Counterfeit-Drug-Detection-Using-Portable-Spectrometer/)

Material characterization:

[http://ssmon.chb.kth.se/vol17/1_Steiner.pdf](http://ssmon.chb.kth.se/vol17/1_Steiner.pdf)

Remote sensing for agriculture (only giving one example here, but this is a huge field. look up "MODIS" or "terra and aqua satellite"): [http://quantalab.ias.csic.es/pdf/130222_e- Informa1832.pdf](http://quantalab.ias.csic.es/pdf/130222_e-Informa1832.pdf)

<comment><USER26> Since similar systems exist, only at a somewhat larger size, miniaturization seems like reasonable option.

And according to [1] they're backed by khosla ventures, which s a highly respectable VC firm. If that's true , that doesn't seem like scam.

[1][http://venturebeat.com/2014/04/29/scio-handheld-sensor- can-d...](http://venturebeat.com/2014/04/29/scio-handheld-sensor-can-decipher- the-chemical-makeup-of-food-pills-and-plants/)

</comment></comment><comment><USER27> You can build your own spectrometer following directions from Public Lab. Their goal is to develop open-source tools for citizen science.

[http://publiclab.org/wiki/spectrometer](http://publiclab.org/wiki/spectrometer)

</comment><comment><USER28> I'm not sure how it's a "sixth" sense. I already have a nose, so at most this is just an augmentation of a sense I already have.

</comment><comment><USER29> I wonder if it could tell you the level of bacteria to determine freshness for example?

</comment><comment><USER30> Holy shit it's a tricorder.

<comment><USER31> This: [http://www.tricorderproject.org/](http://www.tricorderproject.org/) is much closer to my idea of a "real" tricorder project.

Basically trying to combine as many sensors as possible in a handheld form factor.

Also much more transparent as a project.

</comment></comment><comment><USER32> It says for all, but not everyone is going to want to shell out $300 for one of these.

</comment><comment><USER33> My first reaction was : "That's amazing!!!". Indeed a very cool idea. A tiny spectrometer. I would be very much interesting in the details of the technology behind it and what kind of details it can find about the scanned objects.

</comment><comment><USER34> Hm, this is at best utterly misleading and at worst a scam.

<comment><USER16> This is a bad HN comment, not because it's skeptical, but because it has no substance.

An example of a much better comment expressing skepticism is [https://news.ycombinator.com/item?id=7697876](https://news.ycombinator.com/item?id=7697876).

<comment><USER34> Fair point. I was going to get my GF, who actually did spectroscopy and mass spectroscopy as a job at one point, to pitch in. Will do so now.

</comment></comment></comment><comment><USER35> Upvote if this reminds you of "The SmellMaster 9000" from Richie Rich.</comment>


Food taste 'not protected by copyright' rules EU court - <AUTHOR> https://www.bbc.com/news/world-europe-46193818 <comment><USER2> This is surprising since food is one of the oldest subjects of "IP" in Europe:

> [Sybaris around 700 BC] pioneered the concept of intellectual property to > ensure that cooks could exclusively profit from their signature dishes for a > whole year. [1]

[1] [https://en.m.wikipedia.org/wiki/Sybaris](https://en.m.wikipedia.org/wiki/Sybaris)

<comment><USER3> Cooking recipes aren't protected as far as I remember so it would have been surprising to protect the end result.

<comment><USER4> That seems to be true for the most part, but if your recipe contains a lengthy narrative or something, the work as a whole could be covered by copyright[1].

I've seen this in a lot of blogs and recipe books, but I don't know how far it extends, and I'm sure someone could extract just the base recipe from the narrative and the derivative work wouldn't violate copyright.

\- [1] [https://paleoflourish.com/recipe- copyright/#protected](https://paleoflourish.com/recipe-copyright/#protected)

<comment><USER3> Yes, but in that case the copyright extends to the literary work, not the recipe (i.e. the technical process) itself.

Once you have published a cooking recipe you cannot prevent anyone from recreating the dish by following that recipe, even restaurants.

<comment><USER5> Yup. In Europe you don't copyright "ideas" but expressions of them. If a whistle a song and you make a song out of it and sell millions of copies, then I can't claim anything. Now, if I have a sheet of music with that tune written on it, that predates your own version, then I win.

That's made to ensure that ideas are free to flow. That's _very_ good for auhtors (and society in general, as far as I'm concerned)

</comment></comment></comment></comment></comment><comment><USER6> It's somewhat unfortunate that the ruling merely reasons that it wouldn't be practically possible, rather than reasoning that such a copyright would be a burden on society without any real gain.

<comment><USER7> Isn't that a stronger argument? The reason you aren't allowed to hunt unicorns is that they don't exist, not that they are sentient creatures.

<comment><USER6> Not being able to enforce a law is a pretty weak argument. Hunting unicorns isn't the best comparison as that one would be fairly easy to enforce.

If you're more concerned with the unenforceability than the consequences of enforcing a law then something has gone wrong. Going back to your example, a law against hunting sentient creatures would make sense _regardless_ of the fact that establishing sentience is a hard philosophical problem.

<comment><USER8> Not being able to enforce a specific aspect of copyright law led in the 80's to pretty much all countries having to reform their laws.

When home VCRs became commonplace, creating an automatic copy of a broadcast was still illegal. Some German high court ruled that people's right to privacy in their own homes trumped law enforcement's interest in enforcing copyright, so the law was unenforceable in those cases. Hence was born the exemption for "copies for private use", and the related "tax" applied to sales of VCRs (and later on, blank CDs and DVDs) that was used to pay off author associations.

</comment></comment></comment></comment><comment><USER9> It's also worth noting that Heksenkaas is a ridiculously overpriced product, which probably explains why they are trying so hard to keep the competition at bay.

<comment><USER10> I've bought it on sale, but it's just not that appealing. Definitely overpriced.

</comment></comment><comment><USER11> Funny the article made no mention of smell, which one might suspect would be treated in a similar way.

<comment><USER12> Makes me wonder, is there any formal representation for smells like we have with colors?

<comment><USER13> I think one of the problems is that color and what you see is somewhat tightly related where taste and how taste works is highly varied.

While you can get some sort of single-molecule chemical representation of some specific smell or taste, that would be static (as in, the formula or construction wouldn't change) but most people would smell different things.

I suppose for those 'inventions' the recipe or method would be trademarked/copyrighted/patented but not the result.

</comment></comment></comment><comment><USER14> It strikes me as very odd that anyone would even try argue in court that food could be compared to photography, literature, music or film.

<comment><USER15> Creating a good dish doesn't seem any less artistic that creating a good song.

<comment><USER14> I agree that food can be works of art and can require great skill. But to apply copyright laws to food still seems inadequate to me.

</comment></comment></comment><comment> oh-kumudo Well, different people have different taste buds, how are you going to make sure there is a universally agreed representation, of taste?

<comment><USER16> well different people have different retinas, how are you going to make sure there is a universally agreed representation, of a colored trademark =p

[https://m.youtube.com/watch?v=evQsOFQju08](https://m.youtube.com/watch?v=evQsOFQju08)

<comment><USER17> I agree with that personally, having a trademark for a particular colour is clearly a dubious concept.

<comment><USER18> The trademark can only apply to related products. For example you can't sell phones with a logo using t mobile's colour, but you can sell shampoo.

<comment><USER19> But you can't sell Apple Device Management software:

[https://www.bbc.co.uk/news/uk-england- sussex-44107621](https://www.bbc.co.uk/news/uk-england-sussex-44107621)

</comment></comment></comment></comment></comment><comment><USER20> That is not a problem. They would invent a chemical footprint IP right to cover.

<comment><USER21> Even assuming it can be specified precisely enough, they would have to ensure their own product always fell within the footprint, and if the rival product deviated even slightly from it - but not enough to taste significantly different - they would be fine.

But of course to work to do all this would be fantastically expensive in practice, which is a whole other major problem,

<comment><USER20> I think you can describe a group or mixture of chemicals in a chemical footprint in its particular chemical properties, for example, "an alkane chain of 80-85 carbons with an alcohol bound on carbon no. 21 and an ethyl-keto bond on second to the last carbon". Does not have to single out a chemical.

<comment><USER21> How many such chemicals and variations on them are found in, say, as single one of the herbs in the cheese in question? But then it's not just about the raw chemicals in say the herb plant cells, it's also about their structure and relationship with each other.

If you just took a list of all the chemical compounds in say the cells of a herb plant leaf and synthesized them in a chemical slurry I doubt it would taste much like the herb. Which chemicals in the leaf fragments actually evaporate causing the smell? Which ones diffuse into the cheese, and how does the structure mediate that?

</comment></comment></comment></comment><comment><USER22> CopyRighteousness strikes again, how long will it take before someone could copyright the air?

<comment><USER23> Quite the opposite: the EU found that you _cannot_ copyright food tastes.

<comment><USER22> Yes, sure. Just shows that their lobbying was ineffective, better luck next time.

</comment></comment></comment><comment><USER24> This is a strange common sense ruling from the EU, which is most often the lapdog of copyright trolls.

<comment><USER25> On food, EU authorities don't mess about. There is a complicated set of regulations to mark "characteristic" food, which is enforced very rigorously across the continent. The problem seems to be that such regulations mostly cover _traditional_ foodstuffs, whereas modern industrial concoctions (like this crappy cheese) are ignored. Claiming copyright was a somewhat-clever attempt to extend protections.

<comment><USER26> The EU protected designation of origin etc. rights are effectively trademarks, so unlike copyrights or patents there's no harm to consumers. You're free to introduce competing products with the same taste under a different name, e.g. Champagne has to be produced in Champagne in France with specific ingredients and technique, but Spain produces Cava, which is almost identical.

<comment><USER27> In Australia we make "Sparkling Wine."</comment></comment></comment></comment>


If you could only subscribe to 1 feed for tech news, what would it be? - <AUTHOR>

The choice excludes mixed feeds like Hacker News, FriendFeed or a Google search feed.
So, if there was only one publication source for news and opinion for which you could subscribe, what would be the choice, eg a personal blog (Web Strategist), multi-user blog (TechCrunchIT, Inquistr) or a mainstream media site (NY Times Technology Sub Feed).
The focus is on original Tech/Web/IT news and opinion. <comment><USER2> TechCrunch

</comment><comment><USER3> Techmeme

<comment><AUTHOR> From a feed perspective, its links lead to various outside sites as content is not stored on Techmeme.

<http://www.techmeme.com/index.xml>

Thanks.</comment></comment>


Are you a Hyena Startup?, we were… Part 2 - <AUTHOR> https://blog.kuhustle.com/part-2-exiting-hyena-status-and-getting-into-the-graph-e265a3739a4f#.9b23t4t4t <comment><AUTHOR> As a startup we connect clients to Africa's top tech talent, I 'm curious to know what are the reasons that would stop you from outsourcing your software development to Africa, what are your major concerns, What questions do you have ?</comment>


Emerging jobs and the green economy are boosting demand for analytical skills - <AUTHOR> https://www.pewresearch.org/fact-tank/2020/03/23/new-emerging-jobs-and-the-green-economy-are-boosting-demand-for-analytical-skills/ <comment><USER2> If you have o.k. stat skills, and need to work remotely, where is a good place to look.</comment>


Google App Engine Pipeline API - <AUTHOR> http://code.google.com/p/appengine-pipeline/

<comment><USER2> I can't wrap my head around what exactly this does. How is this related to mapreduce? Can anybody explain?

<comment><USER3> Maybe this isn't what they're targeting, but I could see it functioning nicely as a workflow engine (google 'jBPM' for an example).

<comment><USER4> Yeah, I was thinking BPEL for a minute...

</comment></comment></comment><comment> brown9-2 I'm impressed that Google continues to iterate on AppEngine and add features.</comment>