Atom's new concurrency-friendly buffer implementation - <AUTHOR> http://blog.atom.io/2017/10/12/atoms-new-buffer-implementation.html <comment><USER2> [https://github.com/google/xi-editor](https://github.com/google/xi-editor) uses many similar ideas to implement concurrent editing by plugins and other devices. In fact nathansobo, the author of this post, wrote a summary of some of the work Raph Levien (Xi's primary author) has done on CRDTs, so this is probably not a coincidence.

Xi also keeps track of changes using a data structure like Patch. It doesn't use a tree to do so, although we may eventually switch some to use Xi's generic Rope tree data structure. One interesting difference is that Xi always creates another "layer" for every edit and never modifies anything. This leads to lots of layers, but instead of working forwards from a "base text" we work backwards from the current text. So accessing the current text is very fast, and accessing a past snapshot may require mapping in reverse past a small number of edits.

They both solve the same problems though, although Xi's approach of layers for every edit also enables seamless multi-device concurrent editing via a full CRDT merge implementation.

If you're interested in reading in detail about the approach Xi uses, I wrote a big document about it near the end of my internship working on Xi's CRDT: [https://github.com/google/xi-editor/blob/master/doc/crdt- det...](https://github.com/google/xi-editor/blob/master/doc/crdt-details.md)

<comment><USER3> Thanks for this! Great writeup. I'm guessing xi's CRDT uses ideas from Raph Levien's work on combining OT and CRDTs? I've only given Raph's papers a cursory read, but there seem to be a lot of similarities and it looks like he was mentoring you. Does it have an official name yet?

Incidentally, I've also been working on an in-depth article on a particular CRDT: Victor Grishchenko's Causal Trees[1]. The original paper only uses the data structure for text, but I believe it can be extended to a variety of other data types. In brief, the basic convergent structure is a tree of immutable "atoms". This tree is stored in memory as a DFS in-order traversal. I treat each atom as an atomic operation ("insert char" or "delete char" in case of strings), and thus, every user action involves an O(N) mutation of the tree array to insert the new atom in the correct spot, followed by an O(N) re- read of the array to update the user-facing data. This requires the effect of each atom to be O(1) when read in DFS order, but with strings, this follows naturally. A CT string in memory looks a whole lot like your "union string" with explicit delete ops instead of tombstones, e.g. ["ins D","ins O","ins U","del","ins G"] which parses as DOG in O(N), except each atom does in fact have a unique ID and holds a reference to its causal atom — the character intended to be on its immediate left. (So no need for crazy coordinate transforms!) As with xi, you also get a full revision history which can be garbage collected if needed.

My implementation is a work-in-progress, but I've already extended it to basic Bézier drawing and I'm really curious to see how it scales compared to a more OT-like CRDT such as yours. My guess is that CT won't work very well with large files on account of the full O(N) read/write requirement as well as the ~10x memory cost vs. C strings, but on the other hand, it seems that very few other CRDTs can be painlessly tweaked for use with other data types, and this would be a worthwhile tradeoff for me. CT also benefits from a mostly O(N) merge and O(N) past revision viewing, provided you keep to the reconstruct- data-in-linear-time-on-DFS-traversal invariant.

Anyway, CRDTs are super cool! Interesting to see them being used in local contexts, but it totally makes sense, especially since consistency w/garbage collection isn't a concern.

[1]: [https://ai2-s2-pdfs.s3.amazonaws.com/6534/c371ef78979d7ed84b...](https://ai2-s2-pdfs.s3.amazonaws.com/6534/c371ef78979d7ed84b6dc19f4fd529caab43.pdf)

[2]: [https://github.com/archagon/crdt- playground](https://github.com/archagon/crdt-playground)

<comment><USER2> Glad you found my writeup useful, and your CT stuff sounds interesting. You may also find [https://github.com/google/xi- editor/issues/250](https://github.com/google/xi-editor/issues/250) interesting, especially the TODO list of optimizations.

Yes the Xi CRDT (closest we have to a name) is based on Raph's work, plus some discussions we had and about one week of me standing in front of a whiteboard figuring out how to apply the concepts to doing a merge on Xi's specific CRDT structures.

Currently Xi also stores many bytes for each character typed, but one of our planned optimizations is to delta-encode chunks of old revisions. The operations are stored with fields that are designed to delta-encode efficiently so for runs of normal insertions we should be able to get down to ~2 bytes per character.

</comment></comment></comment><comment><USER4> Thanks for the post. Interesting stuff. Atom has come a long way since initial launch, and it still has a long way to go, but its great to see these kinds of improvements.

</comment><comment><USER5> Bit by bit, Atom will become a native editor.

<comment><USER6> Sooner or later everything has to become native. JS/Ruby/PHP/... shit is only for initial launch.

<comment><USER7> How do web programming languages like PHP and Ruby become native?

<comment><USER6> When they decide to abandon:

1\. Dynamic typing

2\. Global interpreter lock

3\. Automatic garbage collection

4\. Interpreting the code (instead of compiling to a single binary).

5\. Virtual machine shit

It is just the matter of time, until the team accepts the pain to learn "How to do stuff in C/C++/Rust?".

<comment><USER8> >3\. Automatic garbage collection >4\. Interpreting the code (instead of compiling to a single binary). >5\. Virtual machine shit

When feeling like the rest of the world is running in a direction of utter madness, it makes sense to re-read "Worse is better" [1] once in a while. However, I agree, DT and GIL aren't helping anything but writing poor code faster and blinder.

[1] [https://www.jwz.org/doc/worse-is- better.html](https://www.jwz.org/doc/worse-is-better.html)

<comment><USER9> FYI: When clicked, that link takes you to an image of a testicle in an egg cup captioned with a sarcastic comment about Hacker News.

You have to copy and paste the url.

<comment><USER10> > FYI: When clicked, that link takes you to an image of a testicle in an egg > cup captioned with a sarcastic comment about Hacker News.

jwz has strong opinions about Hacker News

</comment></comment></comment></comment></comment></comment></comment><comment><USER11> If this gets rid off the freezing issues [https://github.com/atom/atom/issues/7275](https://github.com/atom/atom/issues/7275) then i thank you atom developers for your efforts in fixing it. Although i already switched to VScode it's good to know that there's now more choices available.

</comment><comment><USER12> Reinventing the 40 year old wheel for the 20th time

<comment><USER13> I always hated this metaphor.

I don't know about you, but I sure don't want my new Audi running on stone wheels.

<comment><USER14> Your Audi runs?!?

</comment></comment></comment><comment><USER15> Could WebAssembly, at least when fully realized, be used for this kind of "custom data structure" optimization?

<comment><USER16> Yes, but even faster would be actual native instructions run directly by your CPU.

<comment><USER17> So... webassembly?

<comment><USER18> Webassembly run on VM for portability.

<comment><USER19> Which in turn JIT compiles the code down to your specific hardware, possibly doing some extra optimizations along the way as it cares only about a single processor at a time. I do think languages like Rust are really superior to what we have in JS land, but the VMs there are truly a marvel of modern engineering.

</comment></comment></comment></comment></comment><comment><USER20> > "JavaScript can be quite fast, but fundamentally it's a scripting language > with the unavoidable overhead that implies."

I don't even ... but better late than never.

</comment><comment><USER21> Yay, hopefully no more jankiness. Maybe I can actually use Atom again.

</comment><comment><USER22> Does Atom have a proper side bar yet to show open files? I can't even begin to understand how anyone can get by with tabs when working on big projects. Horizontal file navigation is a terrible idea.

<comment><USER23> Horizontal tabs works better for me. I didn't like the side bar of open files when I tried VS Code.

So it's just an opinion thing - not objectively terrible as you think.

<comment><USER22> It stops being an opinion thing when you are working with so many open files that you can't read their names in the tabs. That's why I specifically said "big projects". VS Code gives users the freedom to show files as they want. Atom doesn't.

<comment><USER23> I work with so many files that I can't read their names in the tabs - so I scroll the list of tabs horizontally - which is exactly what you do I guess if the vertical list doesn't fit on the screen. Or I just find the files again in the project tree. It works fine for me - they can't add everyone's preferred style to the UI or the project would eternally bloat.

</comment></comment></comment></comment><comment><USER16> Atom: reinventing the wheel and never making it round

<comment><USER24> Speaking of reinvention, thanks for the original humour / quip in every submission with Atom in the title.

<comment><USER16> Link me what you are talking about

<comment><USER25> I tried Atom and didn't have a positive experience, so I'm not going to type out a bunch of words defending it. But the "reinvent poorly" comment comes up all the time on Atom posts. You're not adding any original insight or humor.

Here you go:

[https://www.google.co.nz/search?lr=&as_qdr=all&q=allintext%3...](https://www.google.co.nz/search?lr=&as_qdr=all&q=allintext%3A+atom+editor+reinvent+site%3Anews.ycombinator.com&oq=allintext%3A+atom+editor+reinvent+site%3Anews.ycombinator.com)

<comment><USER16> I'm missing the part where someone else said the exact same thing I did.

> the "reinvent poorly" comment comes up all the time on Atom posts.

That's likely because they reinvent things and do it poorly. This post is about yet another instance of that. It isn't something I've seen discussed before, it is a brand new part that has been reinvented poorly.</comment></comment></comment></comment></comment>


Startup School Europe Warmup - <AUTHOR>

Is anyone interested in a Startup School warmup "event" in London on July 25th?<p>Does anyone know a great location for such an event? Maybe an office of a London based startup? <comment><USER2> What a brilliant idea!

I'm happy to host at the GrantTree offices! We're in the heart of Shoreditch. Can host about 100 people for drinks and will happily provide beers, wine and possibly pizza at no cost.

Also, we have a pool table.

Who is taking point for organising this?

Edit: OK, I'll take point on this! Creating an eventbrite meetup as we speak (free of course).

Here's the Eventbrite URL: [https://www.eventbrite.co.uk/e/startup-school- europe-warmup-...](https://www.eventbrite.co.uk/e/startup-school-europe- warmup-tickets-12175763035)

Could the OP or a mod please add this into the initial post? Also, please do register that you're coming, so that we can get an idea of numbers!

Depending on numbers, we'll get Pizza, a beer barrel, etc. If just 20 people sign up we probably won't bother ;-)

Update: 24 already... looking good, keep it coming :-)

Update 2: 40!

Update 3: 60!

Thought I might as well submit it here since this thread has fallen off the page: [https://news.ycombinator.com/item?id=7989159](https://news.ycombinator.com/item?id=7989159)

<comment><USER2> 100 People signed up! It's going to be awesome!

I've added another 50 tickets. We'll figure out a way to fit more people - there's a courtyard, and we can put up a marquee if the weather's bad.

<comment><USER3> Thanks for organizing swombat, looking forward to seeing everyone there!

</comment></comment></comment><comment><USER4> If it's an evening thing, I'll be there.

As for the venue, try hitting up [http://shoreditchworks.com/villagehall](http://shoreditchworks.com/villagehall) \- they are very generous with that space when it comes to user groups and other community related stuff.

</comment><comment><USER5> For those who didn't manage to grab a ticket there's also pre-event drinks being hosted by EF at their HQ in London Bridge. There will be some YC Alum there too. Signup URL: [https://www.eventbrite.co.uk/e/pre-startup-school- drinks-wit...](https://www.eventbrite.co.uk/e/pre-startup-school-drinks-with- yc-alum-hosted-by-ef-tickets-12193680627)

</comment><comment><USER6> If it's something like a casual visit to a pub, I'll bite. For the time being my party's having difficulty finding a place to stay though.

</comment><comment><USER7> Yes! Ideally in the evening. Also, happy to connect with people virtually before that. Keen to talk to anyone doing B2B SaaS.

[https://twitter.com/olegpodsechin](https://twitter.com/olegpodsechin)

[https://www.linkedin.com/in/olegpodsechin](https://www.linkedin.com/in/olegpodsechin)

<comment><USER8> Same here:

[https://twitter.com/woutervanlent](https://twitter.com/woutervanlent)

[https://www.linkedin.com/in/woutervanlent](https://www.linkedin.com/in/woutervanlent)

</comment></comment><comment><USER9> For anyone who misses out on registering for swombat's event, check out Silicon Drinkabout - a regular Friday night after-work drinks meetup that takes place in or around Shoreditch.

[http://www.silicondrinkabout.com/](http://www.silicondrinkabout.com/)

</comment><comment><USER10> I would love to be there for this!How about 26th?

[http://twitter.com/karambinu](http://twitter.com/karambinu) [http://mt.linkedin.com/in/stefanbuttigieg/](http://mt.linkedin.com/in/stefanbuttigieg/)

</comment><comment><USER11> Could possibly use Google Campus

<comment><AUTHOR> I checked the event calendar for the google campus. However, it seems that there is an invite only launch party for a startup at July 25th.

It would be awesome if you are able to organise a room on the google campus.

</comment></comment><comment><USER12> Shit, I wish I had a visa for the UK. Can something similar be hosted within the Schengen countries like Berlin or Prague where its more central.

</comment><comment><USER13> I'll be in the city around 7 PM Friday, up for anything after that. [https://twitter.com/martinmelin](https://twitter.com/martinmelin)

</comment><comment><USER14> Is this a "food + drinks in evening" kind of warmup or "food + drinks + talks in the daytime" kind of warmup? I'm interested regardless.

</comment><comment><USER15> I'd love to do that, however, I'm only arriving at 21:30. I hope it's still going strong by the time I'm there.

</comment><comment><USER16> On the smaller side, I'd be interested in an evening pint down the pub if anyone is arriving the day before.

</comment><comment><USER17> I'd be interested if it's afternoon/evening and not a million miles away from a tube stop.

</comment><comment><USER18> I am interested as well but i depend on other people so cannot commit to anything unfortunately.

</comment><comment><USER19> I might be able to get there a day early, not sure. It will depend on a couple of factors.

</comment><comment><USER20> I am interested.

On a related note, someone travelling from/via Brussels?

</comment><comment><USER8> Arriving in London City around 20:00. Definitely up for something like that!

</comment><comment><USER21> could be great... someone already booked vacations. Next time would be great to know it a bit more in advance (especially for the ones wishing to combine it with corporate jobs).

</comment><comment><USER22> Colour me interested. I'm arriving a day earlier anyway.

</comment><comment><USER23> Would love it. Anyone else from Norway coming? pm me.

</comment><comment><USER24> Should be arriving the day before. Count me in.

</comment><comment><USER25> I will be there if a space can be found

</comment><comment><USER26> I'll be interested as well.

</comment><comment><USER27> I'd be interested too.

</comment><comment> grey-area I'd be interested

</comment><comment><USER28> Definitely interested

</comment><comment><USER29> how many people can the main event have?

</comment><comment><USER30> definitely interested! count me in.

</comment><comment><USER31> Why not?</comment>


Git Blame-Someone-Else - <AUTHOR> https://github.com/jayphelps/git-blame-someone-else <comment><USER2> What is more, you can:

1\. clone [https://github.com/torvalds/linux](https://github.com/torvalds/linux) into [https://github.com/<YOURNAME>/linux](https://github.com/<YOURNAME>/linux).

2\. push a fake "torvalds" commit into your repo.

3\. check the SHA of the the commit that you made.

4\. the commit will be visible at the original repo URL with your SHA ([https://github.com/torvalds/linux/commit/<SHA>](https://github.com/torvalds/linux/commit/<SHA>)), with no indication whatsoever that this is coming from a different repo

I have reported this problem to GitHub a while ago and they replied to me that this is a well known feature of the repo "network".

<comment><USER3> I've never really understood Torvalds' reason for not cryptographiclly signing commits.

> Btw, there's a final reason, and probably the really real one. Signing each > commit is totally stupid. It just means that you automate it, and you make > the signature worth less. It also doesn't add any real value, since the way > the git DAG-chain of SHA1's work, you only ever need _one_ signature to make > all the commits reachable from that one be effectively covered by that one. > So signing each commit is simply missing the point.

[http://git.661346.n2.nabble.com/GPG-signing-for-git- commit-t...](http://git.661346.n2.nabble.com/GPG-signing-for-git-commit- td2582986.html)

<comment><USER4> Because each commit is in a cryptographically secure chain, when you sign a Git tag it vouches for the referenced commit and all the commits preceding it. This can be done at important moments such as each release.

<comment><USER3> Sure, but in the case presented by great-grand-parent is a leaf commit with an unknown providence.

At the very least I don't think it's "totally stupid", even if I know it's not a panacea for all ills.

</comment></comment></comment></comment><comment><USER5> It's funny but it doesn't actually work because the hash of the modified commit and all subsequent ones will necessarily change, right? So it would be very visible to everyone that a change has been made as it might break a lot of things to force-push an incompatible history of commit.

<comment><USER6> The following hashes do changes (you can see that on the gif on their readme). I think you're meant to force push after using the tool

</comment></comment><comment><USER7> This might have a serious use. I have a private repo that I worked on with my daughter. If I open source it, ideally I'd keep the chronological history but scrub her email address out of it. It's OK that all the commit hashes would change. Would I want to adapt this joke tool to that purpose, or is there an exiting tool for rewriting history that way?

<comment><USER8> The standard way to do that is with 'git filter-branch'. If your daughter's email is firstname.lastname@example.com,

        git filter-branch --env-filter '
        firstname.lastname@example.com
        new_email=redacted
        if [ "$GIT_COMMITTER_EMAIL" = "$old_email" ] ; then
            export GIT_COMMITTER_EMAIL="$new_email"
        fi
        if [ "$GIT_AUTHOR_EMAIL" = "$old_email" ] ; then
            export GIT_AUTHOR_EMAIL="$new_email"
        fi
        ' -- --all

This is "safe" in the sense that you can go back to the old version with the reflog if you screw things up.

<comment><USER9> Seconded. The git blame-someone-else tool is just using git rebase and git commit --amend internally to alter one specified commit.

git filter-branch is perfect for this kind of wholesale revision. filter- branch is essential for tasks like: open-sourcing repos that need some kind of cleanup, massaging repos generated by a VCS migration tool, etc. For example, years ago I participated in the move of a large CVS repo to git; there was significant filter-branch post-processing required to create an acceptable baseline)

</comment></comment></comment><comment><USER10> A few years ago I made a similar project with a slightly different twist: [https://github.com/JacobEvelyn/git-self- blame](https://github.com/JacobEvelyn/git-self-blame)

I did it as a learning exercise, and if anyone's interested I documented the source in a lot of detail to show everything I learned along the way.[1]

[1] [https://github.com/JacobEvelyn/git-self- blame/blob/master/gi...](https://github.com/JacobEvelyn/git-self- blame/blob/master/git-self-blame)

</comment><comment><USER11> And that is why signing commits should be enforced.

<comment><USER12> You would already get a conflict as the history of the repo changed and signing all commits as some drawbacks as Torvalds explained here: [http://git.661346.n2.nabble.com/GPG-signing-for-git- commit-t...](http://git.661346.n2.nabble.com/GPG-signing-for-git-commit- td2582986.html)

I'm not sure it's better.

<comment><USER13> I think Torvald's stance is reasonable when considering a customer's safety as guaranteed by an organization. E.g. this build is signed as safe.

Commit signatures are useful in large organizations designed to worry about insider threats. If code that is reckless or malicious is found in a build, you want repudiation of the author. Lack of commit signatures allows a malicious actor to cover their tracks.

And also, we should accept that we don't treat all authors with the same scrutiny. Veterans' code gets scrutinized less, so let's actually trust that they're the real author before signing a tag with their code.

<comment><USER14> How would merges work there?

I've had a coworker, "Tom", who was terrible with three way merges (why is it the people awful at merges want to do the most merges by insisting on feature branches for their code?)

I'm still not sure what he was doing but some of his merges ended up with the wrong name next to code. We started figuring this out about him when "George" was getting dressed down for a bug he introduced.

Two things drew me into this. First, I was getting tired of things being blamed on George. Everybody in this group had issues, nobody should have been pointing fingers at anybody else, especially this guy or his partner in crime, Tom. But equally important to me at that moment was that I was the primary on that code review, so now it's on me too.

A lot of code I look at becomes a bit of a blur, but I remembered this block of code particularly well, because it was the sort of tricky code that George sometimes cocks up but bless him if he didn't get it right on the first try. Only the code we were upset about wasn't the code I reviewed. His name was on it. The commit sequence lined up. What the hell.

An excruciatingly long git bisect later (git bisect is not built for some things, this included) and I track it down to a bad three way merge by Tom. He ended up with some bastardized version of left and right that had its own set of bugs, and George's name on the commit. I hadn't known you could do that with Git. It was quite upsetting.

<comment><USER15> Do you have any more information of any kind on this (like info you have run into since then)? This sounds very interesting and it also sounds like something I should be aware is possible to do (especially on accident).

</comment></comment></comment></comment></comment><comment><USER16> Personally, I find this really useful when I accidentally squash something incorrectly during a rebase and in the process of cleaning it up end up with changes attributed to the "wrong" person.

<comment><USER17> Check out `git reflog` to go back to before the mistake

</comment></comment><comment><USER18> Obligatory self-promotion of my opposite joke project, git-upstage, which steals credit for someone else's work. (Squashes their branch to a single commit under your name and backdates it five minutes.)

[https://github.com/SilasX/git-upstage](https://github.com/SilasX/git-upstage)

(Inspired by the time someone typo'd "unstage" to "upstage" and I guessed what a git-upstage command would be.)

</comment><comment><USER19> This will come in handy when the Australian Government compels a programmer to put a backdoor in their companies software.

</comment><comment><USER20> I really dislike the term chosen for this feature. "Blame", assumes the code is broken or written improperly in some way. Most of the time I use it I'm just trying to find out who wrote it so I can find the original commit to understand it in more context.

Should have named it "git who"

<comment><USER21> SVN has the alias "svn praise".

I was disappointed that git didn't have it, so I created myself one. I'm glad git has trivial support for aliases.

<comment><USER22> AFAIK original was "cvs annotate" [1]. Subversion introduced "svn blame" and "svn praise" aliases for "svn annotate" as some kind of joke. It's funny that git only has "git blame".

[1] [https://compbio.soe.ucsc.edu/cvsdoc/cvs- manual/cvs_74.html](https://compbio.soe.ucsc.edu/cvsdoc/cvs- manual/cvs_74.html)

</comment></comment></comment><comment><USER23> Mine is [https://github.com/some1else](https://github.com/some1else)

</comment><comment><USER24> Loool

</comment><comment><USER25> isn't this just a wrap on top of git rebase -i HASH^; git commit --amend --author "Jhon Doe"?

Also, as already noted, this overwrites all the history after the commit, making it useless.

Then people said it's a joke...

I know I will get downvoted for this comment, but How did this make to the first page of HN?

<comment><USER26> It's Friday, some levity is acceptable here and there.

<comment><USER25> =)

Sounds fair.</comment></comment></comment>


De-Dollarization and Safer Alternatives to Centralized Dollar for Global Trade? - <AUTHOR> https://www.linkedin.com/pulse/de-dollarization-cryptocurrencies-safer-alternative-dollar-sharma/ <comment><AUTHOR> I think this article by the author tries to justify cryptocurrencies as a more efficient mechanism to handle monopoly. But cryptocurrencies are not scalable neither they have any proven use case as a currency.</comment>


Show HN: VisualTail graphical tail with pattern matching - <AUTHOR> https://github.com/santiagolizardo/visualtail

<comment><AUTHOR> Developer here: Just wanted to share this simple Java Swing tool with you. Is a graphical tail with pattern matching/highlighting written in Java Swing. It works ok in multiple platforms against files of size from a couple of MB to few GB.</comment>


Taking down Gooligan, an Android botnet - <AUTHOR> https://www.elie.net/blog/security/taking-down-gooligan-part-1-overview <comment><USER2> A very interesting article that is yet another reason to update your phones.

Shame that vendors don't care to support security updates.

<comment><USER3> Yeah I just don't understand why Carriers (ATT, Verizon etc.) and Manufactures (Samsung, HTC) can't work out a standard deal for providing continuous software upgrades.

I will single out Samsung though: they supposed to be the purveyor of "premium" android phones, but still seem to consider software as second class feature. If they had taken the initiative, maybe they would have set a standard for others to achieve?

As of now, I get the feeling that Samsung users are just resigned to using whatever software Samsung provides...</comment></comment>


A simple command allows the CIA to commandeer vulnerable Cisco switches - <AUTHOR> https://arstechnica.com/security/2017/03/a-simple-command-allows-the-cia-to-commandeer-318-models-of-cisco-switches/ <comment><USER2> Critical vulnerabilities in Cisco products that the CIA can exploit?

 _" Cisco vice president of services Mike Quinn, a former CIA operations officer, ..."_ [0]

 _"... Cisco's recent acquisition of In-Q-Tel-backed security company ThreatGRID ..."_ [1]

 _" After retiring with 30+ years of service from the Agency, I spent several years as adviser to Cisco System's Chief Security Officer, and I found Cisco was doing great work; they're one of the backbones of the internet."_ [2]

Imagine that.

[0] [http://www.networkworld.com/article/2223473/data- center/cisc...](http://www.networkworld.com/article/2223473/data-center/cisco- vp-to-memo-leaker--finding-you-is-now--my-hobby-.html)

[1] [http://www.networkworld.com/article/2358453/security/cisco-p...](http://www.networkworld.com/article/2358453/security/cisco- purchase-of-cia-funded-company-may-fuel-distrust-abroad.html)

[2] [https://www.forbes.com/sites/realspin/2012/10/12/what-do- for...](https://www.forbes.com/sites/realspin/2012/10/12/what-do-former-cia- spies-do-when-they-quit-the-spy-game/)

<comment><USER3> 1\. The vulnerability was probably exploited before the CIA guy joined Cisco. The Vault 7 cache contains some seriously legacy docs.

2\. Why would the ex-CIA guy hurt his _current employer_ to help his former? Don't people do it the other way around?

3\. Good luck finding a single Fortune 500 company that doesn't employ someone that used to be in the Intelligence Community.

4\. Telnet options are pretty arcane. It seems like an easy bug to write. The _modus operandi_ of U.S. backdoor attempts in the past matches a different model. U.S. backdoor attempts fit two models: backdoor dependent on secret key (Dual_EC RNG), and backdoor dependent on physical sabotage (interdiction). This is stuff available in the Snowden docs and related news reports.

It's a common HN meme that Cisco and Microsoft help the U.S. government spy, but there isn't credible evidence supporting it. They actively resist government espionage attempts.

Yahoo, RSA, et. al. deserve the negative attention, not companies that fight the good fight.

<comment><USER2> The edit window just expired as I attempted to amend my original comment, so I'll amend it here:

Those links were the result of a few cursory Google searches. It wasn't intended as a comprehensive representation of Cisco's CIA ties, nor to imply that anyone mentioned was directly involved in backdoors. Rather, the point was that when a security-oriented organization employs ex-spooks, it increases the likelihood of spooky things happening. At the very minimum it fosters distrust.

> _2\. Why would the ex-CIA guy hurt his current employer to help his former? > Don 't people do it the other way around?_

While I didn't mean to imply any specific individual, I'll address the underlying rationale: When someone's former employer is a powerful government spy agency built on secrets, the loyalty dynamic is a bit different than that of normal private sector job hopping.

Moreover, I'm sure the CIA isn't stupid and tends to maintain relationships—intentionally or not—with former employees that cross over to private sector work, especially high-level people since they're already trusted, reliable, and may be taking positions that later prove to be beneficial to CIA interests in the future.

> _3\. Good luck finding a single Fortune 500 company that doesn 't employ > someone that used to be in the Intelligence Community._

This is a fair point. Given the nature of Cisco's products, and combined with recent leaks detailing the pervasive nature of US offensive cyber efforts, it should raise more suspicion than normal when former IC people go to work for a company dealing with network hardware.

That said, I'm not sure how you'd quantify the number of former IC people Cisco hires versus a normal Fortune 500 company. For all I know it could even be lower than average.

> _... and backdoor dependent on physical sabotage (interdiction) ..._

This approach is far superior to baking vulnerabilities into entire product ranges (or even standards). It doesn't compromise the private sector in the process, beyond perhaps supply chain integrity. The flipside of course is that physical implants don't really scale well, but at least the blowback is relatively minimal when things go wrong. Not to mention it's just badass in a _James Bond_ kind of way.

> _It 's a common HN meme that Cisco and Microsoft help the U.S. government > spy, but there isn't credible evidence supporting it. They actively resist > government espionage attempts._

While that's true, it's also possible a company can publicly say or do one thing—genuine or not—and actively do another because of either connections, or that they're being compelled against their will by NSLs. It's also possible to have factions or even individual employees within a company that are actively subverting security with the addition of backdoors, unbeknownst to management.

<comment><USER4> > At the very minimum it fosters distrust.

why? how is someone who has been vetted by the IC as a trustworthy keeper of _their_ secrets become less trustworthy?

> CIA isn't stupid and tends to maintain relationships with former employees > that cross over to private sector work

what kind of "relationships" are you talking about here?

<comment><USER2> > _why? how is someone who has been vetted by the IC as a trustworthy keeper > of their secrets become less trustworthy?_

Because their loyalties may lie with their former employer. National security matters tend to take priority over private sector loyalty for many people, and I'd imagine especially so for former IC types since they tend to be extremely patriotic. I mean that as a compliment, not an insult.

> _what kind of "relationships" are you talking about here?_

Personal relationships. Say Joe retires for private sector work. He's good friends with Bill, who's a case officer. Later when some national security matter comes down the pipe requiring access at Company Y, Bill knows Joe who works there. Seeing that Bill and Joe have been through some shit together, that relationship is probably going to supersede loyalty to any private sector employer _when there are underlying national security motivations involved_.

It's not tinfoil hat conspiracy allegations, just basic human dynamics.

<comment><USER3> Again, I'm glad you're engaging. I'm not down voting you.

> Because their loyalties may lie with their former employer.

By that logic, Apple shouldn't hire any employees from Google, because they might reveal iOS secrets.

> Personal relationships... that relationship is probably going to supersede > loyalty to any private sector employer

Sure, anything could happen. In your example, Joe gets nothing except enormous risk of public humiliation and expensive litigation in exchange for the favor to Bill. Any employee that is involved in this would almost certainly speak to someone. This isn't like a National Security Letter; there's no force of law to compel silence. It would be a foolish move for Joe.

Then Bill gets a call on his gray phone from his boss. "Why is the CIA in the newspapers for attempted backdooring of Cisco products?" We don't hear about this stuff because it doesn't happen like this.

People that are so loyal to the CIA don't leave for a pure private sector company. They go to a contractor so they can stay in the ecosystem. People going to Cisco are (1) physically moving away from Northern Virginia, (2) losing access to secrets.

Besides, it doesn't sound very patriotic to insert backdoor that's not even protected by a secret (e.g. key escrowed Clipper Chip, P and Q in Dual_EC) that goes into hardware purchased by more Americans than anyone else in the world.

<comment><USER2> > _By that logic, Apple shouldn 't hire any employees from Google, because > they might reveal iOS secrets._

Apple and Google are on the same playing field though. They're fundamentally the same type of entity. An intelligence agency vs a pure private-sector company is not.

> _Any employee that is involved in this would almost certainly speak to > someone. This isn 't like a National Security Letter; there's no force of > law to compel silence. It would be a foolish move for Joe._

While certainly risky, I'm not saying Joe wouldn't be legally protected. His favor very well could be under the auspices of an official program. Heck, IANAL but it possibly could even be in the form of an NSL. As far as I'm aware they're the legal equivalents of blank slates and don't necessarily require informing the upper echelon of a company of their issuance, but I could be wrong on that. I know that it is at least customary to do so, however.

Either way, let's say the government wants to issue a NSL requesting a very specific, perhaps even temporary backdoor to a Bay Area company. The normal route would likely start a veritable war with that company's legal department, and runs a non-insignificant chance of being leaked by those who know about it.

Contrast that scenario to issuing the NSL directly to Joe, who they know in advance is solid. If Joe happens to be an engineer, mission accomplished. If he isn't technical, then maybe he just happens to bring a USB stick to the office one day and plugs it in.

If that sounds far-fetched, keep in mind that the NSA compromised Google's internal network during the course of their operations, so network exploitation against U.S. companies isn't even off the table.

> _People that are so loyal to the CIA don 't leave for a pure private sector > company. They go to a contractor so they can stay in the ecosystem. People > going to Cisco are (1) physically moving away from Northern Virginia, (2) > losing access to secrets._

All good points, but it doesn't mean they're cutting ties and shunning their former life either.

> _Again, I 'm glad you're engaging. I'm not down voting you._

Thanks. :)

<comment><USER3> > Apple and Google are on the same playing field though. They're fundamentally > the same type of entity. An intelligence agency vs a pure private-sector > company is not.

Good point; my analogy fails.

> NSA compromised Google's internal network

News stories that used that phrasing were being inaccurate; the collection was of plaintext traffic between international Google datacenters. The Intercept explains it pretty well.

> As far as I'm aware they're the legal equivalents of blank slates and don't > necessarily require informing the upper echelon of a company of their > issuance, but I could be wrong on that. I know that it is at least customary > to do so, however.

The point I'm making is that it's rational for people not well-versed in the minutiae of foreign intelligence regulations to think that intelligence agencies can and do intrude however they please on private companies. In reality, its with great caveats and with a (perhaps insufficient) legal process that introduces friction. It is far more overt and less cloak-and- dagger than would ordinarily be desired. The most clandestine way possible to spy would be with the badass methods we talked about earlier.

> Either way, let's say the government wants to issue a NSL requesting a very > specific, perhaps even temporary backdoor to a Bay Area company. The normal > route would likely start a veritable war with that company's legal > department, and runs a non-insignificant chance of being leaked by those who > know about it.

NSLs aren't a magic spell that gives the government whatever it wants. They go through a company's legal department and are subject to limitations. Several companies have successfully defeated the gag order portions of their NSLs. Having an inside man wouldn't be particularly advantageous since the company lawyers must get involved (the U.S. hasn't yet prohibited a person's legal representative from viewing writs).

At the end of the day, the government has a monopoly on violence and can sent the Army to invade Cisco or anyone else it doesn't like. But due to the conscientious individuals that make up the government, and the public relations and legal risks that are involved, this is unlikely to happen. What I'm describing is a series of norms that are unlikely to be broken in the course of spying business. There are far cheaper, easier, and less risky ways to accomplish espionage than a covert, mass-distributed, plaintext backdoor.

I do wish that the credibility of U.S. companies was taken into account more often when espionage decisions are made. The terrible optics behind PRISM made it look like companies were volunteering information, when the government was coercing them through the NSL program.

<comment><USER2> > _News stories that used that phrasing were being inaccurate; the collection > was of plaintext traffic between international Google datacenters._

A US intelligence agency targeting a portion of a US company's infrastructure that just happens to be international still constitutes a breach of trust. Whether that means they'd go as far as compromising an office network located in the United States is another matter, but I seem to recall a talk given by a security chief at Google discussing their use of custom RISC-V silicon for security due to their threat model including nation-state actors, with explicit mention of Western intelligence agencies. I wish I could find the link.

> _The point I 'm making is that it's rational for people not well-versed in > the minutiae of foreign intelligence regulations to think that intelligence > agencies can and do intrude however they please on private companies._

The mental gymnastics[0] that the NSA already uses to legally justify domestic collection on US citizens doesn't really inspire confidence that the IC wouldn't stoop to similar antics when it came to private companies.

> _Having an inside man wouldn 't be particularly advantageous since the > company lawyers must get involved ..._

Must they? My point was that legally compelling an insider who's already on your side might serve as an interesting loophole. Especially if they're not required to inform counsel and have no intention of doing so. Like I said though, IANAL.

> _... (the U.S. hasn 't yet prohibited a person's legal representative from > viewing writs)._

It's worth noting that in the early days that wasn't so clear:

 _" CONAN: And they are roughly equivalent to subpoenas.

Mr. LICHTBLAU: Yes and no. There are differences - one of the key differences is that for a long time the recipient was not even allowed to tell you when they received such a letter.

CONAN: Even their own lawyer.

Mr. LICHTBLAU: There was debate about whether or not you could even get a lawyer."_ [1]

> _I do wish that the credibility of U.S. companies was taken into account > more often when espionage decisions are made. The terrible optics behind > PRISM made it look like companies were volunteering information, when the > government was coercing them through the NSL program._

Agreed.

[0] [https://news.ycombinator.com/item?id=10605489](https://news.ycombinator.com/item?id=10605489)

[1] [http://www.npr.org/templates/transcript/transcript.php?story...](http://www.npr.org/templates/transcript/transcript.php?storyId=6885103)

<comment><USER2> > _I wish I could find the link._

Eric Grosse at 5th RISC-V Workshop, 2016:

[https://www.youtube.com/watch?v=0knR6vXba7g](https://www.youtube.com/watch?v=0knR6vXba7g)

Slides: [https://riscv.org/wp- content/uploads/2016/12/Tue1330-RISC-V-...](https://riscv.org/wp- content/uploads/2016/12/Tue1330-RISC-V-Google-Keynote.pdf)

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER5> "We are shocked that the CIA has the ability to use the command that we left in our firmware for them..."

</comment><comment><USER6> If you're exposing telnet to the public internet on anything you need to rethink whether you're competent to run internet infrastructure.

<comment><USER7> I doubt that many Cisco shops expose telnet to the public internet, but I bet plenty of them have it exposed on a "secure" internal network since they know that no outside attacker can possibly reach it.

<comment><USER6> 99% that I know of have _at least_ disabled telnet even on internal. SSH2 only. And/or access via secured bastion/console server to a login prompt via RS232 9600-8N1 connection.

</comment></comment></comment><comment><USER8> ArsTechnica article as of this posting:

> _Cisco Systems said that more than 300 models of switches it sells contain a > critical vulnerability that allows the CIA to use a simple command to > remotely execute malicious code that takes full control of the devices. > There currently is no fix._

Text on Cisco Support Site linked on ArsTechnica:

> _This vulnerability affects the following Cisco devices when running a > vulnerable Cisco IOS software release and configured to accept incoming > Telnet connections: [Models list]_

Put aside for a moment the 'desireability' of the outcome, but from what I gather on Cisco's site, by turning off incoming Telnet connections, the vulnerability can be fixed. I'm rather confused about this.

<comment><USER9> Disabling the service is a way to protect you from the vulnerability, but it is not a fix for the vulnerability. A fix for the vulnerability would allow you to continue using the service.

<comment><USER10> The article kind of makes it sound like telnet is somehow necessary and that disabling it hasn't been a best practice for years.

Maybe there are still old devices that don't support SSH and you literally have no option, but really, what other reason is there to have telnet enabled?

<comment><USER8> That's what I was thinking about. On the Cisco support site Telnet gets barely a mention. It is apparently not the flagship feature of these switches and whatnot. Okay maybe it's customary to leave it open but there's a lot of lazy practices that result in bad security, not just headline "vulnerabilities" that affect - gasp - 300+ models!

So, basically I think Ars Technica's sub-par quality strikes again, in that a tech site gets a fundamental understanding of technology wrong. If something isn't mission critical, can be turned off, and alleviates a vulnerability, then that's a way to fix it. Plain fucking English.

<comment><USER11> No, that is a workaround. Telnet is still broken until they patch the security hole.

</comment></comment></comment></comment></comment><comment><USER12> Thank god only the CIA knows the "simple command".

<comment><USER13> It was probably that simple on purpose, knowing Cisco's ties to intelligence agencies.

<comment><USER3> What are those ties? Besides speculation and the fact they sell equipment to intelligence agencies (and everyone else).

</comment></comment></comment><comment><USER14> Shameless plug for my old buddy Ang's product, Symbiote Defense. Definitely watch the DEFCON talk about this.

[https://www.redballoonsecurity.com/](https://www.redballoonsecurity.com/) [https://www.youtube.com/watch?v=HyEiMyyrfyE](https://www.youtube.com/watch?v=HyEiMyyrfyE)

</comment><comment><USER15> Headline is pretty click-baity.

It looks like a better version might be "Some older Cisco switches are vulnerable to a simple telnet-based exploit." And then buried deep in the body it could be noted that, while the CIA should probably be expected to be aware of any vulnerabilities, we actually know that they are aware of this one in particular due to some leaks.

(Whereas the existing headline suggests that ONLY the CIA can use this vulnerability, which was false even before the leak.)

But then, an article about how you shouldn't expose telnet to the public internet wouldn't be very newsworthy would it? :)

</comment><comment><USER16> s/CIA/arbitrary third party/

Headline makes it sound like the Cisco routers come with a CIA SSH key baked in.

</comment><comment><USER17> It is one thing to try penetrate a system (solely for the purposes of,..&c.) that to all appearances seems impermeable to your meagre skills but once you know that these impregnable walls you face can and do become doors placed there by like-purposed if not necessarily like-minded individuals then what a filip! What more encouragement to keep you fuzzing just that little bit longer and who knows maybe you will stumble upon it! That sir, is the damage. Software can be patched. Trust cannot. (And this is what I sound like from my high horse apparently).

</comment><comment><USER18> "Computer Scientists Hate Him"

</comment><comment><USER19> > and organizations get unfairly accused.

I understand people, but why organisations? Capitalist firms literally thrive on the exploitation of labour, disregard for the environment and otherwise reckless pursuit of profit.

<comment><USER3> Capitalist firms employ people, who support families. They may have relocated to a region where they can't find alternate work if the company folds.

Capitalist firms are owned by asshole billionaires, nice billionaires, pension funds, individual investors, and retirement funds. They're still owned by and made up of people.

Instead of inventing false accusations about them, debate them on their merits.

<comment><USER19> >Capitalist firms employ people, who support families.

The feudal lord supports families by giving them a place to live while the workers pay tribute with the fruit of their labour. The idea that the workers ought to be grateful for being exploited is, in my opinion, silly. Capitalist firms pay for the labour-time, which includes the cost of (i) the worker staying in the work force (ii) the worker "recharging" with a moderate amount of sleep and entertainment (iii) the worker adding more to the workforce via reproduction, so the children are also paid for.

The worker is an expense, the family is an expense. The family is an expense because if it was not paid for, the workers could not work or the supply of workers becomes more scarce.

So yes, while the capitalist firm may employ people who provide for the family, so does the slave owner, for the purpose of future slaves. And as soon as the worker is not profitable, what happens to that support for the family? It disappears.

So the merits are thus: people are kept in servitude by virtue of their status of being a worker, with just enough income to pay to replenish the work force and stay motivated. That's the merits of the capitalist firm.

Edit: if the downvoters would like to ask questions or respond, it would be nice to know where I'm going wrong, thanks :)

<comment><USER20> You seem to not be a fan of capitalism. Do you live in China, Cuba, Vietnam, Laos or North Korea? If not, why not?

<comment><USER19> >China, Cuba, Vietnam

These are capitalist countries, in which wage labour is the primary way by which workers sustain themselves; property is privately owned (and yes, the government can privately own property).

>North Korea

North Korea is an ethno-nationalist dictatorship run by a hereditary monarchy.

What's your point?

<comment><USER20> Others disagree with your sentiment: [http://www.thenewstrack.com/top-5-communist-countries-in- the...](http://www.thenewstrack.com/top-5-communist-countries-in-the-world/)

Where is an example of a good system then?

<comment><USER19> People disagreeing with me does not mean that I'm wrong. Communism is defined as a stateless, classless and monelyess and anarchistic society in which peolpe are not paid with wages for work. Even in Socialism, the means of production are owned by the workers. None of the countries in this post have either of these qualities.

However they all exhibit the fundamental properties of capitalism: the primacy of wage labour, private ownership of capital and the means of production, and production is for exchange value to be maximised over use value.

I am an anarcho-Communist. I believe in the demolishing of the state and all unjustified hierarchical relations, including but not limited to the government and the bourgeoisie, to advance toward a society in which the means of production are collectively owned by the workers. Distributed networks of councils of workers, each of which implementing direct democracy to decide what is made and in what quantity. The workers take home the products of their labour, or agree to have them distributed to those who are unable to work, again via direct democracy.

My system is the abolishment of exploitation of the workers and with it the system of oppression aided by capitalism's power structures, including misogyny, racism, homophobia etc.

<comment><USER20> Anarchism - belief in the abolition of all government and the organization of society on a voluntary, cooperative basis without recourse to force or compulsion.

Communism - a political theory derived from Karl Marx, advocating class war and leading to a society in which all property is publicly owned and each person works and is paid according to their abilities and needs.

If there is no government, who distributes things based on needs? Why don't I just kill you and take everything you own? Communism is total government, Anarchism is no government. Its oil and water.

<comment><USER21> That why it's the best system to support in Internet forums! You can just pick the parts from each that work for the argument you are making. Since they are polar opposites you have a lot of ground to pick ideals from. Thus winning the argument.

<comment><USER19> On what evidence do you proclaim that Communism works with a state? Or that there is wage labour? Can you find any quotation at all from Marx or Engels in support of the state? How do you explain the existence of anarcho-Communism if you believe Communism has a state?

There is no need to be snarky. You could have just come out and said the point, vacuous as it is.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER22> jesus christ you guys; I have been telling you about this since 1997

<comment><USER23> Scope of "this" ?

<comment><USER24> CIA ECHELON GOLD BOMB.

<comment><USER25> ...which isn't a terribly poor XKCD pass-phrase.

</comment></comment></comment></comment><comment><USER26> So a couple of years after Snowden's revelations, we're again being told _" use US tech, be the bitch of the powerful"_.

And - honest question - why and how exactly would that ever become a thing of the past?

<comment><USER27> Your best bet is open hardware and open source software.</comment></comment>


I'm selling my software for too much money and nobody is buying. Any ideas? - <AUTHOR> http://udeployer.com/ I've decided to create something that doesn't really exist out there. It's a program that makes it easier for IT departments and small networks to install software on many different Windows computers. Say you have a company with 20 windows computers... you don't want to manually install Skype, Flash and all the other free 3rd party apps... you want something that does it automatically for you. So I created uDeployer.
But I'm just a developer - the website sucks, the program UI sucks - and I'm lost with marketing... maybe the price for it is too much? I have spent a lot of time working on it (almost one year).
Any ideas? <comment><USER2> 1) You need to radically increase the professionalism of that website to support the $499 price point. That price point is not necessarily high for someone in an IT group at a large company, but he cannot pay it to _you_ because everything about your site -- the design, the copy, the video, etc -- screams "risk."

Look at other sites which successfully sell to large corporations with buckets of money and try to hit the note of restrained professionalism they go for:

<http://www.fogbugz.com>

<https://spideroak.com>

<http://smartbear.com>

I picked companies which are on the smaller side. Importantly, they don't _look_ like they're not Real Respectable Software Companies of the sort that will cost you your job if using their software breaks your entire office for a day.

2) Price is typically not the reason software fails to sell. What is your strategy for acquiring the attention of people who have $499 to spend on software deployment? If I were you, I'd be thinking along the lines of creating lots of content specific to their needs, since the organic SEO benefits from doing so are substantial.

At least one B2B business hanging around the forums has had success with this -- they turned a source of data that they already had into a lot of pages, and those pages have lead to leads which bought things priced substantially north of $500. Hopefully they will chime in with their experiences.

3) You need radically more textual content, to answer the numerous worries your prospects have prior to shelling out $500 to you.

4) After someone credible buys this software, get approval to use their logo and then mention that it is in use at Respectable Brand Name. This is social proof and decreases the perceived risk of using your software.

5) (Much love to the HN community but I have to say this.) Ignore the opinions of anyone who says "Reduce the price" that does not also have authority to install this software at their corporation, because they are not your customers and they will not buy your software at any price. Among many other reasons: price signals quality, and if you adopt App Store pricing (or even $29.95 pricing) you will be communicating that you are not _nearly_ reliable enough to be trusted with computer systems which would burn six figures or more a day in the event of downtime caused by a botched deployment.

<comment><USER3> Your first point is quite wrong. I've been selling $600 value software for years now, and design of the website has typically had no effect at all on sales. What people care about is "does it work" and "will it be supported"?

<comment><USER4> Can you share your website? I would expect that patio11 is correct, since I wouldn't recommend it at my company just because the website doesn't inspire confidence. Maybe your case is special in some way? Are you actually making sales through some other channel?

</comment></comment></comment><comment><USER3> It seems to me that when you ask for feedback here on this site, most answers are about website design and typography and length of text and other unnecessary but very visual stuff. This stuff is unimportant. If a person needs your software, all that stuff will not deter him from trying it. If I need some deployment software and your text is a bit gaudy, I'm not going to abort the download.

I've been selling software at your pricepoint for 5 years and more. If you want to sell, follow these rules:

\- Design of your website don't matter

\- Add a price-list request form and remove the price

\- Get into a real and genuine conversation with each person who requests your pricelist

\- Answer emails within 30 minutes and be very helpful

\- Make sure there is no competition with exactly the same featureset who is cheaper

\- Use affiliates and people who are selling similar stuff. Get into partnerships with them

\- Make sure you have your website listed in all download sites possible. They will rank higher than your actual site typically

\- Make sure your software works perfectly, has an easy install and does not require any additional installs and does not crash

\- Capture the email addresses of your potential customers and email them

People want software that works well, is at a reasonable price and that has a human behind them, when they buy at those prices. All the other stuff is really secondary.

<comment><AUTHOR> The "human behind" was exactly my selling point. I wanted to show people that I have full interest in their success with my product, and that I'm passionate about my product and its future.

And I totally agree that if I'm selling a desktop application I should probably concentrate in making its UI simpler instead of my Websites UI... it's not a web-app.

These price-list requests are quite interesting, I would think people would like to know right away what the price is, but maybe that's not the case considering your experience - thanks for the advice.

<comment><USER5> If I don't see a price, I assume I'll have to endure some pushy sales guy whose job is to pocket most of the consumer surplus by charging almost enough to make us walk, so I'm only going to call as a last resort if none of the competitors work out. I also expect to hear a price many times higher than $500, simply to cover his commission draw for however many hours it takes to land a sale.

</comment></comment></comment><comment><USER6> When clicking on the free download button IT SHOULD NOT take you to a page that essentially says "Dumbass you should have registered first!"

If you need to register then make it part of the download page. Now lets be honest here, I am very reluctant to give my details for a free download which might turn out to be a POS (or worse a trojan) and give my details to someone who is going to spam me. Not to mention another login to maintain.

I'm not saying that your software is a POS or that you are going to spam me but I don't know that :)

I couldn't find the price (but then I didn't register). Being coy about the price makes me think that it is overpriced.

The front page is not really selling the product, it doesn't explain the problem it is trying to solve, it doesn't make clear who the target audience is (school/college/company IT departments).

Make the blog part of the site itself so the the branding and navigation does not change.

<comment><USER3> Yes, that's really silly. The first step in the funnel should be easy - putting a roadblock right at the start is not very clever.

</comment></comment><comment><USER7> Your blog needs to focus on the customer's pain and how your product fixes it - it should be a key part of the marketing message to bring IT shops with the same problem into your site.

Off the wall - but the price might be a bit low for larger corporates.

</comment><comment><USER8> My immediate reaction on seeing that it is for deploying applications and Windows is mentioned was "Why not use Group Policies or System Center Configuration Manager"?

Also the applications that you show being deployed aren't exactly the kinds of things that most enterprises would be bothered about pushing to desktops...

<comment><AUTHOR> The company I worked for last year actually needed to deploy these 3rd party apps. Flash and other free software needs to be updated to the latest version to avoid security concerns... so the idea for uDeployer sparked.

<comment><USER8> OK - sounds plausible - but the website needs to tell that story!

</comment></comment></comment><comment><USER9> Your video needs more professionalism. Given that video, I'd rather just use Windows Deployment Services or pay for Altiris.

* What's with the closing statement? You need to redo that, this YT video feels more like a developer demo than a demo that needs to sell to the stakeholders in the business.

* "Trust me" is not a word used in most demonstrations aimed at corporations

* Don't go searching for the Finance Copy Area machine in your demo, just know exactly where it is.

<comment><AUTHOR> The video is totally unacceptable, I know. My accent is horrible and I need a professional to do this for me. I just wanted something quick to show people how it actually worked - but I guess it's not enough for large companies.

</comment></comment><comment><USER10> 1) The website doesn't justify a 499 dollar app. (the website is to simple) 2) The GUI of the software is old fashion and to simple which isn't worth 499. 3) Your marketing can be much better. You don't appeal to your audience which are system administrators. I had to look for 3 minutes to understand what deployer did. 4) Where are the bullets with the benefits? Like saving time, money error etctetc

</comment><comment><USER11> I think you should move on from the website idea, especially if $500 equal to a monthly salary in your country.

My father has a software which sells for around $1,000, but doesn't have a website. He find clients (through his business network, word of mouth, a phone call...) and then install a trial version for them and guide them until they agree and purchase a license.

It's quite important to note that in my country $1K is equal to a professor salary; so that still a big deal for him.

You could do that with Skype, since (I assume) your audience is all over the world map. You may want to spend more time with your customers and to make the product works for them.

If you are selling many licenses, you may consider outsourcing someone to do that work for you. This strategy doesn't work for $0.9-$100 products, but works well for $500. Even if you are paid $100/hour, that still 5 complete hours.

</comment><comment><USER12> Make your download and buy buttons bigger. They look like 10px in size- are you ashamed of charging?

<comment><USER13> It is essential to an extensive A/B testing first. Otherwise how can you possibly know that 11px is better than 10px?

<comment><USER14> I'd go much bigger than 11px... I think it's pretty much a given that the download trial link is way too small. It needs to be clear for people that they can give it a try without having to fork out $500 immediately. I don't think you need A/B tests to prove that - it's pretty much a given that 10px is too small.

I'd also agree with @patio11 - the website is outdated, unprofessional and I wouldn't trust it. I'd pay a decent web designer a couple of thousand to get a bespoke design that will be much more suitable than what you have now.

<comment><USER2> You don't even have to pay a couple of thousand -- $50 for any of the SaaS web templates from themeforest.com or $70 or whatever for one of the product highlight ones from WooThemes would be a quantum leap in the perceived quality of the site. You can always reboot the design later with more professionally placed drop shadows and Helvetica after the software has sold a bit.

</comment></comment></comment></comment><comment><USER15> What's your added value compared to ninite?

Why does one need to register to dowload the trial?

<comment><AUTHOR> What would you suggest to implement on the backend for unregistered downloads? I'd like to track who's downloading... don't want spammers downloading my app a million times. Should I track by IP address or what? Any ideas?

<comment><USER16> What's wrong with people downloading your app lots? Do you have that problem?

What do you want to track about a download? How many times it's downloaded? Just use your apache logs (or make your download link a simple webapp that records a value then redirects to the proper file url). Do you want to track email addresses of a download? If so, you should be aware that it might put of X% of customers. Are you willing to give up tracking emails if it leads to an X% increase in downloads?

</comment></comment></comment><comment><USER17> What are your biggest competitors? I am assuming the big players would be at a higher price point?

More the an GUI complaints people have pointed out the thing that initially gets my attention is that I can only see 6 programs, unless this was able to install just about everything someone needed when provisioning new machines the value proposition seems to be lacking.

Something I think of when I think of a suite of applications is portable apps, a quick browse of their applications list shows probably a couple of hundred apps.

<comment><AUTHOR> The funny part is that there's no competitors. So far nobody (that I've found) has chosen the path of creating a Windows repository of free software (Skype, Flash etc.).

But you're right, I need to show and support more apps. After I finished development I just put _all_ my efforts in marketing and now, after one year, I'm quite tired of just adding refinements to the program - I would love for someone to just buy it so that it would really drive me to get back into development.

<comment><USER18> There's <http://windows-get.sourceforge.net/>, but I don't see it pushing to multiple desktops.

<comment><AUTHOR> I've seen that, but like you said, it doesn't push to multiple computers.

</comment></comment></comment></comment><comment><USER19> Someone has to authorize the purchase. Spending $500 to download 7zip or a couple free utils sounds like a lot. Add software that Windows IT guys have all heard of, so your repository screenshot has a scroll bar.

Then try pricing it at $59 so the IT guy can put it on a corp card now and explain it later if someone asks.

</comment><comment><USER20> The first thing I notice is the bad spelling; "continuosly" infers amateur who doesn't proofread or run a spellchecker.

</comment><comment><USER21> Go to themeforest.net buy theme, retheme website, add more copy.

</comment><comment><USER22> why not start by 100$ and then increase over time?

</comment><comment><USER23> Try reducing the price?

<comment><USER24> Don't know who downmodded you. Perfectly acceptable advice. I'm not saying it's _the_ answer, but relevant nontheless.

IMO $500 for deploy tool is a bit too much, when there are so many free tools available already... or whip up your own bash script.

To OP: You should have a Features link. It's always the first link I find when comparing products.

</comment></comment><comment><USER25> The main page is a bit messy, it doesn't have consistent typography, colors, or layout (at a glance there are 6-8ish distinct content areas). Clean it up a bit, simplify things (compare it to <http://basecamphq.com/>, as an example, which only has about 3 distinct content areas), use fewer font colors, etc.</comment>


Lichess becomes the first chess site accessible to visually impaired people. - <AUTHOR> http://en.lichess.org/blog/U5AX_DcAADkAz-L5/accessibility-for-blind-players

<comment><USER2> I'm sure this isn't the first chess site that is accessible to the VI, but it would be useful to see feedback from other visually impaired people who are using the site.

<comment><AUTHOR> It could be true. But I haven't found any other chess website that does that. Anyway what is more interesting to me is that lichess is an open source application and the core devs are taking feedback from the community and implementing new ideas.

And at least for chess tactics it has replaced chess.com for me.</comment></comment>


SpareOne: Emergency mobile phone powered by AA batteries - <AUTHOR> http://www.spareone.com <comment><USER2> They really shouldn't be encouraging people to think of this as something that will help when lost in the wilderness (see the image on the page). There's a strong possibility that there'll be no reception. That's a situation where you need an EPIRB-type rescue device.

<comment><USER3> Absolutely agree. You want a satellite phone for true emergency situations in the wilderness. A good one will cost you around $500 and you just have to buy a temporary plan before your excursion. The sad thing is that this phone appears to be marketed as wilderness survival device but in all likelihood will do very little to get you out of backcountry without cell towers in the area.

<comment><USER4> I own a DeLorme inReach - ~$300 device with a ~$15/month plan. Runs on the Iridium network, unlike Spot's proprietary network. Also, inReach devices are duplex, and can send text messages to friends, family, and SAR teams.

<comment><USER5> SPOT uses Globalstar.

Argument against Globalstar is that it is not a true polar to polar real-time solution like Iridium.

Iridium is the only constellation where you will always find a bird overhead anywhere on the globe (with a ground station relay)

Realistically, Iridium has occasional (~5min) signal gaps likely due to the aging constellation (based on my own use cases developing with a roof mounted antenna)

</comment></comment></comment></comment><comment><USER6> Or, you can just bring along a small USB battery pack, which can fully charge pretty much any modern smartphone.

Personally, I carry an Instapark Novobeam 3000 in my backpack. It's about the size of a roll of breath mints or a small flashlight, is rechargable, has a waterproof cover, and costs about nine bucks on Amazon.

<comment><USER7> Why? You can get primary lithium AA batteries with a 15 year shelf life.

If you need something like this, you don't need to fiddle with USB chargers

<comment><USER8> Anecdotally, it's much more difficult for me to find AA batteries than USB - AA batteries must be bought from stores, and fewer recent devices use them.

USB is available from almost any computing device, a growing number of displays and other peripherals, and increasingly in common areas. And AC-USB adapters are easy to get, spreading the convenience to every wall plug too. As others have mentioned, AA-USB adapters exist too, spreading USB's coverage to everywhere you can find AA batteries. As I hinted earlier, most recent devices have switched from AA to USB-charged built-in batteries, so a USB battery may have more utility than AA batteries these days.

Tangentially, there's a behavior pattern prevalent in the "Prepper" (aka Emergency Preparedness) community that confuses me. They take a logically- sound concept such as storing large amounts of food, and seem to separate the emergency food from every day food. Here, similarly, we have an emergency device that is not usually used. How do we know if it still works? Test it occasionally?

The USB battery breaks this pattern in that you can use it frequently and it's still useful in an emergency. And using it regularly can build a habit of keeping it charged, and you'll know if it breaks or goes bad before an emergency.

I'm not saying AA powered emergency devices are harmful, but rather our emergency devices and processes should be our every day devices and processes, whenever possible.

<comment><USER7> I'm not a "prepper" \-- I just want a way to get help for medical emergencies when there's a power outage mostly. I get where you're coming from, but a primary cell Lithium-Iron AA like an Energizer L91 ([http://data.energizer.com/PDFs/l91.pdf](http://data.energizer.com/PDFs/l91.pdf)) is up to 20 years -- probably more than the service life of the phone.

I have a phone like this from about 10 years ago that we leave at a family camp (super rough cabin with no utilities). With the loss of quality, power- outage survivable POTS phone service, this type type of device fills an important niche. 20 years ago, NYNEX (now Verizon) would provide dial tone for 10-14 days in the event of a blizzard or other power outage. Now you get 24-72 hours from cable/internet providers at best.

Another issue with conventional rechargeable batteries is they don't handle charging well when discharged completely. A cellphone left in a cabinet for 5 years is a brick in many cases.

</comment></comment></comment></comment><comment><USER9> Or get a phone charger that runs on AA batteries

<comment><USER10> I didn't know those exist. What's the comparison like vs this phone? As in, one AA battery provides 10 hours worth of talk time per their claims. How many times or how much charge do you get from the USB version?

<comment><USER11> Lets try some math. Most mobile batteries today is 3.7V.

An AA is 1.5V (rechargeable AAs are 1.2V).

Once that is established, it all comes down to the mAh.

Most AAs sold these days are listed as 2500mAh, multiply that with 1.5V and you get 3.750 Watts.

Note that this is very close to what you get from a 1000mAh li-ion battery found in many phones (3.7*1000=3700).

Now with a external li-ion emergency battery you will get conversion losses, as it has to go up to 5V for the USB and then back down again at the other end.

<comment><USER10> Very interesting and EE-like approach. :)

</comment></comment></comment></comment><comment><USER12> I wish more devices used easily replaceable standard size cells of rechargeable and non-rechargeable variety. You can walk to any shop or service station and buy a bunch of AA or AAA batteries if it's urgent. And keep a spare pack at home, in car, etc.

In most devices, the size & weight benefits of proprietary li-ion batteries mostly aren't worth it for me once the battery goes bad and you have to look for a replacement (which can be quite expensive, if you can find one to begin with). Forgot to charge the device? Forgot to bring a charger? Don't have a usb battery pack in place with no outlets? Sucks. Can't walk into a shop and get a fix.

<comment><USER13> It's worth nothing that those generic Chinese phones of various brands actually tend to use one of a very few number of (replaceable) battery variations, which tend to be clones of the battery in common models like the Samsung Galaxy S3. The main variables are width/height/depth/pinout, and the former 3 are usually fixed by the battery manufacturers themselves, while the latter is either from cloning another common product or a reference design.

For bigger lithium-ion cells, 18650 is probably the most common size and has gradually made its way into consumer devices too as a replaceable cell, although the safety implications of the much higher energy density mean they have to be treated more carefully than AA/AAA. (E.g. the warnings about not carrying loose cells because they can short and cause burns or fire is far more important with a lion cell, since they have much higher current capacity.) Companies will continue pushing the "safety" excuse to lock-in users with proprietary batteries, but I see the spread of 18650s as starting to counter that trend.

<comment><USER14> Alkaline batteries are pretty energy-dense, and can beat cheap lithium-ions. That's not the main safety issue.

</comment></comment></comment><comment><USER15> This seems like an emergency device for people who aren't actually experiencing an emergency. As vosper said, this is fine if you're lost in Central Park, not actually in the wilderness.

</comment><comment><USER16> Four reviews on Amazon so far, apparently the setup procedure is not simple: [http://www.amazon.com/dp/B01BWHZGDU/ref=cm_sw_su_dp](http://www.amazon.com/dp/B01BWHZGDU/ref=cm_sw_su_dp)

</comment><comment><USER17> Feels hackable, I wonder what kinds of things people will come up with. Do they still charge monthly for service?

I think some kind of wind-up cell phone charger would be more useful for people than a separate cell phone powered by AA batteries ("Hey, where'd I put those spare AA batteries...?")

<comment><USER18> Why bother trying to hack it? For $40 you can get an Arduino with a cell modem built it:

[http://www.seeedstudio.com/depot/Seeeduino- GPRS-p-1909.html](http://www.seeedstudio.com/depot/Seeeduino-GPRS-p-1909.html)

What about a SIM and data plan you ask? Head over to:

[http://neo.aeris.com/](http://neo.aeris.com/)

With just a credit card, no contract required, you can buy a SIM for $2.75 and $1/month gets you 750k of data. You can turn SIMs on and off month to month. You have to buy 10 SIMs to get started but they are having a promotion right now to get 10 SIMs for the price of one.

I have no connection to either Seeed Studio or Aeris other than being a happy customer of both

<comment><USER17> Wow, I've actually been looking for something exactly like this. Thank you for sharing.

</comment></comment></comment><comment><USER19> A Yaesu VX8GR handheld HAM radio transceiver is my spare. I carry it in my work bag every day, along with a quarter-wave antenna, spare battery and a AA- battery adapter. It'll run for days as a receiver and can transmit at 5 watts - plenty of power to hit a repeater within earshot of someone who can call for help on my behalf. Although I work in a dense city, I'm not under the illusion that cell-phone infrastructure will be available for long after a major disaster, particularly an earthquake.

HAM radios are also very useful when venturing into the wilderness. Many hikers monitor the 2m/1.44m calling frequencies periodically for distress calls. And at the right altitude your meager 5 watts can cover tremendous distances.

</comment><comment><USER4> If it's a phone only for calling 911, why does it require a 2-year cell plan _with data_?

<comment><USER20> I can't find anywhere where it states what type of plan this needs. Where did you find this info?

</comment></comment><comment><USER21> Hate to break the news, but this is nothing new. My first cell phone, when I was a young kid, was an Alcatel phone that could be run on either a normal battery pack or AA batteries or AA rechargeables.

I miss that brickphone.

</comment><comment><USER22> So what is the best backup phone to keep in the car? I'd want some thing cheap with no monthly payments just for emergencies.

Think how much it would suck these days to get lost or broken down and your phone isn't working! It seems only prudent to keep a backup with you.

(Especially now that all Payphones have been removed)

<comment><USER23> Any old working flip or bar phone. 911 calls don't require a plan or service contract. You'll only be able to make 911 calls with that, however. If you want something that will let you make ordinary calls or text, you'll need something like a prepaid phone, which are quite inexpensive as well.

<comment><USER22> All the prepaid phones I've found seem to have minutes that expire. That doesn't seem ideal for something I'd never use.

</comment></comment></comment><comment><USER24> Why batteries and not a dynamo?

</comment><comment><USER25> [http://www.amazon.com/American-Cross-Weather-Smartphone- Char...](http://www.amazon.com/American-Cross-Weather-Smartphone- Charger/dp/B007KFLVTM)

</comment><comment><USER26> If these are cheap enough, they might make a good rolling burner phone. You just set up the speed dial to point to other SpareOne phones and then pass them out at periodic meetings.

</comment><comment><USER16> When I've been in trouble the lack of reception is the reason to worry, not my phone being out of battery.

</comment><comment><USER27> Has anyone tried using gotenna for this use case? Just happened to see one the other day.

</comment><comment><USER28> See their Twitter profile?

[https://twitter.com/SpareOnePhone](https://twitter.com/SpareOnePhone)

>30k favorites, aka favorite spam. I hate those - everything is automated and it does not add any value at all.

</comment><comment><USER29> Works great when earthquakes take down the mobile network

<comment><USER30> This still uses the mobile network.</comment></comment>


Edward Snowden attacks Russia over human rights and hacking - <AUTHOR> https://www.theguardian.com/us-news/2016/sep/10/star-treks-zachary-quinto-calls-for-return-of-edward-snowden <comment><USER2> Not sure I would have the courage to say this, but then again I am sure I don't have the courage to do what he did in the first place.</comment>


Announcing GWT 2.0 Milestone 1   - <AUTHOR> http://groups.google.com/group/google-web-toolkit/browse_thread/thread/8b79ebe444b9126d <comment><USER2> Is anybody here using gwt? Is it really easier to use than any of the other widely used javascript libraries? The whole java to javascript translator/compiler sounds overly complex to me. Is there some other benefit to using it aside from ease of use? Is it more likely to generate code that is cross browser compatible than one of the other solutions?

<comment><USER3> We've used gwt extensively and eagerly await 2.0.

GWT is basically built for building webapps like gmail. If you are building a website then I wouldn't bother with it personally, I find jquery much easier in that sense. It's really built for highly interactive, gmail/google docs/wave like applications which are a single page with dynamic content.

Take a look at the following project, which is a nice example of what gwt can do outside of google health, wave etc: <http://code.google.com/p/gwt-cal/>

There are huge benefits with 2.0 over other libraries for building these types of applications:

<http://www.infoq.com/news/2009/10/gwt-2-m1>

[http://fredsa.allen-sauer.com/2009/09/gwt-for-enterprise- dev...](http://fredsa.allen-sauer.com/2009/09/gwt-for-enterprise-developer- jboss.html)

In terms of cross browser, we have only ever had a single issue which was a drag and drop, google map like component. Workarounds were not that hard.

Oh, and styling your interface is very easy if you use firebug well. We have a 37-signals-esque single page interface which is pretty slick.

<comment><USER4> Just to be clear, Gmail was _not_ written with GWT.

<comment><USER5> It's worth noting, though, that Google's implementation of Wave is written in GWT. Since GMail predates the invention of GWT, it's likely that it would be a GWT application if started today.

<comment><USER4> Many things would be different if Gmail were started today -- not all of them good :)

</comment></comment></comment></comment></comment><comment><USER6> GWT is wonderful. If you've come from a world of swing programming (like me), it's very easy to build great, responsive GUIs.

I'm really excited about GWT 2.0. The new out-of-process development mode will let me debug in any browser, using both the eclipse debugger and firebug at the same time. Furthermore, the hosted mode browser on Linux was Mozilla 1.7, which didn't support some things like SSL or Canvas. Now I plan on using canvas a lot more.

I'm not sure how this changes the incubator project. I imagine they will bring in many of the incubator classes into the main branch.

I'm going to have to play around with the declarative stuff. Not too sure how useful that will be.

</comment><comment><USER7> Maybe it's just my dynamic language bias, but isn't GWT about 100X more complex than using something like Cappuccino with Atlas to build a desktop- like app?

And won't it look 100X uglier in GWT unless you are a CSS zen master?

Just watching that GWT "best practices" video made my head spin with all the many layers and buzzwordy concepts one has to master just to make a simple GUI.

Or perhaps it's just that I hate the staticness and verbosity of Java...

<comment><USER5> I thought I would reply just in case you were referring to the video that I linked to. If so, that is most certainly not a beginner's tutorial on the basics that one would need just to make a simple GUI!

Rather, it's the other end of the spectrum: an example of how the toolkit allows a large team to bring serious, large scale software engineering practices to bear on something ambitious and complex.

One of the great things about GWT is that it offers something to that entire spectrum.

</comment></comment><comment><USER8> Pardon my ignorance, but what kind of infrastructure do you need for running GWT? It pretty much means running your own (dedicated) servers, right? (For example, I understand that Google's App Engine does not yet support it!)

<comment><USER9> Actually, Google's AppEngine is nicely integrated with GWT. Check out the Google Eclipse Plugin (<http://code.google.com/eclipse/>) -- even if you're not using eclipse, this will give you a good idea.

<comment><USER10> It's also worth pointing out that a compiled GWT application can be deployed entirely statically. The Java RPC system does require a servlet container, but there are lots of other ways of talking to servers (JSON[P], XHR, etc).

</comment></comment></comment><comment><USER11> SproutCore is also gearing up for 1.0 release soon. Some really good choices nowdays for javascript based windowing apps.</comment>