The fundamentalist FOSS mentality - <AUTHOR> https://blog.hiri.com/the-fundamentalist-foss-mentality-c70a953f2821 <comment><USER3> The complains about FOSS fundamentalists coming from proprietary software dev' (which I am) always seems a bit hypocritical to me.

The reason is, you probably use a lot of FOSS software that were made possible only because a lot of people dedicated time and effort to it. Your servers probably run Linux, if not, the services that you use everyday probably do. Your compiler/language is probably FOSS too, if not, the software that was used to make it was probably. Your OS probably contain some FOSS software or was made using some. Even this blog post was only possible because of free software (medium rely on NGinx, NodeJS, Redis, ...).

Today, it is almost impossible to work without at some point relying on a free software or using software that relies on free software. We wouldn't be were we at right now if it was not for FOSS. Hell, a lot of us may not have ever been developers if it was not for FOSS. I know I only learned programming because of FOSS like Ruby, Linux, GCC, ...

So I understand that we don't live in a world where everything is simple and where we can all live making free software. But criticizing the people who made your job possible doesn't seem like a good thing.

<comment><USER4> I think I was pretty clear in the article - I absolutely support FOSS. The point of the article was to debunk some of the perceived "evils" of proprietary software. It's not a zero sum game - FOSS vs Proprietary. Rather they can support each other.

<comment><USER5> Obviously FOSS supports proprietary software, but I'm curious how you think proprietary supports FOSS. Seems like a pretty one-sided relationship to me.

<comment><USER4> In this case, Linux would get wider adoption if it could attract some large software vendors. Good for everyone.

<comment><USER6> Linux has large software vendors.

</comment></comment></comment></comment></comment><comment><USER7> There's another problem with the "make money by offering support" argument: it incentivizes creating software that requires support, usually via added complexity. Similarly the customization argument: it incentivizes creating inflexible software.

I'm not sure there is a monetization strategy that actually aligns with what should be the goals of FLOSS.

<comment><USER8> Models I know of are open-core, dual-licensing, paid support, selling developer tools, and providing hosted cloud service offerings.

<comment><USER9> Open core can go wrong if you're not coupling the valuable functionality tightly enough to the open core, though. This seems to be happening with BitWarden, where at least two free third party implementations of the password storage backend exist[1,2].

[1] [https://github.com/jcs/rubywarden](https://github.com/jcs/rubywarden)

[2] [https://github.com/Odysseus16/bitwarden- go](https://github.com/Odysseus16/bitwarden-go)

</comment></comment></comment><comment><USER10> I assume that this is the "offending" thread on Reddit [https://www.reddit.com/r/promos/comments/56ymfc/hey_linux_pe...](https://www.reddit.com/r/promos/comments/56ymfc/hey_linux_peeps_my_name_is_dave_founder_of_hiri/)

Quotes: "This is going to be a very hard sell being a proprietary closed source system to Linux users, many use Linux because they have bought into the idea of open source. Good luck with it anyway" "If it were FOSS, I would have downloaded it and compiled it 20 minutes ago."

Is that it? The rest of the thread seems pretty mild and politely interested. This was two years ago and I think I'd be over it by now.

<comment><USER11> >> This was two years ago and I think I'd be over it by now.

The more I think about it, this was written for marketing purposes. He doesn't really make a point. It just draws more attention to the product.

<comment><USER12> I tend to agree. There is suddenly a flash, 50% off sale on the hiri website that wasn't there earlier this morning before this link hit the HN front page.

<comment><USER4> There's no sudden flash sale. This has been there for about a year now.

</comment></comment></comment></comment><comment><USER13> The post essentially lacks any actual arguments addressing the position of the other side and is based on a fallacy.

The position of Stallmann is "the long-term societal costs of using proprietary software outweigh the short-term benefits in most cases". "Using proprietary software has short term benefits" simply does not address that position.

The fallacy is in equating fundamentalism and extremism and a strong conviction.

Having a strong conviction that democracy is a better form of government than dictatorship, and holding to that even tough democracy certainly has its costs and disadvantages doesn't make you a fundamentalist. A fundamentalist is someone who is unwilling to consider the evidence that their position is wrong. Weighing long-term costs against short-term benefits does not make you a fundamentalist.

Extremism on the other hand is a completely useless term. Being extreme simply means that you are far away from the mainstream. People who work for free and fair elections in China are extremists. The only reason why "Extreme opinions are rarely correct" is kinda true is because the author is lucky to live in a place where, generally speaking, extreme opinions that are a good idea do become adopted into the mainstream sooner or later and thus are no longer extreme. For one, that isn't true everywhere, and, maybe more importantly, you don't ever get those good idea adopted into the mainstream if you reject them "because they are extreme".

</comment><comment><USER14> Proprietary software which restricts its distribution and "unauthorized" modification (virtually all of it) is the very essence of fundamentalism. It relies on a rigid and literal interpretation of what constitutes property (e.g. that the concept of "intellectual property" is coherent and non- contradictory) and even goes so far as to use threats, ultimately backed by violent force, to ensure compliance with this belief. To conclude this blog post decrying the skepticism of proprietary software with "extreme opinions are rarely correct" strikes me as particularly ironic and absurd.

FOSS is the antithesis of this fundamentalism, as it expressly rejects the use of threats to intimidate others into not copying or modifying code. I'm sure there are some people who make sweeping generalizations that may not apply to all proprietary software, but being suspicious of an opposing viewpoint doesn't make one a fundamentalist.

<comment><USER4> > ultimately backed by violent force, to ensure compliance with this belief

This is true of all laws. This is how society works. If you don't like it, in a democracy you can campaign for change.

You seem to believe you have a fundamental right to copy someone else's works. If the author of those works grants you permission (open source) - then fine. You seem to suggest that people shouldn't profit from their work. I just don't think FOSS software alone is tenable.

<comment><USER14> > This is true of all laws. This is how society works. If you don't like it, > in a democracy you can campaign for change.

I am well aware this is how laws enforced by governments work. It does not necessarily follow that is how society works, or that it must be so. I'd rather stay on topic than turn this into a criticism of democracy, however.

>You seem to believe you have a fundamental right to copy someone else's works. If the author of those works grants you permission (open source) - <USER2> fine.

On the contrary, you seem to believe you have a fundamental right to use violent threats to intimidate me into not copying or modifying code.

>You seem to suggest that people shouldn't profit from their work.

I absolutely do not suggest that. There are ways one can profit from software development (or other creative and technical endeavors) that don't involve threatening people with violent force.

>I just don't think FOSS software alone is tenable.

I understand that. At least acknowledge that you are the fundamentalist here, taking the approach that because you don't believe it is "tenable" for software to be free, you think it is pragmatic and therefor acceptable to use violent force to prevent others from copying or modifying code.

</comment></comment></comment><comment><USER15> These arguments are myopic. It doesn't matter if your source is open if people give you money, right? So how to get people to give you money?

The first answer is "find a pain point and build a product". Note I said _product_ , not _open source tool_.

The second part is selling it. That's pretty easy: is anyone else fixing this pain? No? Then sell people the product. You can give away your source code, but that's completely incidental.

The third part, _" Our competitors will fork and steal our business!"_, is possible, but _extremely unlikely_ , unless you _suck_ at your product. Incumbents don't get unseated without tremendous effort. The longer you're around, the more people will trust you to do it right, and the better you'll be at it, with more features and more customers. (I don't know of a single case of this ever happening; it's usually just a completely new open source product and they compete fairly)

The last part, _" How do I keep people from just building and using the code for free?"_, completely depends on how difficult this is, and whether your packaging and selling of the product provides additional value worth paying for. The simplest way is to provide premium services that solve more pain points and to provide this with their purchase. But you can also just make the software so annoying to build, and cheap to purchase, that it makes more sense to buy it.

<comment><USER16> > The third part, "our competitors will fork and steal our business!", is > possible, but extremely unlikely, unless you suck at your product.

I don't think you appreciate the danger here. Someone can sink a few tens of thousands of dollars into cloning a codebase, then make it to market in a bare fraction of the time it took you to get there.

When you say "incumbents don't get unseated without tremendous effort," you're referring to big incumbents like Amazon or Google, or CVS or Home Depot. Sure, at that scale it's impossible to ramp up that quickly.

But for small outfits struggling to survive, handing the jackals everything they need to compete with you is flat-out stupid. The barest vestige of a moat, something as small as locking your doors, can be enough to get the jackals to pick easier targets.

Having to manage the creation of a software product is an order of magnitude harder than just cloning it and differentiating it from there.

<comment><USER15> You can claim a lot of things that don't happen are dangerous. Skating on ice is dangerous, because someone could bring out a flamethrower or napalm. Flying on a plane is dangerous, because someone could fire a shoulder-mounted rocket at your plane. Eating food with a fork is dangerous, because someone could come up behind you and slap the fork into your throat. All of these things are dangerous possibilities that do not happen.

AFAIK, small startups do not get unseated by other small startups that poach their technology in order to ruin their competitor. Besides being quite unethical, it's very bad PR. Not to mention, someone else would have to be in the same position, ready to take the same risks, on the same business model, with the same technology, at the same time.

Risky things happen. But so far, I am unaware of this particular risky thing ever happening. I would love to hear if it has happened before.

(I will add the caveat that if anyone were to do this, it would be China)

<comment><USER16> The HN crowd tends to stay outside of these kinds of business circles, but I have a friend who doesn't, and he would ping me from time to time about "cloning a site and building a business around it." It took me awhile to understand the mentality. But "Uber for X" is very much a thing. We just don't pay attention to them because those companies never reach Uber growth. But you don't get to be Uber by just acquiescing to competition. It's not just about execution, you can't just take the high road, Uber's taken a lot of low roads to get where they're at.

It's basically like the kudzu that grows ubiquitously across the SE United States. Find a tree, climb it, then steal all its sunlight. Look at an existing business, find out what makes it tick, then clone its business model and go after its customers using the same marketing channels its using.

I don't think you'd have to read many business books to find an account of this happening, albeit with non-software products. It works because customers simply don't have the bandwidth to be loyal or to thoroughly research everybody they do business with.

<comment><USER17> >I don't think you'd have to read many business books to find an account of this happening, albeit with non-software products.

So it's a general problem with businesses and not a valid argument against FOSS alone then. That being said I don't see "uber for x" companies to be a danger for legit businesses. To me it seems more of a way to milk investors, and not a viable way to steal markets.

Most systems have a potential for agents to act badly, but it is my lay understanding that game theory have shown cooperative strategies to win out.

<comment><USER18> If it happens with businesses so often, why make it easier for them by providing the source?

<comment><USER19> Because the source code is really not the important part of that equation. A competitor with a slick marketing strategy will steal your business no matter what.

Meanwhile, if you do release your software as FOSS, then you at the very least get a marketing channel (the FOSS community) that's 1) cheap to acquire (any "this week in FOSS" blog or software repo or whatever will jump on spreading it around specifically because it's FOSS) and 2) is on average savvy enough to know that you're the actual encumbent and your competitor is a fraud. Assuming your product is actually good, they'll be inclined to support it and possibly even buy it.

If this is scary to do with your core product, then at least start with the FOSS dependencies of that core product. See also: Valve being one of the "good guys" in the Linux-on-the-desktop movement; their core product (Steam) is closed-source DRM (the literal antithesis of free software), but their free software contributions (especially around Mesa and Wine/Proton/DXVK) more than offset the "evil" of their core product, and so Linux users (myself included) have no qualms throwing money their way.

</comment></comment></comment></comment></comment></comment></comment><comment><USER20> Here's another old argument from Stallman against using nonfree software, not addressed in the blog post:

[https://www.gnu.org/philosophy/why- free.en.html](https://www.gnu.org/philosophy/why-free.en.html)

> As a computer user today, you may find yourself using a proprietary program. > If your friend asks to make a copy, it would be wrong to refuse. Cooperation > is more important than copyright. But underground, closet cooperation does > not make for a good society. A person should aspire to live an upright life > openly with pride, and this means saying no to proprietary software.

I don't agree that refusing to copy the program would be wrong. "Cooperation is more important than copyright" is a nice slogan. But copyright IS a form of cooperation. In the situation described, you have to choose between cooperating with your friend and cooperating with the software vendor. Stallman is right to point out that it puts one in an ethical bind, and a way to avoid that is to avoid proprietary software. He argues (elsewhere) that the act of offering proprietary software is really bad, because it erodes society's most precious resource, goodwill.

As for me, I have a fondness for the FOSS subculture, and a preference for free software, _ceteris paribus_. I use a mixture of free and nonfree software because I have other more pressing concerns, like choosing the best technological choice for the job, and ease of use, and making money.

<comment><USER14> Copyright is not a form of cooperation. It is a threat. If you copy something without permission, you risk retaliation that is, ultimately, backed by violent force. It is hardly honest to call something "cooperation" under these circumstances.

<comment><USER21> Proprietary software can be downright dangerous if you tightly integrate it in your work and the vendor suddenly goes away or shuts down the software. But this has nothing to do with copyright, Software Freedom Conservancy defends GPL for the copyright holders that they represent.

The biggest issue with proprietary software is the unbalanced relationship with the vendor that it implies.

</comment></comment></comment><comment><USER22> IMO there's nothing "fundamentalist" about rejecting a _particular_ piece of proprietary software.

When trying to sell a niche product, r/linux might not be the best place to ask. I'm wondering if the author would have had the same response when someone on a windows or mac subreddit did not want to use their software.

Instead try to sell to people who you solve a particular problem for.

<comment><USER23> Imho it is fundamentalist if the only reason for the rejection is that it's proprietary. Don't know if that was the author's exact experience. But it has been mine. And it's not just dogmatic and stupid in a similar way as religious fanaticism, it's harmful for the entire ecosystem.

<comment><USER22> > it is fundamentalist if the only reason for the rejection is that it's > proprietary

Personally I don't use software that I cannot review myself for tasks that are important to me. That includes reading email. Hence, the reason for rejection is that it's not open source. I don't see how this makes me a horrible fundamentalist, but maybe you care to enlighten me :)

> it's harmful for the entire ecosystem

I also completely fail to see how me personally want to review source code is harmful to the "entire ecosystem" (I assume you refer to the FOSS ecosystem?)

<comment><USER23> You are, obviously, free to choose the software you use. What you install on your computer is, again of course, completely up to you.

What I take issue with are people who jump into any discussion of proprietary software and downvote / criticize with "proprietary" being the only point. A fair criticism should take the form "Cons: Not open source", "Pros: ...". But it never does. It's always just "Nobody needs this proprietary crap". That is what I consider actively harmful, because it suppresses options that may actually be useful, if not for you then maybe for other people. If you don't like it, why not just let it be? I don't like JavaScript. I don't go around forums and shout "It's a horrible language!" where ever I see it mentioned.

</comment></comment></comment></comment><comment><USER24> Ignore the naysayers. I loathe having to trust proprietary software for anything critical or anything I want control over, but there are things for which proprietary software got my money... So focus on your market segment - elsewhere, as all producers know, there will always be a chorus of negativity that you are better off ignoring.

<comment><AUTHOR> Interesting. Do you mind if I ask what software (or category) have you bought if you don't trust proprietary software?

<comment><USER25> For me, I'll use the best tool for the job, whether it's FOSS or not. If someone built a great FOSS DAW, then I would definitely switch away from Ableton, Reaper, Logic etc. Until then, I'll use whatever gets the job done in the best way possible. It isn't necessarily about trust.

<comment><USER26> Out of curiosity, when was it the last time you checked on Free audio production tools? I know I didn't check for a while and was pleasantly surprised with the state of the current stack.

</comment></comment></comment></comment><comment><USER27> _> If we do Open Source Hiri, there is nothing to stop someone from forking it and selling it for less /offering it for free._

Tbsync developers have no problem with that.

 _> Also, you literally trust your life to proprietary software every time you jump into a car or onto a plane._

Is that a good thing? People do it out of lack of choice, not because they want to. Trusting closed software for communication purposes is especially bad in the age of mass surveillance, so Hiri is actually not an example to be used if you are so interested in pitching for closed software.

 _> There is ample evidence that companies competing using proprietary knowledge is actually a pretty good model for more productivity / technological progress. It's why we have anti-trust laws._

Laws which aren't working for the most part because they have been diluted by monopolists / oligopolists to completely toothless state.

 _> I believe the Linux community should embrace proprietary software with open arms_

No, thanks. Linux doesn't need to become another macOS. There are cases when proprietary software has no alternatives, but encouraging such situations isn't something to aim for.

</comment><comment><USER28> It's hypocritical for people to continue to benefit from foss and complain about 'fundamentalists'.

Without that level of commitment no one would have used Linux and all the early immature and amateurish efforts, there are people here who know what a horror some of the efforts were to use and the long journey to today. Would any of the practical minded folks use any of that?

That part of the journey could only be made because of those motivated by ideals. The practical 'middle ground' mindset would not have delivered the rich open source world we know today.

If you don't subscribe to the ethics or values driving it it's perfectly ok, but mature discussion needs to recognize that commitment is required to achieve anything. Simply looking at the results and failing to appreciate what it took to get here is a recipe for failure in any endeavour.

<comment><USER21> This seem to be the case, the author don't understand that FOSS is usually built by the communities of people that share the same fundamental values (he can call them fundamentalists for all he wants) but it doesn't make his arguments correct. When he complains that FOSS community doesn't embrace the proprietary software - how exactly does he imagine this to be done, no one dictates what software we should use so this discussion is completely nonsensical. This whole idea is like someone would go to the vegan party, bringing meat there and then complain that no one wanted to eat it. Just this unwarranted complaining is enough to persuade many people that could have bought his software to stay away.

<comment><USER4> I make an important distinction in the article. The FOSS community is not one 'type' of person. There are plenty in the FOSS community who use proprietary software. I have yet to hear a compelling argument on this thread for using FOSS software _exclusively_.

</comment></comment></comment><comment><USER29> The bigger problem with FOSS is that FOSS isn't actually user-editable at all. It's developer-editable - which is not even remotely close to being the same thing, except for that tiny subset of projects where end-users are developers.

It's basically open blueprints, not open systems - with predictable results.

There's never been a truly open system, although Hypercard, Excel, VBS, and Smalltalk have all tried (and failed) to edge into that space in their different ways.

FOSS has certainly never shown the slightest interest in developing an open system.

It has always been more of a charter for tinkering than a glorious liberation for end-users frustrated with bugs, poor UI choices, and all the other things that end-users hate.

<comment><USER21> > It's developer-editable - which is not even remotely close to being the same > thing, except for that tiny subset of projects where end-users are > developers.

There are plenty of FOSS software where one could do meaningful changes that improve your user experience without being a developer. This includes customizing the theme for your desktop, translating the software into another language etc

What do you even mean by open system?

There are plenty of regular (non-dev) people that propose great ideas for changes to FOSS programs that later get implemented, you don't get this kind of interactions with your users with proprietary sw because that your "intellectual property" and who the hell are you to dictate how to do things with my property attitude (which is, if not implied then anticipated by most users).

</comment></comment><comment><USER25> >I believe the Linux community should embrace proprietary software with open arms. It would enable many more users to adopt Linux as their daily driver. Depending on your source, Linux accounts for somewhere between 0.5–3% of desktop users. It's simply not having the impact it could. If you are passionate about Linux/Open Source software, it's time to think of the ecosystem as a whole and embrace proprietary software.

You sell proprietary software, which is a perfectly fine and decent way to make a living. Why are you defending yourself and exactly what against? It's perfectly alright to make a living the way you see fit.

However, I'd rather not have the Linux community "embrace proprietary software with open arms", thank you very much.

<comment><USER4> >However, I'd rather not have the Linux community "embrace proprietary software with open arms", thank you very much.

Why? What possible harm could it do?

>Why are you defending yourself and exactly what against? I didn't write the article as a defence. I wrote it as food for thought. I would like to see Linux usage increase. I believe those that reject proprietary software outright are preventing this from happening. A vocal minority give the impression that proprietary software is not welcome. This has not been our experience.

</comment></comment><comment><USER30> What is the point of attacking such a minority? If the author claims it is a group of people so close to the "horizontal line", then why feel the need to negate their arguments? If the author is the one saying that strong opinions are rarely correct, why would he mention a different strong opinion that Linux users should embrace proprietary software with open arms? It seems as if the author never realized the true struggles that open source or FOSS (not the same thing, I know) movements had in the early 2000s, with corporations such as Microsoft being outright at war with them. The author only uses the example of his small inconsequential startup.

<comment><USER31> 1.) Refuting arguments is not an attack. The article does not read like attack. It is civil and non inflammatory and non insulting.

2.) Those people vocally disagreed with his previous article, him following up defending amd explaining his stance is how discussion work.

3.) Why not?

4.) Why do you want him to be silent and that group to hAve monopoly on discourse?

<comment><USER32> I saw the Reddit thread and couldn't find any particularly 'fundamentalist' views in it, not to say that a fundamentalist belief in user freedom is wrong.

<comment><USER4> Author here. It's not just one thread. And not just Reddit.

</comment></comment></comment></comment><comment><USER33> I didn't read the other post that was controversial, so I'm only seeing this as a self-contained piece: but what is the author saying? Is it just a laundry list of things about open source? What is it arguing? Is it new, or just someone thinking about FOSS for the first time? I can't see how any of the things mentioned support the conclusion "the Linux community should embrace proprietary software with open arms".

Maybe it makes more sense in relation to the other post. If so, I think the essence of it should be worked into this post to give it some context.

</comment><comment><USER34> I also believe that proprietary software is morally wrong. I do not care if it has better performance or features; it is just unacceptable on principle.

If I'm a fundamentalist for this belief, so be it.

<comment><USER35> Well, using the term _morally wrong_ seems to paint you into a certain corner. I am curious: where do morals come into play here? Why is a written piece of software so much different than, say, a chair that was built by a carpenter. Would said carpenter be morally wrong as well if he did not want to show you how to build the chair? I am _not_ trying to start an argument here---I am honestly curious about your perspective!

<comment><USER34> > where do morals come into play here?

I want to be able to check whether the software does anything harmful for me, and to be able to fix it and adapt it to my needs. Proprietary software effectively curtails the possibility of doing that.

Say I am allergic to nuts. Fortunately, when I buy some processed food I can check easily whether it has nuts or not. Now imagine living in a world where food makers sneakily put nuts in their products, in order to "enhance the user experience". And not only that, but they took great efforts to hide this information from the consumers. After all, most people are not allergic, so no big deal here. I would say that this is immoral.

<comment><USER4> > Now imagine living in a world where food makers sneakily put nuts in their > products

Sure, this would be morally wrong (and also illegal). But you are basically saying that everyone is putting peanuts in their software, which is simply false. Quite insulting to those of us that do work on proprietary software.

<comment><USER36> I don't see where they said "everyone". The fact that _anyone_ does that is cause for concern.

It's great that you don't include malicious code in your proprietary software. But why should you defend the right of others to do so? It's not really "insulting" to note that this is a common occurrence.

As you note, it is illegal for food manufacturers to put anything secret in food, let alone secret and harmful. Why tolerate it in software?

<comment><USER37> _> As you note, it is illegal for food manufacturers to put anything secret in food, let alone secret and harmful. Why tolerate it in software?_

We don't enforce laws against food manufacturers putting secret ingredients in food by opening up food production processes so that any member of the public can walk into the factory and watch them at work. A major reason for that is that the FDA is bound by law to respect trade secrets, so it can't just make public every detail of the food production processes it inspects; all it can say is whether or not they are safe in the FDA's judgment.

If we wanted to make laws against putting secret ingredients in software, the enforcement mechanism analogous to the one we use for food safety laws would be to create a huge government agency that inspected software source code. It wouldn't be to open up the source code to anyone who wants to see it.

<comment><USER36> We do require food manufacturers to 'open up' their production processes by printing every single ingredient on the packaging, plus a comprehensive review of the effects of the food on the body in the form of nutrition facts, caffeine content, alcohol content and allergen content among other things. Quite what the equivalent procedure for software would be is left as an exercise for the reader, but it's not as simple as 'government says so'.

The trouble is that the effects of harmful software are much less obvious than harmful food.

<comment><USER37> Yes, both of these are fair points. The second one, in particular, seems like an important difference between the two.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER4> I'm the author of this particular blog post. Curious to see how this is received by the tech community.

<comment><USER38> FOSS is something I aspire too, I still use some proprietary software but as I dream at a Star Trek world similar I dream that in future I would work only on FOSS.

If there is a choice use FOSS app A or proprietary app B I will use A if it does what I need, as a developer I adapted the open source apps to my needs where with proprietary apps I could never done it.

<comment><USER4> The question is, will you choose FOSS even if it is a poorer choice?

<comment><USER39> Most of the time, yes. Of course it's nuanced, so it can only be evaluated on case-by-case matter, but if the FLOSS choice is "good enough", there's no need for me to look for anything else, even if it might be somewhat "better choice". Losing freedoms is way more painful than using second best software for the task.

</comment></comment></comment></comment><comment><USER19> "Secrecy is not necessarily a bad thing provided a proprietary software vendor's incentives are aligned with your own objectives."

That's the point: if you're being secretive, then your end users are denied the ability - without undue effort - to verify for themselves that you or your software are acting in their best interests or "aligned with [their] own objectives".

Transparency is a dependency of trust. No ifs ands or buts. If you can't be transparent because "boo hoo we can't make any money" then I can't trust you, and no reasonable person should.

The tired excuse that "but but but the black hats will see our code and hack us" is just that: a tired excuse along the same lines as "security by obscurity". The black hats will find holes in your software _anyway_ , because they're motivated to do so (whether because it's how they put food on the table or because they find it a fun challenge). The least you can do is make it as easy as possible for the white hats to spot those zero-days first.

None of the arguments in this article are groundbreaking or compelling. They're the same tired bullshit excuses closed-source devs always try to feed their users for why said users should be fine with "don't worry, just trust us, we pinky-promise we're not selling your data to advertising networks (wink!)". Maybe you are, maybe you're not. Maybe you aren't _yet_ but might in the future. No way to know for sure without full-blown reverse engineering every single build.

And note that none of this has to do with software _freedom_. Yes, most transparent software happens to be free software, but you can be transparent and proprietary. From a trustworthiness perspective, I don't care if there's a thousand-page Apple-style EULA in the source tree; I just want access to the source tree. Conflating transparency and freedom is a tell-tale sign of strawmanning here.

</comment><comment><USER40> I'm not a developer and I don't have a strong opinion on open-source software either way, but I've always wondered: does the fact that developers and other technical people have (comparatively) excellent job security affect their attitude toward free labor and products? If developers had a job outlook similar to say, musicians, would open-source be as widely-used and praised as it is now?

Surely some academic economic work has been done on a situation like this?

<comment><USER41> Free labor is distinct from free software and it is misleading to conflate the two. Plenty of people are paid to work on free software, and I'm not talking about Red Hat or SUSE either. See: 90% of the Linux kernel contributors.

As for musicians, plenty of them share their music (or flps, or whatever) all the time. Soundcloud, bandcamp, jamendo, magnatune, soulseek... the list goes on.

<comment><USER40> 1\. Right, but I guess I was talking more about the ecosystem itself. If there were no jobs paying people to work on open-source software, would there be as much work done on free software in general?

2\. True, but charging money for your music doesn't get nearly the same negative reaction that paid software often gets.

<comment><USER39> There's nothing wrong with paid software. I'm happy to pay as long as it's free.

<comment><USER42> This is an interesting double entendre. Do you mean happy to pay as long as it has a permissive/OSS license and comes with source code or that the purchase price is zero, or both?

Genuinely not trying to be pedantic, just curious if you were being clever.

<comment><USER39> Although I have just meant "free as in freedom" above, it's not uncommon for me to pay non-zero amount for FLOSS with purchase price of zero as well.

</comment></comment></comment></comment></comment></comment><comment><USER43> Well, my own personal response is that "FOSS fundamentalist" are as opposite free people that do not want _actual_ society model but another and "people who describe them as fundamentalist" are simply people that can't think a different society or anything as society scale instead of their own company scale.

It's not an offense but a simple reasoned scheme: did you know that at the start of IT golden age software was open? In the USA, not in the URSS. Did you know that in the golden age of USA "rich people" arrive even at 90% of income taxes and they are still happy?

I do not talk about centuries in the past or restricted communities.

My own personal truth is that you are right many in a FOSS world will be dead. Simply because they do not really produce anything sensible. FOSS world work on innovation, without innovation business die. Today we have near-zero innovation because we can't have anything really new in a managerial-drive world. But again this is a system that work well in the short term, crash miserably in the medium/long term.

</comment><comment><USER23> I had the same experience numerous times. It's great OP is standing up to this.

When I'm attacked for writing non-free software, I now respond by linking to [https://fman.io/blog/dear-comrade/](https://fman.io/blog/dear-comrade/).

<comment><USER44> The link is completely irrelevant to the topic. The topic is libre software versus proprietary. The link defends paid software against gratis, or at least misleadingly conflates both aspects.

<comment><USER23> You did read the section "Maybe you also dislike the fact that my project is not open source" right?

<comment><USER44> Yes, it's a small part that provides "I think I can't make it" as the only argument. That doesn't really bring anything into the discussion.

<comment><USER32> That's another of these developers who benefited greatly from FLOSS, yet write condescending posts. Ironically, the author of fman makes use of Qt, which is a great example of how to make a business and still have a copyleft licensed codebase.

<comment><USER23> I write to defend myself when I dare (gosh!) to write proprietary software.

<comment><USER32> My problem isn't with you writing proprietary software, (I'd prefer if it wasn't proprietary, but do you as you wish). My problem is with you people who benefit daily from FLOSS to then act as if the FLOSS people are just crazy hippie, commie lunatics and how you couldn't possibly be FLOSS without also putting food on the table and how other people are apparently not (gosh!) allowed to advocate for not using proprietary software, or how is wrong for them to do so and other such garbage.

<comment><USER23> I don't care about FLOSS people. Actually, I'm grateful to them and I also have my own set of FLOSS libraries [1], because I feel we as a dev community should work together and not have to reinvent the wheel all the time. What I take issue with is being criticized for writing proprietary software. It happens somewhat regularly. And the silencing that takes place is simply unacceptable.

1: [https://github.com/mherrmann](https://github.com/mherrmann)

<comment><USER32> People are free to say they won't buy your software because it is not free, (as in freedom). Also, there are important differences between merely "open- source" and free software, so am glad to see that fbs is indeed copyleft and applaud you for that. You seem to however be more on the open-source side of things, despite the great choice for a license of fbs.

One thing to understand, is that the free software movement strives for a bit more than open-source. It strives for trustworthy, ethical software. Software that does not spy and only does precisely what the user knows about and can be adopted to work according to one's needs. Copyleft is the best means we have of achieving that.

What I think you're also missing is how hard what we have even now was to win. You're grown up in a world where FLOSS was already a thing and fairly popular, but it is precisely because of the 'fanatics' that it is so and we're still far from an ideal place. If they were so lax as you wish them to be, you may not have all the things you take for granted today, because it is radicals who change the status quo.

You will be asked why fman is proprietary from time to time, because you market to people that have a lot of principled people on this issue in their ranks. You're free to ignore them and they're also free to keep not buying your proprietary product. That's how it works.

P.S. Just to let you know, I did subscribe to fman when it first showed up here and even renewed my license to support a one man shop, despite me not using the tool. Posts like the commie one however, carry with them a serios lack of understanding of the goals and reasons behind the (need for) free software movement.

Nonetheless, as I already said, I applaud you for taking the step to make some of your work copyleft. I am personally strongly of the belief that if fman itself was GPLed, you'd see an uptick it sales, not any downturn, because it would generate excitement and make people like me write plugins for it. At present, I don't want to do that due to it being non free.

<comment><USER23> > but it is precisely because of the 'fanatics' that it is so

People fought for the freedoms in our democracies with their lives, and killing others. That doesn't mean we have to keep doing these things. I understand that it was a fight to get here. But it's not like we will lose it all again if an indie dev like me writes proprietary software.

> You will be asked why fman is proprietary from time to time

I'm not just "asked". I'm told it's shit for the mere fact that it's proprietary.

> You're free to ignore them

They're not just ignoring me. They take time out of their day to actively hurt my product by downvoting or commenting in the nice way I described above.

> if fman itself was GPLed, you'd see an uptick it sales, not any downturn

I talked to the author of a once very popular Mac app for developers. He open sourced it under the GPL. Sales went down by 90% over night. So, while I am with you and would love for fman to be open source, it simply is not viable.

<comment><USER45> What's the name of the popular Mac app?

<comment><USER23> I can't say, sorry. The dev told me in private and I don't want to violate his trust. Suffice it to say, people on HN usually know it.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER46> > If we do Open Source Hiri, there is nothing to stop someone from forking it > and selling it for less /offering it for free. We die. And I do worry about > my bank balance.

The author is fearful of not making money if his code is open source. The rest of the article seems like a justification-wrapper around this. I am not saying that this an unjustified fear but that it doesn't seem to be tackled-on directly. Is there any alternate reality where Hiri could be making money while having their product open source?

It seems to work for Travis CI and Sentry where their product has an infrastructure component attached to it.

</comment><comment><USER47> The "inconvenient truth" that the author subscribes to is, in fact, a plain old neoliberal capitalist worldview. It is not an objective worldview, since those don't exist, and it is focused on money and power. The author cannot imagine doing anything for society without being compensated with cash, it seems.

It sure would be an inconvenient truth for them if their blog and business and business model and a significant fraction of their perks in life were backboned by FLOSS.

The author's approach to security is deplorable but frustratingly common, treating security as a feature, as optional, and as something that is too expensive for most software. As a reminder, the author's product is an email client.

To the author's proprietary-software mindset: Remember, in the long run, all software is worthless. Someday, there will no longer be email. I have a box of add-on cards with connectors which will never be used again; I think that most folks do. We know that proprietary protocols fade away, that closed languages wither and die, and that siloed knowledge is never cited.

To tackle the final argument directly: No, the purpose of software is to compute. Stop being married to work; it's an ugly American meme and doesn't have to be how we live.

Finally, here's a popular argument that the author chose not to talk about: What if existing copyright law is unconstitutional? In particular, what if the Constitution's copyright clause forbids copyrights which survive the death of the creator; or what if works-for-hire are inherently disenfranchising to artists? This would align just fine with Stallman's opinion that copyleft is only necessary because copyright law exists; maybe a world where corporations can't take code from their employees as easily would be a better world.

</comment><comment><USER48> But Free Software is a reaction _against_ Proprietary Software... it exists _because_ some people don't want to embrace PS.

Hey ho. You go your way and I'll go mine.

<comment><USER49> > Hey ho. You go your way and I'll go mine.

That is the attitude that I can get behind, however neither side of this argument is really prepared to do that. In my experience, FLOSS advocates do appear to have a more fundamentalist all or nothing approach when espousing their opinion online, often aggressively. Ideology is great, but it does lead to book burning on occasion.

</comment></comment><comment><USER50> I disagree with part of your argument. If being FOSS is important to you, by all means, only use FOSS. In some situations it is critical. For example, all of my devices become worthless once they stop being supported, unless they're FOSS.

At the same time there are some FOSS fundamentalists that think using proprietary software make you a bad person. They are wrong.

<comment><USER51> > using proprietary software make you a bad person

We don't believe this. We argue that free software is important[0] because it gives users control over their technology, and proprietary software is bad because it denies users that control. We don't believe using proprietary software (whether by choice or otherwise) makes you a bad person.

If anyone is actually making this argument I would say they are doing the free software movement a disservice.

[0] [https://www.gnu.org/philosophy/free-software-even-more- impor...](https://www.gnu.org/philosophy/free-software-even-more- important.html)

</comment></comment><comment><USER52> Does anyone have instances of forking open-source software that supports a business in order to undercut that business?

<comment><USER53> mariadb / mysql? matomo / piwik.pro? It seems mostly done by the original developers however and not a new 3rd party.

<comment><USER54> Generally it seems to happen in response to Darth Vader deals "pray we do not change the terms further".

OS branches over technical direction disagreements are a closer thing but they generally aren't businesses.

</comment></comment></comment><comment><USER55> > Extreme opinions are rarely correct.

this is the only thing I agree with.

some things should never be kept propietary unless there are widely availabe (FOSS) tools to reverse engineer them.

<comment><USER17> > Extreme opinions are rarely correct. That is definitely an opinion. If you > look throughout history it is clearly evident that extreme opinions were > often right (No men have a god given right to rule. Consciousness is > material. Other people have a right over their body. Etc.) The "wise" > centric position might sound nice, but it is often just a mix of conformity > and a weak imagination.

<comment><USER54> Yeah extreme opinions are large leaps whether their direction is right or wrong. If they take a wrong direction much of the time it may be because most opinions are wrong. There is a depressing tendency looking at history seeing someone stumble upon something groundbreaking, looking at it and saying "Nah that can't be right." and then promptly discarding it.

I think the late Justice Scalia had one such ironic moment with his dissent in I believe Laurence vs Texas when he derided a decision as saying under that logic it would lead to gay marriage.

</comment></comment></comment><comment><USER56> The statistic of .3% of desktop users on Linux is miles off. It's somewhere between 2% and 3%, or, by some measures, almost a third of the user base of Mac OS. Admittedly quite small, but not nothing.

[https://netmarketshare.com/operating-system-market- share.asp...](https://netmarketshare.com/operating-system-market-share.aspx)

</comment><comment><USER57> > If we do Open Source Hiri, there is nothing to stop someone from forking it > and selling it for less /offering it for free.

Your license can easily stop that in a way that still respects user freedom. Even more than GPL does.

<comment><USER44> An Open Source license cannot limit for what purpose the software will be used.

<comment><USER58> That's because restricting the use of software is restriction of user freedom …

<comment><USER57> Most open source licenses don't respect user freedom at all and are promoted precisely because they allow corporations to use such software to restrict user freedom. And among those licenses that claim to respect user freedom none actually respect it enough to prevent corporations from distributing such software as user freedom restricting services. Even GPL was not merged with AGPL because corporate interests outweigh respect for user freedom.

</comment></comment></comment></comment><comment><USER59> My 2c: the author has something to say and I mostly agree with many of the things he is saying. However, his choice of labels (fundamentalist mentality / reddit / FOSS defender / etc.) hurts intelligent discussion -- whoever is disagreeing would be tempted to counterattack with a label ("copyright nazi", etc.) rather than discuss the post on merits.

Maybe author hopes that choice of words would stimulate discussion, but I think all it stimulates are flame wars reusing old slogans. So the content may be interesting, but the form struggles to make it underwhelming.

</comment><comment><USER41> No one is entitled to a business model. If your userbase has a culture of being (rightfully, in my opinion) defiant toward proprietary products, that's for _you_ to remedy. If you can't make _any_ money from ancilliary uses of your product (support, hosting, whatever) maybe you should question why you're monetizing in the first place.

Free software is strictly more ethical than nonfree software. Any attempt at arguing otherwise basically boils down to a rationalization of 'but I want to make money', which is not a tenable ethical stance. I'm not saying it's wrong _per se_ , but it doesn't inspire goodwill or good sentiments either. Trying to deride people with a strong sense of ethics regarding software production and use by comparing them to religious fanatics is misguided as best, malicious at worst.

<comment><USER4> I'm certainly not trying to deride open source. For the record, we have plenty of Linux users paying for the product (see previous article), but I simply don't understand why some people won't buy the product because it's not open source. I mean it's their choice - fine. But it's also our choice on whether we open source or not. No need to abuse us for this choice. I am trying to remedy the issue - I'm writing about it.

As for free software being more ethical, I'm just not sure what that means? You think because someone is giving their time the motive is always altruistic and therefore superior choice? I'm not trying to antagonise you. Just asking the question. I don't think of it as a zero sum game. You can add to humanity and get paid for it. I'm no libertarian, but if you add value, create jobs, contribute to taxes...

<comment><USER41> I don't think I was in any way abusing. I said that your attitude does not inspire goodwill or good sentiments. You're trying to make money, like everyone. That's fine, not everyone is a monster for not writing free software, giving to charity, whatever. I just don't see why you should feel entitled to make the money the way you're attempting to. Your userbase feels strongly about some issues and these are the same people you're trying to convince to give them money to you. Calling them fundamentalists will not help or solve anything, and I can't emphatize with "If only more of my users agreed with me so I could make more money".</comment></comment></comment>


Four African girls create a urine-powered generator - <AUTHOR> http://thenextweb.com/shareables/2012/11/07/forget-apps-and-other-useless-startups-these-four-african-girls-have-created-a-pee-powered-generator/?utm_source=Twitter&awesm=tnw.to_chiG&utm_medium=Twitter%20Publisher&utm_content=Forget%20apps%20and%20other%20useless%20startups:%20These%20four%20African%20girls%20have%20created%20a%20pee-powered%20generator

<comment><USER2> <http://news.ycombinator.com/item?id=4752986>

[http://www.hnsearch.com/search#request/all&q=title%3Auri...](http://www.hnsearch.com/search#request/all&q=title%3Aurine)

<comment><USER3> Do you remember these, or do you do a search on each link? Just a-wondering!

<comment><USER2> I remember when I've seen something, and I've written tools to perform quick searches and create the text. I then confirm by hand, and copy-paste that text. It takes seconds if the search shows what I think I remember, and about a minute if I need to work harder.

More, when I do the searches I often stumble across other items by accident, and I've made several happy discoveries in that manner, so I don't think of the time as wasted. In this particular case the search for "Urine" in the title turned up some other interesting articles in addition to the earlier one for this story, one which already had discussion, which people may have missed without the cross-reference.

</comment></comment></comment><comment><USER4> Unfortunately this looks to be mostly puff-press since we are dealing with a trifecta of minority-in-startupland (black, female, third-world country)

This weird contraption obviously uses more power to make hydrogen than it takes to run it. (Unless we are breaking some laws of physics?)

I also see no mention of why using urine is better/worse than just using regular water. I am guessing because "Putting electricity in water generates hydrogen" is a less exciting title.

<comment><USER5> Urea is easier to break down than water. (0.37V as opposed to 1.2V) I'm no chemist, but I think that making an unstable chemical into a stable(er) one gives off energy.

Also, if it wasn't a viable way to get energy than it wouldn't run at all. I don't see any wire going into a wall socket or anything, so I assume if they had it run for six hours like the article implies there has to be /something/ there.

My main issue with it is having what looks like a gasoline generator run on hydrogen. Doing the necessary tweaks raises the technical complexity of this by an order of magnitude.

<comment><USER4> Article mentions a charged electrolytic cell. Charged from outside power?

<comment><USER5> I did a ctrl-f for charged in the article and didn't see it. Where did it say that?

If that is what it is, though, the entire thing is pretty much fake because a charged electrolytic cell is the same thing as a charged capacitor.

</comment></comment></comment></comment><comment><USER6> I honestly don't understand all the money and hype around "world changing" startups that creates a product or service that offer some kind of amusement/entertainment or solving a "real world problem" such as the need to know what restaurants are near one person or how much one spends in potatoes.

I wish projects like this had more support, from offering sponsorship or scholarship to the people involved in the project to do more research or prototypes, to big companies offering to help on the research of that project, something like that, and hopefully leave aside the cookie-cutter world changing android app we see every week and start focusing on things that matter. I have the feel we have become a stagnant society as far as innovation and discoveries go, we focus all our energy, money and interest in entertainment rather than in discovery and humanity development.

<comment><USER7> It's a nice sentiment, but this project isn't real. They are basically using those girls for publicity.

</comment></comment><comment><USER8> >1 Liter of urine gives you 6 hours of electricity.

"Hour" is not a unit of energy.

</comment><comment><USER9> Here's a link to google's cache of the original blog post on Maker Faire Africa's site:

[http://webcache.googleusercontent.com/search?q=cache:7Tim1l5...](http://webcache.googleusercontent.com/search?q=cache:7Tim1l5Ay4UJ:makerfaireafrica.com/2012/11/06/a-urine- powered-generator/+&cd=1&hl=en&ct=clnk&gl=us)

</comment><comment><USER10> while I applaud the initiative, someone might want to explain to them what 'Rube Goldberg Machine' means... As others have commented there's no gain here, it would be just as well to store the solar or wind power that charged the 'electrolytic cell' and keep the energy there rather than then using that captured energy to separate out the hydrogen.

edit: as some have pointed out, yes one could just run the wind generator 'directly' into this device and use the intermittently produced hydrogen as the storage mechanism..

<comment><USER11> Except that hydrogen (in gas form) is not that easy to store to begin with and likes to leak from containers.

The most efficient hydrogen storage we know is... fossil fuels.

</comment></comment><comment><USER12> Sounds like this system puts out less energy than it consumes.

<comment><USER13> Do any (eg gasoline) generators put out more energy than they consume?

<comment><USER14> There is no pure energy generator. All the generators are transforming one form of energy to another. The chemical energy from gasoline is transformed to heat (thermal energy) + mechanical energy + other forms of chemical energy (CO, CO2 and others). The mechanical energy is then transformed into more heat and electric energy (if we're talking about an electrical generator).

What makes gasoline a good energy "producer" is the simple way the chemical energy can be released and the percentage of usable energy (the efficiency of the generator). What makes other substances bad energy producers is the efficiency and complexity of changing the energy to usable energy (like mechanical or electrical energy).

</comment></comment></comment><comment><USER15> > 1\. Urine is put into an electrolytic cell, which separates out the > hydrogen.

How does this part work

<comment><USER16> If you stick a pair of charged contacts in a container of water, you'll see bubbles produced at each contact. The cathode produces hydrogen.

Go get a 9 volt battery and try it right now. Just drop it in a cup of water. Presto! Hydrogen!

Use solar power as a source of electricity, and who cares about efficiency?

<comment><USER7> So what does that have to do with urine?

Use the energy from the solar panel directly, why convert it to hydrogen and back to electricity?

<comment><USER17> The idea is that their electrolysis unit is fed by the generator, which is in turn fed by the hydrogen from the electrolysis unit. To make the contraption somewhat more scientific-looking (and less suspect), they've put two water filters in the loop, presumably to 'purify' the hydrogen.

<comment><USER18> Does the article say that the generator runs the electrolysis? I don't see where it does.

</comment></comment></comment></comment></comment><comment><AUTHOR> These girls banded together and built something. Whether it's a rousing success or ends up being a bad idea, there is something positive to be said for their efforts. If you consider the cultural context in which they are operating, they deserve praise for this.

Heck, we praise people who build failed webapps here in the US, in part because it's an exercise in execution. When people build new things, it's great even if it doesn't work out, because who knows what it could lead to?

</comment><comment><USER19> Did anyone read "<http://www.suttonfruit.com/pics/urea_electrolysis.pdf> linked within the article. That's a paper that illustrates direct hydrogen production from urine without electricity (a chemical process)! Making the whole idea a little more plausible.

</comment><comment><USER20> I am awestruck that there may be a day we all have urinals in our bathrooms because it helps lower our electricity bill.

</comment><comment><USER21> Anything that uses electricity to take hydrogen out of water will use more electricity than it produces.

<comment><USER19> <http://www.suttonfruit.com/pics/urea_electrolysis.pdf>

<comment><USER22> When you read this paper closely you will recognize that the authors have discovered a way to remove bound nitrogen from effluent. It's possibly an advance over the well-established biological reduction of nitrate, considering that instead of putting energy in in the shape of methanol you can recover a part by burning the hydrogen the process generates - possibly in the sewage gas plant that you already have on site.

</comment></comment></comment><comment><USER23> My friend works for a small startup in SF called Fenix International. Their device for providing power in places like Africa is much more promising www.fenixintl.com/

<comment><USER24> You could at least explain the basics behind how the device works rather than making us type in a url. As it is, I have no interest in looking into your friend's product.

<comment><USER23> Sorry, I posted from my phone just before a meeting.

The device is called ReadySet and is a high-quality personal power generation unit with battery for storage. It can be powered by putting it beneath the rear wheel of a standard bicycle or the included 15-watt solar panel. <http://www.fenixintl.com> <http://kck.st/LP5NjI></comment></comment></comment>


Update on Coinbase Data Security - <AUTHOR> http://blog.coinbase.com/post/81407694500/update-on-coinbase-data-security <comment><USER2> While not ideal, I think this is being blown out of proportion by someone that doesn't like Coinbase. For starters, of the 2042 "leaked" emails, 1153 are unique. That means the person that posted it was trying to pad their results, which combined with the possible but unfounded FBI/Fincen accusations, illustrates that someone is mad at Coinbase and is lashing out.

Enumeration isn't a fantastic idea, but given its ubiquity in various forms on major sites throughout the internet, I don't think it's worthy of all of this negative attention directed specifically at Coinbase either. I once wrote a program that could take a list of random emails and use Facebook to turn it into a CSV matching each email to a name, a list of their friends, their location, and interests. That should have been scandalous, but it wasn't.

We are acting as pawns in someone's revenge scheme against Coinbase.

<comment><USER3> _> That means the person that posted it was trying to pad their results_

Not necessarily. The duplicates are in exact order(quick check using sublime). Could have just been a double paste, happens very often.

The fear mongering (FBI et al) definitely seems unfounded.

 _> illustrates that someone is mad at Coinbase and is lashing out_

That's an ad hominem attack.

 _> I don't think it's worthy of all of this negative attention directed specifically at Coinbase either_

Agreed Coinbase is the target of a lot of negative attention. That does not discount that enumeration deserves any less attention, it's unnecessary and poses more risks than benefits (again I don't know of a single benefit when requesting funds - when sending funds it is understandable but still problematic).

 _> We are acting as pawns in someone's revenge scheme against Coinbase_

You're giving people too little credit. Coinbase is bad at communicating (timing and message), bad communication pisses people of. They are also in a business that gets more scrutiny than other payment processors.

<comment><USER4> >> illustrates that someone is mad at Coinbase and is lashing out

>That's an ad hominem attack.

No it isn't. I honestly wish that people would stop erroneously calling out logical fallacies. An ad hominem attack is refuting someone's argument by attacking their character in a way that has nothing to do with the discussion. For example, this is an ad hominem attack:

Obama: ObamaCare has insured 7.1 million people through the exchanges.

Sally: Oh sure, but what difference does that make - you're a muslim and want this country to fail!

That is an ad hominem. Because Obama being (or not being) a muslim is irrelevant to the discussion and is only used to impugn the character of Obama.

What is not an ad hominem attack is evaluating evidence of someone padding numbers to make Coinbase look bad and then determining that they must be biased against Coinbase. If you think evaluating evidence and coming to negative conclusions about someone is an ad hominem attack, then you are seriously mistaken.

</comment></comment></comment><comment><USER5> _You'll find that user enumeration is possible on Facebook, Google, Dropbox, and nearly every other major internet site._

And yet, most banks & payment processors do not do this, for good reason. Seems like Coinbase is suffering from some domain confusion.

<comment><USER6> As mentioned in the blog post, payment services also commonly allow user enumeration, including Paypal, Venmo, Square Cash, and others.

The reason you don't see it with banks is that they don't allow you to send money to an email address.

<comment><USER7> Maybe in the US they don't, but in Canada you can. I'm quite sure in most of Europe & Australia you can as well.

<comment><USER8> Interac e-Transfers (the only widely used method for doing this I'm aware of) do let you send money to someone via an email address, but it's a notification channel, nothing more. An account enumeration isn't possible with it, the actual email is sent some time after the money for the transfer has left the source account, and the sender doesn't get any information about the delivery of the email.

I suppose you could send e-Transfers to random email addresses and then see if any are accepted, but that would cost you an absolute minimum of $0.01 per attempt and would probably have a terrible response rate.

Source: this is my day job.

Edit: sorry, forgot to mention this is Canada-specific.

</comment></comment></comment></comment><comment><USER9> I'm curious why, given the prior reports of security issues at Coinbase and the ongoing drama with Mt Gox, you guys didn't _immediately_ hire, say, tptacek's company to do extensive penetration testing and a full security audit. It appears that not all API calls were rate-limited, as they probably should have been, and there certainly doesn't seem to be any sort of monitoring of brute-force attempts like this in place. With all the negative publicity around Bitcoin exchanges, you should have doubled down on security weeks ago, or at least explained the privacy tradeoffs in your design decisions clearly.

<comment><USER10> A few thoughts. I agree with you, which is why we are currently going through a third party security audit in addition to the impromptu peer review by Andreas the day MtGox went down and our normal reviews by accountants. We also hired a director of security from FB. Also, there were rate limits, just not well tuned enough. So it's definitely in focus for us.

Hope this helps clarify

(edited for formatting)

<comment><USER11> What precautions have you taken against meatspace robbery? What's to stop 3 thugs with guns walking into your office(s) and cleaning out all the coins? Can you get insurance against this?

Do you also have measures to prevent evil janitor attacks like hardware keyloggers being planted at 4:00am? Do you have screens facing an open window to watch from across the street? Can I rent beside your offices, drill holes through the walls and set up spycams or gain entry? Not to sound alarmist but seems no exchange has given a thought to physical security meanwhile bank execs are dropped off at work by private guards specializing in counter- kidnapping operations, even though their money is fully insured and extremely difficult to steal. Bitcoin's are easy to steal.

<comment><USER12> > meanwhile bank execs are dropped off at work by private guards specializing > in counter-kidnapping operations

Perhaps there are some bank executives for which this is true, but it is absolutely NOT the case for all banking executives. I work with some bank executives and they drive themselves to work in their own cars. The buildings DO have alarm systems and it is quite possible for the FBI to respond to physical threat incidents (because it is treated as a bank robbery) but otherwise there is little that is special in the way of physical security.

And for Coinbase, I believe the lack of special physical guards is appropriate. A high percentage ("up to 97%" according to [https://coinbase.com/security](https://coinbase.com/security) ) of their coins are in cold storage and while I am not privy to the details of Coinbase's arrangements, keysharing and multiple physical storage locations that are off-premises are a reasonable precaution. They are vulnerable to hostage-taking or "3 thugs with guns" to the exact same extent (no greater) as any other company with a similar amount of protection.

I can't comment on protection against hardware keyloggers: it's a threat that they need to be prepared for. Cold storage is one major way of protecting against this threat, business insurance is another.

<comment><USER11> Any other company doesn't need to worry since robbing their head office and demanding online bank transfers is a waste of time. A cryptocoin fixed rate exchange with millions in storage you can instantly transfer is a different story. It's like Ft. Knox being located in a regular office building with gold piled on the desks. Bank vaults have physical security so why don't Bitcoin based businesses.

I did read through their security about the backups being spread around different locations, but those are backups. They would need access to the cold wallet on a regular basis if 97% of funds are truly in there. Unlikely to happen but then again police here didn't expect criminals would remove huge concrete barriers with a stolen tractor, ram a shopping mall entrance, drive through the mall and ram a gated jewelry store but they did.

<comment><USER12> > They would need access to the cold wallet on a regular basis if 97% of funds > are truly in there.

Not true. First of all, that would only be true if their net daily turnover were more than 3% of their total amount stored -- which it may not be. Even then, I would expect graduated levels of cold wallets: imagine one with another 2% that is down the street in a bank safe deposit box, 5 wallets with 50% of the deposits stored in a way that can only be accessed with cooperation of 4 people in different parts of the country ... that sort of thing.

I am, of course, just speculating: I don't know how Coinbase runs their system, I just know that they seem competent and that this is how _I_ would run such a thing.

</comment></comment></comment></comment></comment></comment><comment><USER13> _We'd also like to address the claim of a "leaked" list of Coinbase emails and user names. This list (the size of which is less than one half of one percent of Coinbase users) was not the result of a data breach at Coinbase. This list of emails was likely sourced from other sites - probably Bitcoin related ones. It's clear there was no data breach because no other user information is provided._

That last sentence is doing a _lot_ of lifting, out of its weight class.

This immediate "no it's not true" might reassure some folks, but it scares me because of how quick it is. Have you looked at the audit systems on your database?

"We believe this information is bogus but are investigating to make sure" is a better response, assuming you actually do investigate to make sure.

</comment><comment><USER14> I think many users will assume, with a finance site like Coinbase, that the name they have provided is for $ transactions (taxes, Visa, MasterCard, etc.) not for social aspects. In my opinion, getting behind the Privacy Policy and claiming that users know their names will be publicly shared is unethical.

Why people want to hide their names? Personally I don't hide my name. But it is not too hard to understand that on "web-scale" there will be someone who is stalked, who has posted on suicide help forums, etc.

</comment><comment><USER15> (Bug report at [https://hackerone.com/reports/5200](https://hackerone.com/reports/5200))

From Ryan McGeehan, director of security (user magoo):

      > This behavior is mostly informational to an attacker and does not
      > directly increase risk in any significant way

All information leaks are useful to an attacker. By themselves they are harmless, but can be combined with other information to successfully exploit a system.

From bug reporter Shubham Shah (user zero):

      > This request can now be replayed unlimited times, with unlimited email
      > addresses inputted. Coinbase does not limit the rate of POST requests
      > to /transactions/request_money

This should not be possible _at all_. The reporter must have made a mistake and forgot to mention the X-CSRF-Token needs to be updated each time. If it didn't need to be updated, this would be a basic CSRF vuln.

All this being said, the real flaw here is the lack of rate limiting on transactions, for three reasons:

1\. The spam will eventually mount up and ISPs will block their servers for days or weeks.

2\. Their network and app stack is subject to DoS attacks unless they rate- limit transactions.

3\. Harvesting of e-mail addresses would be stopped by basic rate limiting of email<->user queries.

</comment><comment><USER16> I was phished for coinbase just recently with an email telling me "You just received 0.08525920 BTC" and just "Click here to sign in and view this transaction" and I stupidly I did click on the link and did try to log in. The login failed (as it would with a trojan and the coinbase 2 factor authentication I have enabled). But even so, the phishing site was able to attach 3 Android apps to my account with full access. I deleted the apps and notified coinbase, but they were totally less than helpful.

<comment><USER17> People should upvote this much more. This shows that the reported exposure has resulted in at least one successful phishing.

The fact that the 2 factor auth can apparently be bypassed by attaching apps is another security vulnerability entirely. If that is what you are claiming is the case, then they should be immediately fixing this as soon as you reported it to them.

</comment></comment><comment><USER18> Less sympathetic than I was hoping for but copacetic. Could they have nipped this in the bud with a faster response? Perhaps. However having dealt with reports like this, I cannot recall a decent interaction with a reporter.

<comment><USER19> copacetic : in excellent order.

(For the lazy like me, who still want to learn new and useful words.)

<comment><USER20> Three-finger click on OS X defines the word. Or right-click and Look up in Dictionary.

<comment><USER19> Indeed, and a great trick too — but that appears to be a great but non-default option, only working within Apple software (namely Safari browser when surfing HN) and uses the System language (not English for me).

I personally prefer Right click "Search with Google…" in Chrome: it has the upside of coming up with a definition when the word is actually rare -- so it prevents me from defining an word I didn't know simply because I'm not a native English speaker.

<comment><USER21> It works in any software in OS X using standard text controls. It's _insanely_ handy.

The few programs I use that don't support it actually drive me nuts because I've become so used to it.

The system language thing is a little annoying. It would be fantastic to be able to look up the random Spanish or Japanese word, but I understand the limitation.

</comment></comment></comment></comment></comment><comment><USER22> _Rate limiting_

Do we have to spell it out to them?

<comment><USER10> We are pushing some changes to rate limiting - this wasn't clear in the original post and I just edited. Thanks for the heads up.

<comment><USER23> So why are you blowing this off and now all of a sudden writing rate limiting?

The only reason he got 1000+ emails is because you guys messed up.

Not even going into the whole idea of you releasing that end point with name leakage without somebody going 'oh hey.. do we have rate limiting?'.

Mistakes like this are signs of amateur hour.

<comment><USER24> Suppose they limit it to 100 emails before blocking your account. The guy can just sign up with 10 accounts. Or 5. This "attacker" would still post it and make a big fuss.

Most likely they're implementing rate-limiting to appease people and prevent an ongoing spam issue. Or perhaps it was on their list for a while and just hasn't been an issue until now.

<comment><USER23> In regards to rate limiting, it would be a much smaller number prior to block.

If it's IP based at let's say 10 over X attacker would have to lease 100 IP's.

In any case, rate limiting is the quickest mitigation prior to actual fix of the data leak in question.

</comment></comment></comment></comment></comment><comment> wes-exp If Coinbase can't admit any amount of fault whatsoever for enabling the large- scale harvesting of their customer list, I'm sorry, but I've lost faith in their security.

This is a service that stores _digital cash_. It should be like an online Fort Knox, not "safe as Facebook" like that's some kind of high bar.

<comment><USER25> If you read the post even a little bit carefully, they refute the idea that this was a harvesting of their database. One compelling bit of evidence they present is that the list is tiny, and their customer list is very large.

It's not just that this isn't a "large scale" leak; it's that they say it's not a leak _at all_ ; that this data was made available through some other combination of services that exposed it, not Coinbase. They don't provide any additional evidence (but few companies would) --- but it's a plausible argument.

<comment> wes-exp Coinbase's tone at [https://hackerone.com/reports/5200](https://hackerone.com/reports/5200) convinces me that they just don't care about user account enumeration. Combined with the blog post, my sense is that Coinbase does not deny that systematic enumeration is possible; rather, they deny that we should worry about it. ("it's not a bug, it's a feature")

<comment><USER25> I don't know if they do or don't, but I wouldn't be surprised either way, because I sure don't care about user account enumeration. We doc it, but I'm always embarrassed when we do.

</comment></comment></comment></comment><comment><USER23> Do you smell it?

They believe it's not a risk to their users (never minds those users who are now targeted via e-mail leak because they have BitCoins).

"You'll also find many leading payment services allow user enumeration"

They also do pattern monitoring and rate limiting. And instead of saying 'but they do it!' they should be saying 'they do it too, but we think this is a valid privacy issue that we need to fix'.

This is more or less 'If you don't get privacy implications , we will bullshit you so you don't panic and go elsewhere with your money. Everything is fine!'

</comment><comment><USER26> I also think this whole thing is overblown but I hope it will help to further humble Coinbase in realizing that they really need to focus more efforts on squashing things like this before they become a problem. Coinbase has a large responsibility in whether or not Bitcoin is to become "accepted" in the USA and several small events like these left unsettled or left to fester could prove catastrophic(IMO).

I don't believe Coinbase should consider this a real "security threat". I believe that this is a negative side-effect of what may be a feature. It is certainly something that needs improvement, as I'm sure all of the people whose email has been leaked will tell you...

I'm not sure if Coinbase has an engineering blog or a similar outlet where they can speak to more developers directly but if they do not have one already, this may be the time to start. This could've been squashed entirely within a small development community but when left unsettled for so long, it is things like this that the news will latch onto and run with We all know how blown out of proportion things get when that happens.

Anyway, long story short... I hope Coinbase improves. As much as I hate to say that a tech company needs more representatie

</comment><comment><USER27> I don't who is wrong or right here (Coinbase saying there was no breach or alledged hackers via pastebin), but isn't having fake security breaches for large bitcoin sites a good opportunity to manipulate the rates? If one wanted to bring the rate down it might be possible to do this with creating a good fake security breach of a large site.

</comment><comment><USER28> Is there an option to opt your account info OUT of the api?

<comment><USER24> I tried deleting my name from the user settings page. No problem. This "bug" is literally about people being upset that information they opted-in to share was shared.

</comment></comment><comment><USER29> Interesting to note that they did not dispute the claim (posted on HN with the pastebin data) that they are providing transaction data to government agencies.

</comment><comment><USER30> I always find my 'skeptic' meter ticks faster when I read of a data breach, and find a company:

a) using language that is very specific when making a denial b) also introducing a new Director of Security in the same post

<comment><USER31> No new director was introduced; the Ryan McGeehan hire was in the news weeks ago.

<comment><USER30> Thanks, I stand corrected. It was my gut reaction at the phrasing, all good.

</comment></comment></comment><comment><USER32> My email was not published anywhere with regards to bitcoin or coinbase, I receive relatively little spam, yet I received 4 of these spam messages. Smells fishy.

</comment><comment><USER33> You can add a soft rate limit with a captcha to make sure it's a human doing the requests rather than a spammer's script.

<comment><USER31> You can't rate limit APIs with CAPTCHAs.

</comment></comment><comment><USER34> There was no mention of the IRS and FBI gag orders/data transfer in this post.

<comment><USER35> I filed a Freedom of Information Act request to the FBI about Coinbase, and they replied that they have no documents. [https://www.muckrock.com/foi/united-states-of- america-10/coi...](https://www.muckrock.com/foi/united-states-of- america-10/coinbase-fbi-9727/) Of course, the FBI is explicitly allow to lie in response to FOIA requests if it will protect an ongoing investigation.

However, I was also told at a party by a Coinbase employee that this is not true (which is why I filed the request to begin with.)

I am certain that they have a relationship.

</comment></comment><comment><USER36> does anyone know what blogging software they are using for the coinbase blog? is it tumblr?

<comment><USER31> If you view the source, you'll see tumblr right from the first line.

<comment><USER36> thanks boss

<comment><USER37> You should write a book - Babies first pentest.

</comment></comment></comment></comment><comment><USER38> No mention of the claimed IRS / Fed gag order, interesting. (although I realize its not their main focus right now)

<comment><USER24> Well they can't mention it if they have it, but they can mention if they don't. So this would be the only way Coinbase could communicate that they _are_ under a gag order, barring a prior warrant canary. So it's probably prudent to act as if they have acknowledged the gag order until they deny it. Although it'd be really dumb if anyone was assuming the records were private.

I guess they could say "We have implemented a warrant canary at <url>" then 404, but perhaps their legal team wisely denied that one.

<comment><USER12> Yes. And while we're at it, I wanted to point out that cbcbcb (who posted the initial leak) is ALSO under a federal gag order. He/she either won't deny it (because, obviously, they can't) or WILL lie and deny it (forced to lie by the gag order).

Oh, and I'm under a federal gag order too... or at least there's no way to prove that I'm not.

<comment><USER24> Has it been shown that the USG can order an entity to lie?

<comment><USER12> There has been speculation among legal scholars that the legal threshold for ordering someone to lie might be greater than the legal threshold for ordering someone to keep silent. This has not been tested in court (at least, not in open court) so no one knows for sure. If I received a national security letter ordering me to lie, I would have to think VERY carefully before deciding to violate it and become a test case.

</comment></comment></comment></comment></comment><comment><USER39> >there has been no data breach of names or emails at Coinbase

I have a Pastebin URL with 200 email addresses to prove the contrary. Why lie in PR?

<comment><USER40> You have to have the email addresses before you can query Coinbase with them. The addresses didn't originate with Coinbase, the attacker already had them.

<comment><USER21> Were you certain they were Coinbase users? Did you have the first and last names?</comment></comment></comment>


Ask HN: How to convince my parents to buy me a good chair? - <AUTHOR>

I have been having this problem, in which I cant convince my parents to buy me a chair that costs above 50 bucks. After a couple of months I cant stand sitting in this thing anymore, and even find the ground more comfortable. Any recommendation on how to make them change they way of thinking? And how to pick a good chair? <comment><USER2> I don't think the answer is for you to convince your parents to buy you a new one. Your paradigm needs to change to begin focusing on 'how can I get a new chair?' In which an option is get your parents to buy you one, but the more valuable options are in looking for ways to leverage your skills.

You can make a deal with someone to barter services. You can work to earn money and buy one on your own. You can contact chair manufacturers and request one to demo and review on your blog. You can go dumpster diving. You can find businesses going out of business and selling their office furniture.

I don't think you're doing yourself a favor by asking for how to be convincing, the problem you need to solve isn't being convincing, it's how to acquire the chair.

If you're still not convinced, here are some ways to get your parents: Have them sit in the chair for dinner and see if they find it as uncomfortable. Do a high quality presentation of pros/cons to you having a new chair, don't be silly make it serious. Look for a financial barter. Yard work. Chores above and beyond normal, etc.

<comment><AUTHOR> How to get a decent paying job, for a high school student in a Latin American third world country?

<comment><USER2> When you put it that way, it makes me ask if you _should_ as your parents for money for a better chair. Why not get a pillow to sit on? Or an additional cushion?

In any case, this doesn't answer your question: How do you get a decent paying job?

First off, decent paying is a flexible term. It means different things to different people. In the US a decent paying job has a wide variance even among members of the family based on age etc.

So my first advice is decide what (reasonable) pay rate you're aiming for. You want to be definite and exact. Don't pick a range, pick a minimum. Be reasonable. Finding a job paying you a college graduates wages will be much more difficult than an hourly rate slightly above what your friends are making.

Now, do your homework. Research. What jobs pay in that range? What skills do you have that people are willing to pay you for? Programming? Computer tech support? Etc.

Go, apply, sell yourself. Be confident.

<comment><AUTHOR> Because of my lack of a degree, I have only managed to get jobs that pay me at most $10 a day; that despite my knowledge of three languages (spanish, french and english), good programming skills, and good GPA. I guess this happens when you are stuck in a third world country, but I would really appreciate any suggestion on how to get out of this; cause I have already done what you have recommended me to do.

<comment><USER2> It's tough, I don't want to sound like I'm belittling your struggle for income.

How about turning to the entrepreneurial spirit? What problems exist in your community that you can help solve and will earn income? Maybe your need for a comfortable chair is something others are struggling with?

Can you take your programming and language skills and find jobs online? Translation? Amazon's Mechanical Turk? kgbkgb.com? elance.com?

</comment></comment></comment></comment></comment><comment><USER3> Step 1. Learn <some activity>.

Step 2. Perform <some activity> in return for cash.

Step 3. Purchase chair of dreams.

At any rate, your parents aren't the answer.

I know this will probably enrage some ergonomics hacker, but I actually prefer wood chairs with straight backs over anything fancy (I sit up straight even in nice chairs, so there doesn't seem to be too much benefit...). You could get one at goodwill (or similar) or a restaurant supply store for a few bucks.

Don't sit on the ground or the couch for long periods, though. You could damage your spine. Some people like standing desks too, have you given that a try? Maybe it would work long enough to earn the money for your chair.

</comment><comment><USER4> Save up some money and buy yourself the chair you want. It's cheaper than a computer, typically.</comment>


Professional GTD project management - <AUTHOR> http://help.cashboardapp.com/kb/project-management/getting-things-done-with-cashboard

<comment><AUTHOR> Managing your professional projects better by using GTD methods.

Our personal spin on GTD using Cashboard.</comment>


I lost 13 stone – now I know the truth about obesity - <AUTHOR> https://www.theguardian.com/society/2019/jan/05/truth-obesity-five-fat-myths-debunked#comment-124302779 <comment><USER2> Was it intentional that you linked to one of the comments, rather than to the article itself?

<comment><AUTHOR> Sorry, just saw your comment- no, I thought I was linking to the article itself. The Guardian's comment section has been behaving a bit weirdly for me lately. Thanks for pointing it out.</comment></comment>


Ask HN: What would you build with real-time data - <AUTHOR>

What would you build if you had access to a real-time data stream? The data would be items such as pricing/item information, weather, and news stories. I'm just curious what developers would build if they had access to that kind of data. <comment><USER2> A very similar question was posed a few days ago with some pretty interesting replies - <http://news.ycombinator.com/item?id=1015079></comment>


What happens when your startup is acquired? - <AUTHOR> http://dondodge.typepad.com/the_next_big_thing/2011/09/acquisition-success-depends-on-founders.html Success depends on founders and acquirers sharing vision and control <comment><USER2> _Most acquisition failures can be tied directly to the founders leaving too soon._

I think that it often works in reverse: the acquisition fails, _causing_ the founders to leave too soon. I don't doubt that some founders see the $$$ and can't wait to leave, but there are lots of founders who genuinely want to thrive at the new company. Sometimes the acquired startup doesn't get the attention or resources it needs to successfully integrate into the new company, or maybe it gets put on a back burner. That may cause a founder to want to leave.

<comment><AUTHOR> Exactly, it does work both ways. It would be interesting to know the details/motivations on why Ev Williams (Blogger), Dennis Crowley (Dodgeball) and Max Levchin (Slide) left Google. Yet, Andy Rubin (Android) and Chad Hurley (YouTube) stayed on and were very successful. Same parent company, different results.

<comment><USER2> According to Crowley:

 _It's no real secret that Google wasn't supporting dodgeball the way we expected. The whole experience was incredibly frustrating for us – especially as we couldn't convince them that dodgeball was worth engineering resources, leaving us to watch as other startups got to innovate in the mobile + social space. And while it was a tough decision (and really disappointing) to walk away from dodgeball, I'm actually looking forward to getting to work on other projects again._

(<http://gigaom.com/2007/04/15/dodgeball-founder-quits-google/>)

At a brief glance, it appears that when you get a lot of autonomy and resources (YouTube and Android), you want to stay. When you feel like Google is ignoring you, you want to leave. That's the way it looks to me.</comment></comment></comment>