ProtonMail now offers elliptic curve cryptography - <AUTHOR> https://protonmail.com/blog/elliptic-curve-cryptography/ <comment><USER2> This announcement is an example of why I am not using ProtonMail anymore. There are a lot of things they do that sound very good on marketing materials, but upon examination are security theater.

For example, they claim, "We have chosen a particular elliptic curve system known as X25519, which is fast, secure, and particularly resistant to timing attacks. It's simple to implement".

However, previously they've said that they use Indutny's library [0]. This library is somewhat infamous because its leadership deciding to discard any pretense of defending against timing attacks on the grounds that would make the library "too slow." [1]

There are other options. They could have used something with good timing attack resistance from WebCrypto. Those options exist. Folks with more skill than I have recommended P-256 as an option.

[0]: [https://protonmail.com/blog/openpgpjs-3-release/](https://protonmail.com/blog/openpgpjs-3-release/)

[1]: [https://github.com/indutny/elliptic/issues/128#issuecomment-...](https://github.com/indutny/elliptic/issues/128#issuecomment-302593662)

<comment><USER3> Out of curiosity, what did you switch to? I'd like to leave Gmail and Proton Mail seems to be pretty well recommended. Is Fast Mail a better option?

<comment><USER4> I've been using Tutanota for almost a year now and it's pretty good. I'm no expert on encryption but that part also seems pretty solid [0,1]. NordVPN "leans towards" TN over PM, but only for convenience and not security (that's more or less equal between the two)[2]. However, PM is based in Switzerland (not bound by GDPR), while TN is in Germany (bound by GDPR and other privacy laws that the EU is really progressive in pushing, compared to the rest of the world)[2]. That said, PM is what Cambridge Analytica was using to overthrow governments so I suppose that has to be pretty secure[3].

PM pricing is €48-288/y while TN is €12-60/y[4,5]. Both have freemium options too; I'm paying €12/y for TN just to receive support (more to be able to message them with feedback, really).

My only complaints w/TN is that it's a bit slow; notifications will remain even seconds after I'd read the mail, and sometimes (especially in the beginning) I would hit "Del" twice or more for the same email because it would remain in my inbox, ultimately accidentally deleting the emails after it in my inbox (something I noticed only after refreshing the tab, which -- annoyingly but also securely -- would cause me to have to log in again).

I ultimately went with TN because of one thing, however: I can export emails. Yes, it's a hassle, and yes, I have to generally do it by hand, bundle by bundle, but I love being able to have all my emails archived offline. Plus, with their new (beta) desktop client, this should be even easier[6]. I'm staying with them for now because they're the only ones (that I know of) who encrypt both your emails and your contacts, as well as the subjects, contents, and attachments of all the emails you send[7]. This is HUGE for me. However, the moment a better service comes along who does all this and who is smoother, faster, I won't mind switching ship. Especially because the name is so annoying to tell people, especially over the phone ("Puta? Duda? T like Dom or like Tom?"). Yes, I get it means "secure message" in Latin, but come on now. Just use a simple word already. Or do what PM did and enable a neat shorthand domain (pm.me, how neat is that?[8]). Though they also do offer custom domain names so I suppose this isn't too much of an issue, I just haven't had time to properly look into this yet.

After reading this thread though I'm curious to find out more about FastMail. But Australia, uhhh... Five Eyes, no thank you.

[0]: [https://tutanota.com/security](https://tutanota.com/security)

[1]: [https://tutanota.com/blog/posts/innovative- encryption](https://tutanota.com/blog/posts/innovative-encryption)

[2]: [https://nordvpn.com/blog/tutanota](https://nordvpn.com/blog/tutanota)

[3]: [https://reddit.com/r/ProtonMail/comments/85vgca/cambridge_an...](https://reddit.com/r/ProtonMail/comments/85vgca/cambridge_analytica_ceo_alexander_nix_caught_on)

[4]: [https://protonmail.com/pricing](https://protonmail.com/pricing)

[5]: [https://tutanota.com/pricing](https://tutanota.com/pricing)

[6]: [https://tutanota.com/blog/posts/desktop- clients](https://tutanota.com/blog/posts/desktop-clients)

[7]: [https://tutanota.com/faq/#what- encrypted](https://tutanota.com/faq/#what-encrypted)

[8]: [https://pm.me](https://pm.me)

<comment><USER5> ProtonMail actually has a dedicated export tool: [https://protonmail.com/support/knowledge-base/export- import-...](https://protonmail.com/support/knowledge-base/export-import- emails/)

ProtonMail also encrypts emails, contacts, contents, attachments, of all emails you send and receive, with end-to-end encryption.

However, the most important differentiator is the trust model. ProtonMail has Address Verification, which means it is trust on first use, which is significantly more secure than the trust on every use model Tutanota uses for key distribution. Details here: [https://www.reddit.com/r/ProtonMail/comments/b84kd3/why_is_p...](https://www.reddit.com/r/ProtonMail/comments/b84kd3/why_is_protonmail_better_than_tutanota/ejyu35v/)

</comment></comment></comment></comment><comment><USER6> X25519 is great, but it doesn't make Protonmail (really, OpenPGPjs) a net safe communications mechanism.

It inherits all of the flaws inherent in OpenPGP, including optional authenticators (which lead to EFAIL), kitchen sink bulk protocols complete with negotiation (did you know your public keys specify what algorithms you like?), lack of forward secrecy, repudiability, et cetera.

We should stop using RSA. But RSA isn't what was keeping OpenPGP from being a great secure communications channel. That's aside from the question if it's meaningful to say you control your keys if you use OpenPGPjs served up every time by a third party. (I say that being extremely on the PGP apologia side of the scale compared to some of my peers!)

<comment><USER7> Shouldn't it be possible to have the library built in to the browser? I can't seem to find any information on attempts to make that happen, either directly by browser developers or as an add-on.

<comment><USER6> Sure: that's WebCrypto. The main problem it solves is that you don't really want your AES implementation to be in JS which is only a small part of the problem. You still have the problem that the site would be telling you to do with all of that good crypto, and you still need to do key management.

You could do all of this well if WebCrypto was good and you had a WebExtension, or an Electron app, or some other way where you weren't just going to do whatever the website tells you to do.

(That is not a blanket security recommendation in favor of Electron. XSS does not normally get me RCE.)

<comment><USER8> Interestingly there is such an extension: [https://github.com/tasn/webext- signed-pages](https://github.com/tasn/webext-signed-pages)

tl;dr version is one pins all resources on the page with Subresource Integrity hashes and signs the page. The extension verifies the signature matches before rendering anything.

<comment><USER6> Neat! I haven't audited it but a quick look through the README suggests the approach is sound.

<comment><USER8> Too bad there is nothing like that built into browsers directly. I guess not only security related webapps could take advantage of it.

</comment></comment></comment></comment></comment></comment><comment><USER9> I was silly enough to sign up without looking in to it because it was recommended on HN. Then I realised they need this bridge software to connect. I asked about it stating I'd like to build it my self and confirm it is libre software. They just sent back a generic link to a .deb beta file. I had a look and its got this eula.txt with the standard you-have-no-rights. Messaged them again asking what they intended to do license-wise and they ignored me. Someone else has written their own bridge and put it on github but it's a bit of a joke to have to do that. Not sure what to move to now, mailbox.org was another I saw recommended.

My email history: \- gmail.com > US spying, escape. \- lavabit.com > Shutdown due to US government legal attack. \- Ran my own server > Too much bother, gave up. \- openmailbox.org > Died for months, ran away with my money. \- protonmail.com > Sketchy, cancelling it now. \- Free mailbox.org with custom domain.

<comment><USER10> Seconded. Anyone know of a good email workflow? Rolling your own server no longer seems practical. From what I have read most email providers now simply blacklist the email address of an email from sent from a non-major email service.

<comment><USER11> Use your isp for emailing out and receive email on your own server.

</comment></comment></comment><comment><USER12> Love ProtonMail. Over the past few years I've slowly switched more and more of my usage onto it as my confidence in the service grows. Gmail now occupies a similar niche as Facebook in my life, where I keep a vestigial & largely empty account for those few organizations which still insist on proprietary apps (Google groups/docs, Facebook groups/chats) for organization.

</comment><comment><USER13> Off topic

I had a proton email created when it was announced & didn't use it. I found out that my mailbox decryption for that email id is not working (not sure how, I use password manager) & I haven't set a recovery email to recover my account.

I saw a HN comment earlier telling, the user had recovered their Proton mail account by answering few questions to customer service.

I attempted the same, the issue is that I used VPN to create the email id & didn't provide any personal details for the account.

They asked questions like,

-Do you remember the exact time and date when your account was created? -When was the last time you have accessed your account? -What is your display name? -Do you remember to which addresses you have sent your last messages? -Do you remember the email subjects of the last sent messages?

I tried to answer the account creation date by using the date of password creation in my password manager (the login password was working); but the support didn't seem to buy it.

They were insistent on,

-Can you please tell us if you remember from which addresses have you received your last few messages? -Could you tell us if you have used the ProtonMail account to sign up for some other web services?

I told them, I don't remember receiving email from anyone else & I didn't sign up for any service

-There is a service that the email@example.com address has been used to sign up for. Can you please tell us what that service is?

I told them again that I didn't sign up for any service using that email id.

\- Can you tell us the full address below?

email@example.com

Even though I could obviously guess the username of that email id. I told them that I didn't sign up with such service, that it must be a spam mail sent by some service.

They said,

\- If you have not signed up for this service, the account probably belongs to someone else.

Then I typed 'firstname.lastname@example.com' on Google Search, the instant results gave 'email@example.com' as the first result.

I sent them,

Hey sorry, I remembered the service. I did signed up for Dropbox & used the account for a while.

The email id you asked was,

firstname.lastname@example.com

They reset the account & I got access to it.

Edit: Had to fix the xxxxx.

<comment><USER14> This would worry me more than drama about one algo choice over another. Encrypting the data at rest (even it's not perfect) is probably better than letting it sit around in plain text.

OTOH account hijacking is a well documented[1][2] threat.

I don't like the idea that if I set up a secure password and 2FA someone could call up Protonmail and go " _Uh yeah, I use, uh... Hulu? Reset my password please!_ "

[1] [https://www.ftc.gov/news- events/blogs/techftc/2016/06/your-m...](https://www.ftc.gov/news- events/blogs/techftc/2016/06/your-mobile-phone-account-could-be-hijacked- identity-thief)

[2] [https://www.engadget.com/2016/06/10/hacker-hijacks-deray- by-...](https://www.engadget.com/2016/06/10/hacker-hijacks-deray-by- redirecting-his-verizon-phone-number/)

<comment><USER13> It's a valid concern, though in my case there's no other means to check the ownership albeit being flawed one; note that me having a valid login password/ or not doesn't seem have any impact on me recovering the password as I contacted them using web form support.

<comment><USER14> Oh, you're on a free account?

So you think it'd be stronger protected if you're paying due to probably having a CC etc tied?

<comment><USER15> You'd think, right?

AWS doesn't even consider you the account owner despite you holding the credit card that they bill for that account.

[https://news.ycombinator.com/item?id=19574672](https://news.ycombinator.com/item?id=19574672)

Our industry is such a shitshow in some massive ways.

</comment></comment></comment></comment></comment><comment><USER16> Anyone using ProtonMail regularly? I created an account but haven't used it much.

How are your experiences? Any iOS users who can comment on their experience with proton mail and the default mail client?

I don't went to switch to something that won't be around in a decade or so.

<comment><USER17> One major issue with the iOS client is that it cannot handle more than one Inbox. So, if you use two accounts (e.g. home and work), you can only be logged in in one at a time, and have to go through the full sign-in-sign-out process each time you want to switch. And my understanding is that the iOS app doesn't actually cache email offline, so it's not terribly possible to work on an airplane, etc.

Also, understand that due to the encrypted nature, you can't just point an IMAP client at their servers. They offer separate software to serve as a bridge, but it's complicated. So, you are _only_ using their web interface. They don't offer a native app for OS X, even. So again, no offline mail processing.

I recently put serious thought into moving my personal and business presences to PM to support the idea and normalize serious encryption, but ultimately felt like my need of the security it provides doesn't justify the complexity and UX compromises it forces. But ymmv.

<comment><USER13> Same with Android, only one account in free version. But I think when switched to pro, one can use more than 1 proton mail account in their app.

<comment><USER17> My understanding is that this isn't a free/pro distinction, but a "Feature on the Roadmap". But I'd be delighted to find out I'm wrong.

<comment><USER13> I stand corrected[1], premium users can 'Combine multiple accounts into 1 account'.

[1]:[https://protonmail.com/support/knowledge-base/combine- accoun...](https://protonmail.com/support/knowledge-base/combine-accounts/)

<comment><USER17> Yep, that's fine, but it's not much of a firewall. And unless I'm mis-reading this, this doesn't allow you to combine multiple domains.

<comment><USER18> I've setup multiple domains on the same Protonmail account. You can create new addresses (@protonmail.ch/protonmail.com/pm.me/domain) with a paid account (iirc up to 5 total addresses with Protonmail Plus).

</comment></comment></comment></comment></comment></comment></comment><comment><USER19> As a PM customer of almost a year, I'd definitely say they should focus more efforts on the UI/UX as opposed to advancing the crypto for now. What's the point of having the world's most cryptologically advanced, unusable inbox. Specifically conversation threading/nesting. I don't expect everyone to be as streamlined as say a Gmail, but basic "1 conversation - 1 email" in the inbox would be nice for starters.

<comment><USER20> I really really really like thier conversation threading. Because I get so many recurring transactional emails (eg bank statements, auto pay, etc) it makes it very easy for me to view ALL of these in one thread, and not take up a lot of space in my inbox.

Honestly I wish other providers would give me this sort of 'transactional email' conversation tie up because it's convienent. I can see in the last 12 months for example, I have always paid my gas bill on time, at a glance too!

</comment></comment><comment><USER21> While I appreciate advances in cryptography, I would rather protonmail work on things like getting their bridge returning properly formatted IMAP responses[1] so we can use whatever clients we want with it.

The mobile experience is fine, but desktop is brutal unless you happen to prefer one of the few clients they support.

[1] [https://github.com/Foundry376/Mailspring/issues/429](https://github.com/Foundry376/Mailspring/issues/429)

</comment><comment><USER22> I like protonmail and will likely move my domains to it. I don't use it for regular social, dating, or sales emails because it is a privacy brand that creates cognitive friction with people who don't get privacy and security.

If I wanted to grow protonmail, I would emphasize users moving domains to it because while the brand has exceptional trustworthiness, anything security and privacy themed runs into the "tacti-cool," problem, where even if it's the best available and used by real operators, it triggers peoples sense of illegitimacy, and depends with users who identify with a "rebel," e.g. "losing" team who are not attractive to other users.

IMO, the same problem killed Silent Circle, and the rest of the cryptophone market.

When you look at who overcame the tacti-cool problem in security and privacy, the way a brand like arcteryx did it in clothing, Apple's iPhone has done it in hardware, WhatsApp did it for messengers, and protonmail is _just_ on the cusp of it.

There is an opportunity to build a new privacy brand that would be as big as a FAANG, and if I were running it, I'd fold protonmail into it.

</comment><comment><USER23> To answer everyone here, I've been using ProtonMail for 6 months now (and protonvpn) and I love it. The iOS app is great, the web view could be improved but isn't bad.

</comment><comment><USER24> Slightly OT, but I didn't see an important question being asked:

What is the motivating threat model of ProtonMail?

If I just want to access my email securely, that's done by HTTPS. If I want an end-to-end encrypted solution, ProtonMail can provide that, though only for emails between ProtonMail users. For e2e outside of ProtonMail, I can use PGP.

From what I understand, ProtonMail makes all the PGP stuff easier by baking it into their UI. Is there anything else it offers other than this convenience? Are they encrypting incoming mail with recipient keys and throwing away the original? If so, who is that protecting, and against whom? Presumably the plaintext was stored by the sender and possibly seen by intermediary servers. Can I get similar security properties by periodically downloading my email and deleting it off the server (assuming the deletion is actually happening)?

These are honest questions. I admit I'm skeptical of PM's utility, but I'd this fits someone's usecase and threat model, I can't argue with that.

<comment><USER25> I'm using ProtonMail because I'm trying to de-Google-Amazon-Facebook my life somewhat as another user mentions. I'm tired of being the product and am willing to pay for certain things.

<comment><USER24> So why ProtonMail over any other email provider, besides GMail? Would you be willing to pay for email?

</comment></comment></comment><comment><USER26> I quit ProtonMail / ProtonVPN after trying over and over and over again to import mail through their IMAP bridge. They won't provide an open API for interacting with their mail services so someone can write a better bridge, and their bridge is very slow, disconnects repeatedly, and basically makes any migrations impossible. If you're willing to start over with an empty mailbox, maybe ProtonMail is for you. I eventually gave up trying to move my mail account in (many tries, with Thunderbird in chunks, with Lamiral's awesome imapsync tool, you name it), and let them keep the money I paid for a year of ProtonMail Visionary.

I ended up using StartMail from the StartPage people. It's not perfect, but I was actually able to migrate to it and use it effectively.

</comment><comment><USER27> Unsolicited opinion on ProtonMail: I'm a big fan. It's not as flashy as gmail, but so far my mails haven't been marked as spam, which was happening with zoho. Unfortunately, zoho doesn't provide free email forwarding, so the migration to PM is taking longer than hoped for.

I'll probably soon subscribe to PM for two reasons: to use the @pm.me domain for outgoing (currently only incoming), and for custom domain support. Also subscribing gets IMAP support (I think).

<comment><USER28> Note that IMAP support is only through a bridge software that you have to install and configure.

</comment></comment><comment><USER29> This gets asked often, but as someone wanting to get away from Gmail, any thoughts on Fastmail vs. ProtonMail?

<comment><USER30> They represent vastly different philosophies. Fastmail is direct alternative to Gmail with good UI and UX but they're based in Australia and against message encryption as it impacts their UX (for example it's not possible to index encrypted messages). Protonmail is an OpenPGP company (they directly invest in OpenPGP.js) but have issues supporting other standards. For example IMAP/SMTP is available only through a bridge.

<comment><USER31> They're based in Aus, but their servers are in the US (which is why I decided against switching from GMail to them in the end, and picked someone a little more local).

<comment><USER32> That means their servers cannot be directly accessed but since they're based in Australia the company can be compelled to install decryption software without notifying anyone.

Source: [https://www.youtube.com/watch?v=eW-OMR- iWOE](https://www.youtube.com/watch?v=eW-OMR-iWOE)

</comment></comment></comment></comment><comment><USER33> I tried proton with my own domain... its a hasle, and how about address book sync and calendar?

</comment><comment><USER34> does it matter if its traffic is routed through counties with a history of breaching privacy?</comment>


Show HN: A Chrome extension for more relevant Swift search results from Google - <AUTHOR> https://chrome.google.com/webstore/detail/untaylored-search/jimacabmlffpbpbmnebmkpfpookmffjj

<comment><AUTHOR> It's a pretty simple extension that just appends a bunch of negative keywords to a Swift search. I built it out of frustration with how often Taylor Swift showed up in my Google search results. Welcoming feedback!</comment>


Auto-rotating buttons on HTC Incredible S - <AUTHOR> http://www.engadget.com/2011/02/18/htc-incredible-s-auto-rotating-buttons-explained-video/

<comment><USER2> Its a nice to have on a device, but a 90 degree rotate for the icon wont make me go "ooooh, that was the home button, not the back button". I think I could understand that the button on the left will always be home, even when I flip my phone to landscape mode.

Now one thing that would have been cooler would be to allow users to remap the keys. So many android phones are fragmented in their button placement. On my Droid X I know the menu button is on the far left. I dont even look, I know its there so I click without looking. If I owned this phone I can see myself accidentally always going to home if I thought I was hitting the menu button within an app.</comment>


Google penalizes original content site because of scrapers - <AUTHOR> http://www.seobook.com/no-adwords-soup <comment><USER3> Google's latest algorithmic changes seem to be either horribly wrong or not fully baked.

Our site went from ranking #8 for our target search "artist websites" to PAGE 440 of the results. Our listing for "how to sell art" just went away. There's been nothing but original content on our site for 10 years, and, among artists, we're considered one of the best sources of art marketing information, given that I owned an art gallery for 20 years and all of our other writers are professional artists. (and yet Google still has _ehow_ ranked for "how to sell art".....yeah, I'm sure ehow knows a _whole_ lot more than we do).

I'm saying this not to vent, but to concur with Aaron and others that there is something wrong. It may not hurt Google's business....the latest algorithm's probably improve adsense revenue, and that's fine, it's their business. Fortunately I've read HN long enough to know not to build my entire company on top of someone else's platform and, as much as it upsets me, we don't need Google. Bing (and Yahoo) have us at #3 for that same search ("artist websites"). We don't depend on search engines as our only source of marketing leads....nor even our main source.

The most frustrating thing is not even that it happens, but that they do not communicate. There's no way to find out WHAT happened. Nothing in Webmaster Tools. No way to pay for search support. I read the Google blog post with guidelines on how to structure content after Panda and, none of that applied to us, at least not that I could tell.

They say "just focus on users" and that's what we do, but I guess, that's BS.

I, frankly, think Google's gotten to big for their britches and as unlikely as it is to happen, I hope Bing, Blekko and yes, DuckDuckGo take some market share away. Windows is better for having OSX and Linux to compete with. Maybe Google would be a bit less "evil" with more competition too.

Sorry for the bit of the rant, I'm usually only a lurker here, but this article of Aaron's really hit close to home this week. At least there are a couple of relevant points buried in my little rant....I hope ;-)

<comment><USER4> >the latest algorithm's probably improve adsense revenue, and that's fine, it's their business

There's no reason to jump to that conclusion. We don't make ranking changes to improve adsense revenue, and don't use it as a metric to evaluate ranking algorithms. We don't even have a mechanism to collect the data.

<comment><USER3> Thank you for replying, thank you for clarifying that. My question is since we've followed Google guidelines for 10 years, never intentionally engaged in any practices against Google's recommendations, are already doing the suggestions outlined in the most recent Google blog post on this subject, yet have, for some reason lost all of our rankings completely and are being outranked by known content farms and sites with adsense, what should we do?

I realize you can't guarantee any results, but honestly, we really have absolutely no clue what to do next. Every change we've made to our site in the past 2 years has been to try to do everything we read that Google wants from official Google channels. We truly just don't know what else to do.

Edit to add: we did 3 months ago change from a very long domain name to a short one (faso.com) because it is shorter and we own a federal trademark on the word "FASO" and thought that Google wanted to place more emphasis on brands - our rankings stayed the same and even improved....until Monday.

</comment></comment></comment><comment><USER5> Just like the anti-content farm blog posts previously, I'm half hoping that the internet community turns its attention to the problem of content scrapers (in the hope that Google take more action against the problem). I am a fan of Google - and the biggest source of traffic to my websites is Google search traffic - although the issue of scrapers does seem to be growing (even despite the attempted anti-scraper Google algorithm update earlier in the year).

A couple of days ago I did some searching online and found that a fair number of websites had copied some of my articles in their entirety. And sadly, a lot of these 'websites' were actually Google Blogger (Blogspot) blogs. And whilst some of these copied articles weren't appearing in Google search (I guess since the entire site contained copied/scraped content, thus giving them a Google SERP penalty?), some of the copied articles were appearing in the SERPs. And a couple of these websites even had Google AdSense on them.

So there was the crazy situation whereby my content had been stolen/scraped illegally, and put on a Google Blogger blog with Google Ads on it, and (in some cases) that blog then received traffic from Google Search. Hrmph.

In the interest of balance, I will point out that I filed Google DMCA requests after finding these scraped articles, and Google did promptly reply (a non- automated reply around 30 hours later, which is quick considering how many DMCAs Google must get).

They only removed the individual blog post (and not the blogs overall, even though they were clearly spam blogs), but nonetheless I am happy with Google's quick response.

I just wish that content scraping isn't (in some cases) a profitable endeavor..

</comment><comment><USER4> The headline is factually inaccurate. It looks like a mistake that he was denied access to Adwords due to original content, but that has no connection to his ranking in search. It looks like the adwords representative may not have access to fine-grained enough tools to assess the site accurately, which is an organizational failing, but there's no bad intent there. In some sense it reflects how disconnected search and ads are from each other that they're using crude tools to assess original content.

Google cares a great deal about putting the original source of a piece of content first. If we're doing that incorrectly, it's because we screwed up, not because that's how things are designed. It's a hard problem and an area we are still working on intensely. It would be great if someone involved could post the queries on which we are screwing up so we can debug what's causing it.

<comment><USER6> You don't seem to have read the article.

The search:

["a superb app for iPad and iPhone that lets you quickly and easily transfer photos and videos between iOS devices and computers – has been updated this week, to Version 2.3."]

returned results from content scrapers above the original content.

For me, the original content doesn't even show up in search results, even though it's in Google's index:

[http://ipadinsight.com/ipad-apps/photo-transfer-app- updateda...](http://ipadinsight.com/ipad-apps/photo-transfer-app-updatedadds- ability-to-transfer-photos-and-videos-in-the-background)

Further, Google wouldn't let the site owner buy AdWords to drive traffic to their site.

Google owns both search and AdWords. This makes the headline here:

      Google penalizes original content site because of scrapers

accurate, as far as I'm concerned.

<comment><USER4> The results for that query are horrible, but his complaint about losing traffic certainly isn't due to his ranking on 30-word quoted queries. I'm hoping to get an example of a normal query where he's losing out to scrapers so we can debug what's going on.

The headline implies that he's penalized in search due to scrapers, which isn't happening.

<comment><USER7> > The headline implies that he's penalized in search due to scrapers, which > isn't happening.

In this case the phrase "Google penalizes" = "Google denies access to adwords". The word _penalize_ doesn't always refer to site penalties in the Google search index.

<comment><USER4> The reason it's on top of HN is almost certainly because that's the conclusion everyone jumped to. That seems to be how the word "penalize" is consistently used with respect to Google.

<comment><USER7> I agree, I am a bit surprised this is on the frontpage. What is ironic though, is than now when I search for the 30 word phrase, two scraper sites appear with the article scraped from seobook.com. ...nicely backdated by 37 seconds.

</comment></comment></comment></comment></comment></comment><comment><USER8> Is Google doing anything to solve the content duplication problem?

It seems like a solvable problem. Why don't they let webmasters implement some kind of time-based cryptographic signature?

It seems so lame that his problem has gone on so long, especially when there must be some kind of technical solution.

For real businesses spending a few days implementing some authentication protocol would not be particularly burdensome.

<comment><USER9> I'm guessing a lot of it has to do with determining where the content originated. Google will crawl sites at different times of the day. If site B stole content from site A but Google came to site B first, how are they supposed to know that the content originated on site A? I'm sure there's certain things they look at like PR, trust signals, etc. to determine if the content on site B could have been copied, but it can't possibly be perfect. The time based signature sounds good in theory but implementing it across billions of pages would be very difficult. Not only that, but what if site A didn't create a signature but site B did when taking site A's content? I don't think there's an easy solution to this problem.

<comment><USER10> I don't know if it's an easy fixer but it's certainly not difficult to eliminate 90% of scrapers. My sites get scraped all the time and if you look at these scrapper sites, they usually are not scrapping just one site. To simplify the issue, let's look a small data set:

      Site 1:
        * Content ABC
        * Content DEF
        * Content GHI

      Site 2:
        * Content JKL
        * Content MNO
        * Content PQR

      Site 3:
        * Content STU
        * Content VWX
        * Content YZ0

      Site 4:
        * Content ABC
        * Content DEF
        * Content MNO
        * Content PQR
        * Content STU

Which of these is a scrapper?

<comment><USER11> The scraper is the one where the content appeared last.

<comment><USER12> How do you perform that measurement using practically bounded computing and networking resources?

</comment></comment></comment></comment></comment><comment><USER13> Here's a simple idea that could fix a lot of this problem. Copy Twitters idea of verified accounts.

Google could issue verified sites. If someone copied a verified site the content would be automatically removed from the index.

Now they would have to hire some staffers to research the applications and handle complaints. But this is beginning to cost them far more than adding a few more staffers.

<comment><USER14> While certainly a potential fix, Google seems very averse to non-algorithmic solutions (see their issues with customer support).

</comment></comment><comment><USER15> I'm sure this is a _gross_ oversimplification, but Google is in the business of monetizing people's interest in content it doesn't create. Who will it perceive is the better partner for that monetization, the scraper who understands how to apply Google's tools to maximize monetization, or the original content author?

<comment><USER16> Umm, wasn't Google supposed to "Don't be evil" and care about their search result quality about all else? I find your defense of and apathy to hypocrisy disturbing.

And oh, your post pushed a hot button of mine: comments by people who think they're being incredibly insightful by saying "the world is not fair" in different ways. On HN, I think we can assume that people are adults and understand such things. Sorry about the flame.

<comment><USER17> "Umm, wasn't Google supposed to "Don't be evil" and care about their search result quality about all else?"

Mmmm... no, unfortunately Google is supposed to make money, and they make money mainly from adsense. I'm not prepared to accept that random algo modifications having big impact on their revenue are done without concerns.

And when you are at the same time the same company driving people to web sites (search) and getting profits from ads showed in web pages (adsense) something bad can happen as it is not a free market setup.

<comment><USER4> >I'm not prepared to accept that random algo modifications having big impact on their revenue are done without concerns.

The effect on adsense revenue isn't even _measured_ let alone used. The people who make decisions about changes to ranking algorithms don't even _see_ the data on adsense revenue because we don't even have a system to _collect_ it for ranking changes.

I work in search quality, and there are many metrics I have to collect to launch changes. None of them involve ads.

<comment><USER17> I'm glad to hear that, and I trust you. If it is this way I expect to find less spam engines or copied content in the next months when I search on google :)

</comment></comment></comment></comment></comment><comment><USER18> I'm the guy whose site this is all about - iPadInsight.com. I only used that specific search in the forum thread because I discovered that was the single point on which the Adwords reviewer had judged that my site didn't produce original content. I sent back the results of the same search showing that links were either from legit aggregator sites (like alltop.com) linking back to my original review, or from a number of scraper sites that rip my content. Even when the review was overturned for Adwords I was told it would leave a black mark against my site because it had already been marked that way. Great system.

Soon after all that hassle, my site suddenly lost 60% of its traffic. From what I can gather, mine is one of the quality sites that produce original content that has been mistakenly penalized in the Panda / Farmer / Whichever Other updates.

Among the reasons I say my site is a quality site that produces original content, in accordance with this post at the Google Webmaster Central Blog ([http://googlewebmastercentral.blogspot.com/2011/05/more- guid...](http://googlewebmastercentral.blogspot.com/2011/05/more-guidance-on- building-high-quality.html)) and with all the logic I can apply to the subject, are:

\-- The site contains over 1,700 posts published in the last 15 months. I wrote around 1,550 of them myself. The remainder are written by three other occasional authors, who are colleagues and friends of mine. There's no 'outsourcing' of content creation or anything of that ilk.

\-- I spend tons of hours every day researching and writing the content that appears on my site. Every app review on the site is 100% original content (<http://ipadinsight.com/category/ipad-app-reviews>), as are all posts published.

\-- I do consider myself an expert on the subject my site covers - the iPad. I have been writing app reviews,accessory reviews tips, how-to posts on it ever since it launched. I've appeared on ABC World News and numerous radio programs as an iPad and Apple expert. I've been a contributing author for iPhone and iPad Life magazine (printed publication) since their debut issue - <USER2> expert tips and tricks posts, buyer's guide articles, and more. I'm listed in Robert Scoble's Twitter list of best tech people to follow. Blue-chip app publishers and accessory vendors approach me to write about their products. The Daily (the first iPad only newspaper) contacted me before their app even hit the App Store, as do many leading publishers. I've been a beta tester for many top iOS apps for years. I participate regularly at several leading iPad and iOS forums. I'm not saying any of this to boast, but in an effort to establish that I'm a blogger who is enormously passionate about the subject I cover, and someone who is respected in the area (mobile tech) that I write on.

\-- My site is a long-standing member of the Got-OATS group of sites (<http://www.gotoats.org/>) that seek to uphold and promote the highest ethics in app reviews. We never accept money for reviews or coverage, and add disclosure statements to our reviews to indicate whether we received a promo code for an app reviewed, or a sample unit of an accessory reviewed.

\-- I spend a lot of time on every single post, on researching, on testing apps and whatever else I'm covering, on ensuring that spelling and grammar are spot-on, on providing good screencaps of apps in action, and every other detail I can think of.

\-- I use a great cache-ing plugin on my site and do my best, with help from a few Wordpress experts, to keep the site fast and clean.

\-- I currently have close to 4,500 RSS subscribers and over 3,000 Twitter followers for the site's account.

\-- Before my recent sudden traffic fall off a cliff due to Panda, my site had around 80-100,000 unique visitors per month.

As for search results and scraper sites, I am still often seeing horrendous spam sites ranking above me for recent posts. Here is just one quick example on a recent post I wrote about iPad rivals, where several scraper sites rank above mine, including one (ipads101.com) which I have submitted 3 spam reports on via Google Webmaster over the last two months, and had zero response:

[http://www.google.com/search?sourceid=chrome&ie=UTF-8...](http://www.google.com/search?sourceid=chrome&ie=UTF-8&q=ipad+rivals+the+year+of+the+clueless)

I run a good site. I pour hours of effort and my heart and soul into it. And I think it has been very wrongly assessed by whichever new algorithm.

<comment><USER4> I get your site #1 for that search. I suspect the scrapers are ranking above your site only when you search due to personalization (you've clicked on them in the past.) Try adding &pws=0 to your search to see if they still rank higher and I'll debug further.

This is a quite common problem actually when webmasters have reason to hate certain sites. They click on those sites in search results a lot and often see them promoted above their own, even though they're the only one who sees them promoted.

<comment><USER19> Searching for "ipad rivals the year of the clueless" with or without &pws=0 I get 5 scraper sights before ipadinsight.com/category/ipad-rivals-2:

1\. usedipadforsale.net/ipad-rivals-this-year-the-year-of-the-copycats-or-the- clueless.htm

2\. www.ipads101.com/ipad-rivals-this-year-the-year-of-the-copycats-or-the- clueless/

3\. ipads2nd.com/.../ipad-rivals-this-year-the-year-of-the-copycats-or-the- clueless/

4\. catsmakemebats.micasaessucasagermania.com/.../ipad-rivals-this-year-the- year-of-the-copycats-or-the-clueless/

5\. ipad.thedailyglobe.com/.../ipad-rivals-this-year-the-year-of-the-copycats- or- the-clueless/

6\. ipadinsight.com/category/ipad-rivals-2

That looks pretty bad to me.

<comment><USER20> For that query I get ipadinsight #1 in bing. The only other result from that list that shows up is the "usedipadforsale.net" as #5.

</comment></comment></comment></comment><comment><USER21> I believe Panda also looks at originality, content freshness, document authority, trust factors, usability factors, site authority etc.

I'd agree that the denying of Adsense was (obviously?) wrong, if this is all there is to the picture. As for looking at ipad information on the internet, after a manual inspection of that site, I, as a user that cares for quality and relevance, don't need any of the results on justanotheripadblog.com in my top 100.

The order of relevance, discovery and editorial quality seems to flow from:

<http://reviews.cnet.com/8301-19512_7-20023976-233.html>

>

[http://ipadinsight.com/ipad-tips-tricks/how-to-make- airprint...](http://ipadinsight.com/ipad-tips-tricks/how-to-make-airprint- work-with-just-about-any-printer/)

>

[http://www.info4arab.com/how-to-make-airprint-work-with- just...](http://www.info4arab.com/how-to-make-airprint-work-with-just-about- any-printer/)

With a lot of intermediate steps.

iPadInsight.com is not a cheap scraper site, but is it a site that does original research, beyond rehashing what is hot in the industry? I think Panda might have judged correctly in not assigning higher rankings to this site.

The site seems to have had a canonical problem with the comments in 2010, inflating the site size in index to * 10. The depth of these comments is usually not much more than: "Great! Interesting Article! Love this! Thank you!" and might just as well have been auto-generated.

Also the shareasale footerlink "Thesis Theme for WordPress" alone, might disqualify you for running Adsense, as you dofollow an affiliate link (and this is not allowed in the webmaster quality guidelines).

The trademark inside domain name might be another issue.

</comment><comment><USER22> The same thing happened to us as well. When I did an event last month our page rank dropped from 4 to 2 despite getting 12+ new links, which I strongly suspect is because all of the bloggers who link to our conference site are having their blogs duplicated by content farms. Overall our page rank has dropped from 7 to 2 in little over a year, despite having 10x more inbound links. (And zero SEO or anything else that would violate Google's best practices.)

I did ask a Google employee, who said it was because we weren't using canonical tags, but this doesn't make much sense and fixing this doesn't seem to have done anything to improve the situation.

<comment><USER23> The article above is about his problems getting an AdWords campaign approved, not about his ranking in search results.

<comment><USER24> Those problems are one and the same. He can't get an adwords campaign approved for the same reason his search results rank poorly, he's being scraped.

<comment><USER23> In the original post, he used a very specific query and his site was listed 2nd. Naturally the scrapers were also all over that results page, since they were all exact matches to the text. I didn't see anything about him complaining about poor search ranking ([http://www.google.com/support/forum/p/AdWords/thread?tid=0bb...](http://www.google.com/support/forum/p/AdWords/thread?tid=0bb4bb671eff7054&hl=en))

</comment></comment></comment></comment><comment><USER25> I don't understand the incentives for google to deny AdWords to someone. AdWords is what ultimately gives Google the profits, not AdSense. Google already has plenty of places for you to see ads, and AdWords is the product that actually takes money acquired through other industries and funnels it into Google.

I really don't think it's being done of malicious intent. I think it's very likely that it's just being done because of negligence, since service/app reviews happen to be frequently scraped.

<comment><USER26> The complaint is indeed about negligence, not malice.

Google puts some effort into making sure that (i) people aren't annoyed by ads directing them to content they didn't want, and (ii) the top ads are good quality and likely to have a good click-through rate. Ads that have a high quality score cost less to place for that reason, ads with a low quality score don't get placed, or get placed on the second page of ads.

</comment></comment><comment><USER27> Hell with Facebook's replacements; it's Google who needs a replacement! (Note: I am currently thinking about possible alternatives for PageRank.)</comment>


Performance Tuning Linux Instances on EC2 - <AUTHOR> http://www.brendangregg.com/blog/2015-03-03/performance-tuning-linux-instances-on-ec2.html

<comment><USER2> Brendan Gregg seems to have worked extensively on extracting maximum performance on all major UNIX kernels ( FreeBSD, Linux, Solaris ) out in the real world. If he writes an essay around performance of these kernels, I feel it will be very close to the true state of the affairs.

</comment><comment><USER3> Ironically, a swappiness of 0 may be detrimental to the health of software running on a VM, as it severely limits what may be swapped out of memory. This means that the OOM killer ends up being more aggressive against the processes on your system.

A better value is one of "2" \- this allows the Kernel to swap out data in response to memory pressure, without being overly aggressive about it.

<comment><USER4> EC2 instances are typically configured without swap at all.

</comment></comment><comment><USER5> Slideshare is very annoying, when you are trying to get the PDF.

First it tells you that you must sign-up sign-in with Linked-In or Facebook. Then after finding a non Linked-In or Facebook sign-up, I need to enter my phone-number to get a link as SMS.

 _SIGH_

</comment><comment><USER6> Note: there is some justification in the slides; the article itself just lists the "recommendations" outright.

(from the article)

> net.ipv4.tcp_tw_reuse = 1

(from the man page)

> Allow to reuse TIME_WAIT sockets for new connections when it is safe from > protocol viewpoint. It should not be changed without advice/request of > technical experts.

Why? Are sockets in TIME_WAIT a problem somehow?

> net.ipv4.ip_local_port_range = 10240 65535

Again, why? My understanding is that this controls the range of ports that the kernel selects from for new sockets; e.g., if you make a TCP connection to google.com on port 443, on _your side_ the connection is <your ip> : <a port from that range>; the default range is [32768, 61000], and this is per destination IP. (You can have two connections to two separate IPs with the same local port.) The default range is nearly 30k ports wide. Are you opening >30k connections to a single host?

> In the talk I described these tunables as our medicine cabinet, and to > "consider these best before 2015".

Does that not mean that these are expired now? (This article was written today, though?)

<comment><USER7> The problem is opening >30k connections to a single host during a TIME_WAIT period, 60 seconds. 500 connections per second. For backend servers, eg, an application server talking to a database, 500 connections per second is easy (although it's preferable if they can keep-alive).

I liked Vincent Bernat's post about TIME_WAIT: [http://vincent.bernat.im/en/blog/2014-tcp-time-wait-state- li...](http://vincent.bernat.im/en/blog/2014-tcp-time-wait-state-linux.html)

<comment><USER8> Could we say it a bit stronger than that? Opening and closing connections from the same source to the same service is wasteful since you need multiple extra round-trips and it resets all the TCP dynamic tuning like CWND.

I thought your talk was great; one minor niggle: you said that the result of too many sockets in TIME_WAIT would be dropped packets; it should refuse to open the new connection if no slots are available.

<comment><USER7> Yes, it's really wasteful to have unnecessary connect()/accept() calls, plus handshaking and buffer allocation, and TCP dynamic tuning, etc.

And you're right, thanks, TIME_WAIT full should just error on the Linux client. I was thinking of a different kernel which has bugs in this area, and ends up dropping SYNs...

</comment></comment></comment></comment><comment><USER9> I don't seem to see a mention of the file descriptor limit. As recently as last year the default on Ubuntu was 2048 iirc, which is laughable given that it was 2014.

I guess it's not strictly performance related, but should definitely be one of the first parameters to tune.

        # in in /etc/sysctl.conf:
        fs.file-max = 100000

        # then:
        sudo sysctl -p

        # in /etc/security/limits.conf

        * soft nofile 100000
        * hard nofile 100000

        # then:
        ulimit -n 100000

(tweak the exact number as required)

</comment><comment><USER10> I saw Brendan's talk live at re:Invent. Highly recommended.</comment>


Tips for Startup Companies - <AUTHOR> http://philip.greenspun.com/business/startup-tips/

<comment><USER2> That is quite a bit of sound advice.

Two of the items there hit on a favorite theme: closing feedback loops. A) understanding your customers through direct interaction, and B) hiring people with P&L focus.

Large companies tend to hire for obedience, willingness to conform to a plan, and ability to please one's boss. All of those things are dangerous in startup. Startups don't have a sustainable income stream, and just can't afford to carry too many people who don't pay attention to the essentials.</comment>


In Defense of Technology (2014) - <AUTHOR> http://tmagazine.blogs.nytimes.com/2014/11/05/andrew-ohagan-technology/?_r=0

<comment><USER2> I think what is missing from this conversation which both this article and people like Marc Andreesen forget is that technology isnt just progress its also change.

The thing is we are not all actual beneficiaries from technology. In fact a lot are victims who loose their jobs, get smaller paychecks and basically lost the ability to offer their skills to the workforce.

Technology gives and technology takes. What it takes is increasingly important to have a critical view on because something more fundamental is going on I think that is going to be increasingly clear.

<comment><USER3> Technological change has destroyed industries and livelihoods in the past, but it also created more opportunities as it went. The anti-luddite argument is that there were more jobs made available to the people despite the heavy labour intensive work being disrupted.

These days though it might be different. An interesting extension to your point, and using your terminology, is that the rate of what technology 'takes' is possibly beginning to exceed the rate at which it 'gives'. Things might be changing too quickly for the market to adapt and ensure gainful employment to people.

<comment><USER2> Thats my point.

Look at these two graphs

[https://plot.ly/~BethS/8/job-growth-by-decade-in-the- united-...](https://plot.ly/~BethS/8/job-growth-by-decade-in-the-united- states/)

[http://www.technologyreview.com/sites/default/files/images/d...](http://www.technologyreview.com/sites/default/files/images/destroying.jobs_.chart1x910_0.jpg)

The more jobs created have been because of globalization not because technology creates more jobs. (My claim)

Furthermore the less money is being made even though production goes up (because of technology)

This is the problem we are facing and so I am simply not buying the luddite fallacy argument it is in itself a fallacy.

Another way to look at this is that technology replaces higher and higher levels of abstract thinking.

The horses that where replaced by cars didn't find new jobs.

</comment></comment></comment><comment><USER4> Your frame of reference is a bit off. To wit:

You say: "technology isn't just programs, [it is] also change... a lot [of people] are victims who lose their jobs..."

When in fact, the "victims" of this process aren't subject to the technology, qua technology (technology is simply a tool - derivative of the Greek "tekhne" for "art" or "craft"), which is to say, one doesn't create a technology which then has a mind of its own (yet), but rather, they create tools that other individuals then have a _choice_ to either use, or not.

And so when you say "technology gives[,] and technology takes," what you really mean is "people chose how to spend their [time/money], and [those choices have consequences]."

Which is to say that you are implicitly saying "We ought to decide how people chose to spend their [time/money]".

Would your reaction be the same to the ironworker who made a living on horseshoes two hundred years ago?

Of what do you wish to be "Critical"? Of choice? Of giving people the ability to spend less of their time and energy on certain tasks?

Five hundred years ago human beings spend most of their time producing life- sustaining staples -- growing what for bread, chickens and cows and hogs for protein, vegetables for vitamins and nutrients. Now we can buy a week's worth of sustenance (which used to quite literally consume 12 hours of labor per day), grown to higher standards, in greater quantity for less than $50 -- the equivalent of a single day's labor at minimum wage.

Do you wish to be "critical" of this tekhne as well?

<comment><USER2> The factory worker does not have a choice about whether his employer want to use robots or not.

You are proving my point by applying the very flawed logic of the luddite fallacy that I am really critiquing.

</comment></comment><comment><USER5> Technology for me will ultimately be judged by the degree in which it's use requires the commodification of my self. From my taste in entertainment to more invasive information such as my location and who I interact with, I feel it's important to put into consideration who I'm trading this information with and for what in exchange.

As long as a service requires my submission into an database which will be sold off and used to strengthen marketing and other forms of persuasion, I have no choice but to assume the worst case usage. With that assumption I feel it is most ethical to mostly not participate.

I hope that I'll be able to sit back and hop on when popular tech services have given me an alternative form of payment other than my person as an information commodity. I have no idea as to whether that day will ever come.</comment>


Ask HN: Feeling Lonely - <AUTHOR>

I have been feeling pretty lonely for the last couple of weeks. My job is contract python work so I stay home all day. I don't really have close friends. The last time I went out with friends was weeks ago. I barely have any communication with others online. I always seem to never have anything to talk about and have trouble keeping a conversation flowing.
I am getting worse at being motivated to do any work, so simple tasks take hours to do. I used to love programming on personal projects but the last time I worked on a personal project was nearly a month ago.
I am 20 and still live with my parents but don't talk to them much, they are restrictive parents. I am a college student on a long holiday.
So, I am not in a super depressing position, but I am not having that much fun either. I would like to be more social to not feel lonely. <comment><USER2> Sounds like you're in a rut and burnt out. If you get to the stage that you're experiencing extreme apathy or dark thoughts then definitely call a help line and get some free counseling.

Assuming that you're not depressed but just in a rut here are some things that work for me but your mileage may vary:

\- go outside. Go for a walk or a hike in nature.

\- invite friends over and cook them dinner. While youre cooking as them about their lives and how they are going. Be interested in how they really are. Once you do that, communication will start flowing.

\- block your work up. You could try the Pomodoro technique etc. take blocks of time to relax too.

\- get some exercise.

\- ask your parents about what it was like growing up for them. You may get a deeper understanding of why they are restrictive.

\- get your friend to set you up on a blind date.

\- write a page of free form stream of conscious every morning for a week. First thing when you get up. At the end of the week read them.

Good luck buddy

</comment><comment><USER3> Work from a café.

When I feel that I'm getting bored of coding all day I go to a local Café with my laptop and using my smartphones 3G connection shared on wifi to the laptop. Works great for looking up docs and googling a question if the Cafe dsn't have free Wifi. I'm working from a cafe 2 times a week about 3 hours each time.

\----

Go to the Gym, even if it's not your thing.

When I started going to the gym i definitely felt lost, the big guy where lifting way more than me and I wasn't very sure what exercises I should do. But just going to the gym, doing some basic exercises and looking at others in the gym thought me a lot and now I really like it. It does also have benefits such as feeling better afterwards and making you look more attractive, which is a huge boost for your self-estime.

\----

Help others.

Jump on IRC or the mailing-list for your niche and help others when you feel you want to do other things other than work. This not only gives you the pleasure of helping others with your skills, it's also a great place to find gigs.

\----

Contribute to an opensource project.

Find an open-source project that you are using and understands how it works, look up what reported issues the project have and try to solve them. If you can't find a solution for any of the issues start with the documentation, every project needs better documentation and it's not a very hard task to write if you understand how the code works. The benefits are same as helping others really.

</comment><comment><USER4> If you have a car, drive to a different coffee shop or café everyday (like Starbucks, Barnes and Noble, Peet's, whatever) and work from there. Spend a few hours there and in the process, try to meet some new people. Talk to them about anything and I guarantee you'll find some way to connect.

In the weekends, there are lots of places (especially if you live in a decently populated city) where people go to to spend time with other people. If you find one of these places (just google it, basically), there's almost always musicians (e.g. Jazz Saxophonists) playing some laid-back music, and tons of people having a great time. Merely being present in a place like that is enough to make you not feel lonely. Your situation might differ but I doubt it would hurt to try these and some of the other ideas other HNers presented.

</comment><comment><USER5> Don't feel bad about not being able to make small talk, like everything its not for everyone. I can't honestly maintain it either. Social skills are what they seem to be; skills. Like other skills they take time and effort to develop, but if you work and stay committed to them and the people you like it will pay off. I think finding a casual/social hobby is a good idea (like the other guy said) too. All of my close friendships are based on a common insterest that we can discuss or do together. Taking an interest in people is key too, not to be confused with seeming to take an interest. People appreciate your legitimate appreciation of them, and they know when you've made them a real priority or when you make real sacrofices for them. Whatever happens don't give up. I've been at the point multiple times when I literally had 1 friend, who wasn't very close to me, and trust me you can always come back if you stay positive and actually like people. Be happy, its worth the effort, and because you CAN do it!

</comment><comment><USER6> If you are religiously inclined, joining a church/synagogue can have a profound effect on your social life. I met my fiancee at church, and some of my deepest friendships are with people from my congregation. Also, you'll meet people with interests and backgrounds that are much different from your own, which I find enriching.

</comment><comment><USER7> All of the suggestions in the thread are great. I have been in a similar position to you and I can say from experience that working in a public place really helped alleviate the pangs of loneliness. I even made a friend because I brought a book along with me to the coffee shop and it happened to be her favorite author (Thomas Pynchon for those curious).

The key is to step away from the computer and realize that it isn't what life is all about. There is so much beauty and wonder in the world that simply cannot be replicated on a screen.

P.s. If you want someone to talk to about Python or books or the future or girls or boys or dreams, please send me an email. I too am working a remote Python job from home on a long winter break so some company would be appreciated! If you are around NYC I'd even grab a coffee or something.

</comment><comment><USER8> Working from home is lonely; that's just the way it is. Motivation can be easier to come by if you find somewhere else to work sometimes, like a library or cafe. When I was at my greatest depths of despair from living in a new city with no nearby friends and working long hours from home, I found that I could escape if I started attending events in the local entrepreneur community. Just do something...anything to get away from working at home with nobody around. Even a little interaction goes a long way, and being good at conversation takes practice.

I would also suggest surrounding yourself with as much outdoor greenery as you can (time of year permitting). It's really therapeutic.

<comment><AUTHOR> Thank you. I have been wanting to work outside for a while but never got around to it and didn't really know where I would go but I guess almost anywhere is better then my room.

</comment></comment><comment><USER9> Since you are into programming, have you ever considered finding a local hacker lab to attend and meet new people with like interests?

[https://www.google.com/webhp?sourceid=chrome- instant&rlz...](https://www.google.com/webhp?sourceid=chrome- instant&rlz=1C1CHFX_enUS438US438&ion=1&ie=UTF-8#hl=en&tbo=d&rlz=1C1CHFX_enUS438US438&output=search&sclient=psy- ab&q=jack%20lab%20meetups&oq=&gs_l=&pbx=1&qscrl=1&fp=99bbb1d5e9938d35&ion=1&bav=on.2,or.r_gc.r_pw.r_qf.&bvm=bv.41229759,d.cGE&biw=1280&bih=620)

If there aren't any in your area, start your own meet up. You can do it at a local coffee shop and take it from there. I am sure you are not the only one in your situation. Give a try!

I was in a similar situation and I found a local group. Best decision I ever made. Got to hang out with people, have lunch, dinner drinks and made a lot of new friends and potential business partners. Good luck!

</comment><comment><USER10> I was feeling very similarly recently and have been trying to get out of the rut. I found user groups to actually be very helpful. Are there any around you? (Where do you live?)

I actually just posted my experience on this here: <http://news.ycombinator.com/item?id=5066944>

</comment><comment><USER11> The current answers seem good, but I wonder why you work? Or perhaps: why work so much?

You're pretty young and your parents are supporting you, at least providing housing, which is pretty nice. I'd tackle some of those personal projects you enjoy, and travel (at the very least, explore your own city), and learn to do some new stuff (learn Latin and read Cicero, practice a musical instrument, learn how to bind books, build a tube amplifier, other stuff we never have time to do 'cause working for rent/mortgage gets in the way). Go to the library (w/o a laptop) and sit and read, a lot.

I so wish I were young again...

And yeah, talk to your parents, being sure to let them do lots of the talking.

</comment><comment><USER12> Great suggestions by djt.

I found myself in a similar space a few years back and these are the three things that brought me out of my rut:

1-I joined a martial arts club. The Aikido community is generally a welcoming group and most dojos have classes 5 - 7 days a week. 2-Wrote brief entries in a journal. 3-Sought out cultural experiences/events that I wouldn't normally attend. Oh and 4-, actually, outside time. Even in the winter. Even a 15 minute walk. The ol' gray matter really likes to hit the trails, or even the pavement.

Just make one change to your routine today and that sense of your own agency can build momentum.

<comment><USER13> it has been 4 months since I applied this, joined a Karate club , writing my experience on an anonymous blog ,go meeting new people ,I start learning languages and I got many certificates,but at the end it still don't work for me , I'm in a great despair , I still feel empty inside ,I simply don't enjoy life anymore,since going out is not really working (I think its a waste of time) I spend all the days at home working(programming) or playing video games, my relations with people is still not very deep , I call some friends ones a week and we meet for 2 or 3 hours , still don't enjoy going out with them . by the way I'm not depressed , I was depressed in the past years , but the doctor says that I'm fine now , may be when he tries it , it would work for him who knows .

</comment></comment><comment><USER14> Let me second the suggestion to go outdoors and explore nature. Hiking's good. If you're north enough, and if you haven't already, take up x-country skiing. Lessons from a good instructor are awesome!

An instant mood makeover is to perform a good deed. Just because you can. Examples: Feed some pigeons. Free a rabbit caught in a snare. Drop by the local SPCA to pet some animals. And see if they could use a pair of hands for the day.

 _I don't really have close friends._

A close friend is like a priceless jewel. Guard 'em with your life.

</comment><comment><USER15> Exercise is always great. Expand your knowledge in other ways. Try acting in some amateur theater or go to cooking lessons. It is always good to meet other people who are interested in other stuff. Learn juggling. And if the situation is really hard and no one is around, this works often for me. <http://750words.com/> and the simple analysis it gives on the end feels like an awesome private conversation.

</comment><comment><USER16> Oh man, I also work from home and sometimes do feel lonely. So hey, shoot me an email (on profile) and we can talk about whatever. But dont worry. Shit like this happens to a _lot_ of people and it will get better. I'm also a python guy , by the way. Get in touch!

</comment><comment><USER17> Best thing I have found during times like that is going to a gym every day for a while (keeping it up after that is even better). You meet people, get out of the house, get stronger/healthier, feel better in general.

</comment><comment><USER18> I would suggest to go get some exercise, getting active and listening to good music gets the negative energy out of your body. If you're lonely at home chat with the guys in irc #startups.

</comment><comment><USER19> Yeah definitely take a week or so break. Get on a meetup from meetup.com and talk to others.

<comment><USER20> Seconding this! Meetup.com has been great for me. I've met some really cool people there. It doesn't have to be programming related, even. There are many different activities, so perhaps you could find a hobby that gives you a break from programming so you can go back to it with a fresh mind (biking, chess, atheist or religious groups, etc).

I hope you feel better soon.

<comment><AUTHOR> I just found some nice looking meetups that I would be interested in going to. What's it like just showing up to one?

<comment><USER20> A little awkward, but not too bad, even for an extremely introverted person like myself. Chances are the people who are there already were at one point in your shoes when they first attended. If you're nervous you can always post to/comment on some of the group's stuff, so that when you arrive you can be like "hi, I am username so-and-so" and they will be like, "oh, yeah! I saw your comment..." and so on. Not all groups are great, but my experience has overall been quite positive.

Also, it's pretty commonly understood that the site exists so that like minded people can find each other when they otherwise likely wouldn't have crossed paths, so it's a great way to make new friends (and/or social networks). If you still have some anxiety, I would suggest contacting the group admin and saying you're interested but a bit nervous about going to the first meeting. It does take a small amount of money each year to host the group, so the people in charge of it usually care enough to try to make people feel comfortable enough to come and keep coming. (I have a friend who runs a small meetup group for writers, and he's always extremely super thrilled when new people come out to it.)

</comment></comment></comment></comment><comment><USER21> I also work from home. I think the best way to stay social even working at home is to have internet chatting with friends!! I usually chat with two or three people while working at home. If you want, you can add me on gtalk.

</comment><comment><USER22> get a hobby where there is some kind of socialization. R/C flying/racing and amateur astronomy are some nice ones that come to mind right now... you could also find a hackerspace in your city.

</comment><comment><USER23> I think you should find a girlfriend. She will 'start your engine'

<comment><USER24> Please don't assume heterosexuality.

When I'm in a rut I grab a notepad, go for a walk and only let myself return after writing down 5 observations.

</comment></comment><comment><USER25> Go work in a public library or café(I prefer library), it`s good because you see people, move around and also get work done.

Besides that, you have to socialize, it`s absolutely imperative to escape depression, not decay your(apparently already low) social skills. Also, don't you communicate with your work friends?

Start an activity like a sport, dancing, painting, whatever, you'll meet new people doing this.

Working remotely is a great thing but you gotta enjoy it's advantages or this sort of stuff will bite you. When I did remote work I went through the same stuff, now I'm working "normal" and I feel it's my fault that I didn't enjoy it as I could and I wished I'd work remotely again.</comment>


9 Live Wallpapers to Make Your Macintosh Even More Beautiful - <AUTHOR> http://blog.smartbear.com/geek/9-live-wallpapers-to-make-your-macintosh-even-more-beautiful/ <comment><USER2> Does anyone know of something similar to Mach Desktop for Linux? I'd love to be able to set the wallpaper to a live website.

<comment><AUTHOR> Funny thing, I asked someone about this, who poked around... and discovered the Linux options are far smaller. There's _one_ option (I don't recall its name) but nothing like the choices for Mac and Windows. Lots of Android choices though: [http://blog.smartbear.com/mobile/10-live-wallpapers-to- gussy...](http://blog.smartbear.com/mobile/10-live-wallpapers-to-gussy-up- your-android-device/)</comment></comment>


After days without a single demo, Facebook closes hundreds of Oculus VR pop-ups - <AUTHOR> http://www.businessinsider.com/facebook-closing-200-oculus-best-buy-pop-ups-poor-store-performance-2017-2 <comment><USER2> This is weird - I would have expected people to be excited to get an Oculus demo. Any guesses why not?

<comment><USER3> Same reason VR flopped in the late '90s. It's a cool gimmick, but people don't generally want to own it. Just like the last wave of VR, it will live on in niche applications. Spending time in VR means putting actual reality completely on hold. That makes people uncomfortable; we're much happier being distracted than being blinkered.

<comment><USER4> I concur with your assertions. AR is much more likely to be adopted.

</comment></comment></comment><comment><USER5> I went to one of these in an airport. They gave a first-rate demo. Seems like a good product, but they asked me what I thought and I told them, honestly, it's a lot like Google Cardboard.</comment>


Show HN: Simple browser-based music sequencer - <AUTHOR> http://onlinesequencer.net/15506

<comment><USER2> I've seen this before! The interface/usability have definitely improved since the last time I tried this, but it still has a bug where audio cuts off if you switch to a different tab in Chrome.

<comment><AUTHOR> I still haven't found a workaround for that, it's due to Chrome slowing down window.setTimeout calls for inactive tabs.

</comment></comment><comment><USER3> Very cool, im a musician and ive thought a lot about online recordingand production apps. Kudis on actually doing it. :)

</comment><comment><USER4> This is great! Can you speak at all about what libraries you're using here and why you chose to use them?

<comment><USER4> No? No way?

<comment><USER4> OK, good talk!</comment></comment></comment>


Accidentally Turing-Complete - <AUTHOR> http://beza1e1.tuxen.de/articles/accidentally_turing_complete.html <comment><USER2> Also x86 mov instruction is Turing complete! [1]

There is a guy who run Doom with only mov instructions, but it is of course incredibly slow, one frame every 7 hours :) [2]

[1]: [https://news.ycombinator.com/item?id=9751312](https://news.ycombinator.com/item?id=9751312)

[2]: [https://news.ycombinator.com/item?id=16218872](https://news.ycombinator.com/item?id=16218872)

<comment><USER3> I wonder how that one was missed as it's a famous example.

</comment></comment><comment><USER4> On Magic The Gathering being Turing-complete, this is an interesting quote:

> Our result is also highly unusual in that all moves of both players are > forced in the construction. This shows that even recognising who will win a > game in which neither player has a non-trivial decision to make for the rest > of the game is undecidable.

At first I thought this was pretty mind-blowing for a game, but actually this is directly comparable with a Turing machine; each step is forced, mechanical and very easy to derive, and yet, the overall behaviour is generally undecidable.

<comment><USER5> For anyone curious about the details of building a Turing machine in MtG, Because Science did a thorough breakdown and demonstration, using actual cards: [https://youtu.be/pdmODVYPDLA](https://youtu.be/pdmODVYPDLA)

</comment></comment><comment><USER6> While rather more dense, I find Gwern's article/list[1] a bit more extensive (although missing a few from this list), while also having some interesting commentary on security implications.

[1] [https://www.gwern.net/Turing-complete](https://www.gwern.net/Turing- complete)

</comment><comment><USER7> I'm still not sure if Python Pickles, _without_ the GLOBAL opcode to call into Python, are Turing complete.

Python pickle files are a sequence of op-codes that run on the pickle VM. By default the VM allows calls to arbitrary Python functions. I'm still puzzling whether Python pickles without access to Python globals (e.g. using [https://docs.python.org/3/library/pickle.html#restricting- gl...](https://docs.python.org/3/library/pickle.html#restricting-gl...)) are Turing complete. I don't think so, because the pickle VM has no branching or looping, but it does have a stack and my understanding of automata theory is not great.

My research/tinkering so far is [https://github.com/moreati/pickle- fuzz](https://github.com/moreati/pickle-fuzz)

<comment><USER8> Pickle is a stack machine ([https://en.wikipedia.org/wiki/Stack_machine](https://en.wikipedia.org/wiki/Stack_machine)). It is Turing complete. See source code and documentation at [https://github.com/python/cpython/blob/master/Lib/pickle.py#...](https://github.com/python/cpython/blob/master/Lib/pickle.py#L107and) [https://github.com/python/cpython/blob/master/Lib/pickletool...](https://github.com/python/cpython/blob/master/Lib/pickletools.py#L38)

N.B: "Turing complete" really means a lot less than you seem to believe.

<comment><USER9> A machine that has a stack and runs a series of instructions in sequence, no looping or branching, is a pushdown automaton. That's significantly weaker than Turing complete.

(A pushdown automaton can do branching if it wants, but the lack of looping / going left is critical.)

</comment></comment></comment><comment><USER10> This list is careful to mention that the PowerPoint machine requires the user to perform an action for each step, but neglects to make the same disclaimer for the HTML5 + CSS3 machine.

<comment><USER11> I thought HTML5 was just a single button click.

<comment><USER9> The version that's linked requires a button press for each colored box.

</comment></comment></comment><comment><USER12> It's pretty hard to make something that is not turing-complete. I've always wondered if it wouldn't be beneficial to have a turing-incomplete language given that Rice's theorem then doesn't necessarily hold and thus very powerful semantic analysis might be possible. But the language is then probably not practical due to limited expressiveness.

<comment><USER13> This is kinda part of the promise of regular expressions, context-free grammars, relational algebra, map-reduce and other stream/pipeline-based programming models, and maybe to some extent P-complete things like convex optimizers and programming models based on horn clauses like datalog.

Each of these things aims to allow the user to specify a task in a restricted model of computation. In turn, it tends to be possible for the engineer writing the solver to build an engine capable of very radical transformations, optimizations, and analyses, that generally can't be matched by compilers and interpreters for Turing-complete programming languages.

<comment><USER14> If I want to build a language with those optimizations, what resources could I use?

</comment></comment></comment><comment><USER9> > HTML5 + CSS3

Nope. I'm going to argue this every time I see it. It only demonstrates basic arithmetic. When an external actor has to come along and take each iteration's output and manually do things with it, you don't have Turing completeness.

<comment><USER15> That is clearly a demonstration of Turing completeness, but it's a demonstration of Turing completeness of HTML5 + CSS3 _\+ copying from output back to input_ (the same as eg string rewriting systems) and that could stand to be stated more clearly.

<comment><USER9> Technically yes, but only when it's paired with the understanding that arithmetic plus copying the output back to input is Turing complete. HTML5+CSS is only supplying the arithmetic half of the equation.

</comment></comment></comment><comment><USER16> The game "Cities: Skylines" is also Turing-complete: [https://medium.com/@balidani/cities-skylines-is-turing- compl...](https://medium.com/@balidani/cities-skylines-is-turing- complete-e5ccf75d1c3a)

<comment><USER17> Factorio too. Raycasting engine: [https://www.youtube.com/watch?v=7lVAFcDX4eM](https://www.youtube.com/watch?v=7lVAFcDX4eM)

<comment><USER18> And "Baba Is You": [https://twitter.com/mattar0d/status/1109987662608384000](https://twitter.com/mattar0d/status/1109987662608384000)

</comment></comment></comment><comment><USER19> Turing Complete is not a very high bar. Add a second stack to a pushdown automata and its Turing Complete. Add two counters to a NFA and it's Turing Complete. I am not sure if folks know what this means.

<comment><USER20> Yes. Judging from the HN discussion of a very similar list a week ago, a loud minority confuses "not Turing complete" with "sandboxed". Hence lots of discussions about security that seem to miss the point.

</comment></comment><comment><USER21> Somebody should make awesome-turing-complete project on github, so we can merge everything from the comments here into a neat list...

<comment><USER22> Done [1]

[1] [https://github.com/abetusk/Awesome-Turing-Machine- Equivalenc...](https://github.com/abetusk/Awesome-Turing-Machine-Equivalence)

</comment></comment><comment><USER23> Turns out Pokemon Yellow is also Turing complete!

This fantastic hack escapes the game, loads a couple bootstrapping sequences and then proceeds to turn Pokemon into a MIDI player.

[http://aurellem.org/vba-clojure/html/total- control.html](http://aurellem.org/vba-clojure/html/total-control.html)

<comment><USER9> * using an enormous glitch.

It's really cool, but it's notably different from using actual ingame mechanics to compute.

And there are much more fun versions of pokemon yellow total control than the link you and the article have. [https://www.youtube.com/watch?v=zZCqoHHtovQ](https://www.youtube.com/watch?v=zZCqoHHtovQ)

</comment></comment><comment><USER24> How concerned should we be that BGP is in there?

</comment><comment><USER25> The C++ templates example is kind of a meme, and Bjarne has pushed back on the idea that it was "accidental."

Sure, they didn't set out saying "we want to design a Turing-complete generics system" (because what kind of problem statement is that?), but templates were explicitly designed to be as general-purpose as possible. Turing-completeness was the result of that design goal:

"...I had aimed for generalty (and gotten Turing completeness modulo translation limits). I opposed restrictions to C++ immediately when Erwin Unruh presented what is widely believed to be the first template metaprogram to the ISO Standards committee's evolution working group."

[http://www.stroustrup.com/bs_faq.html#understand](http://www.stroustrup.com/bs_faq.html#understand)

</comment><comment><USER26> > _In a very similar fashion to C++, the type system of TypeScript can be used > to implement a prime check._

PCRE can do that too (for numbers in unary). [https://www.masteringperl.org/2013/06/how-abigails-prime- num...](https://www.masteringperl.org/2013/06/how-abigails-prime-number- checker-works/)

</comment><comment><USER27> But most importantly - should your config language be turing complete, or not - or do we care or not?

<comment><USER28> If a config file isn't deterministic (because it's executable _and_ can read info from its environment), then it can be harder for tools to introspect on the full config (imagine an IDE showing your project's settings or a tool that validates it; the tool would be blind to what your config specifies in environments the tool doesn't test with) or know when it's safe to cache the config's result (because the tool doesn't necessarily know whether the environment may have changed in a way the config cares about). (Extreme example: if you had a software library that declared its list of dependencies in an executable config file, and that config file could arbitrarily read the environment, maybe toggling certain dependencies depending on your platform and whether you had certain pre-requisites on your system, then a package repository that the library is published on can't show a canonical list of the library's dependencies. When a user wants to install the library and its dependencies, the package repository server can't respond with library and its dependencies together, because the library's dependencies for you could only be found out by executing its executable dependency config on your computer specifically, so the server would need to send you the library, your computer would need run the dependency config, and then go back and ask the server for the dependencies, and then repeat for their depedencies, etc.)

Also, executable config files (deterministic or not) aren't so easy or pretty to programmatically modify. If the config file can define arbitrary functions and use them to compute the config, then if you want to tweak the config with a tool like an IDE or package manager, then it will need to try to recognize a pattern in the config file, or add a chunk of code at the bottom that just mutates the config file after your handwritten code.

</comment></comment><comment><USER29> That Pokémon is an arbitrary code execution, not "accidentally turning complete"

<comment><USER4> But if a system allows code execution on its host CPU, and the host CPU is Turing complete, this means the system itself is Turing complete too by extension.

</comment></comment><comment><USER30> Oh hey, the Vim example is my project. Super fun to build.

</comment><comment><USER31> Reminded me of the fact that D templates are not Turning Complete.

<comment> ben-schaaf IIRC D templates are more powerful than C++ templates, and certainly turning complete. CTFE is also turning complete.</comment></comment>


Green New Deal bill aims to move US to 100% renewable energy, net-zero emissions - <AUTHOR> https://arstechnica.com/tech-policy/2019/02/green-new-deal-bill-aims-to-move-us-to-100-renewable-energy-net-zero-emissions/ <comment><USER2> "Upgrade or replace every building in US for state-of-the-art energy efficiency."

Yep - that is definitely doable. Every building.

"Build out highspeed rail at a scale where air travel stops becoming necessary".

Hmm - I kinda like being able to travel coast to coast in a few hours instead of a few days.

How much will it cost?

Ocasio-Cortez: "... even if every billionaire and company came together and were willing to pour all the resources at their disposal into this investment, the aggregate value of the investments they could make would not be sufficient."</comment>