Ask HN: Anyone making a living from  Desktop apps? - <AUTHOR> is there such thing still developers that make desktop apps and making  a living out of it ? that is i guess indie small teams not the big companies like adobe <comment><USER2> I'm a lone developer hacking away on a couple of Mac apps. I also have a few iPhone apps, but these generate little to no income. The Mac apps are better. Most notable is InstaDesk (<http://www.instadesk-app.com>) which generates my main income and I can live off it thus living _the dream_ (i.e. right now I'm sitting outside in a small cafe, enjoying the sun, watching people, and fixing a couple of bugs for the upcoming 2.0.2 update; after that I'll head to a green park which features fast wifi).

I'd say it's a lot easier if you're working alone and have little costs. I have a small flat, and I don't have any employees. Also, I do the website myself, the customer service, the one or other ad campaign, the graphics, etc. So apart from my small rent and hardware (which is where I do invest, since I do think that good tools are really, really important) I have almost no expenses. Living in a small student town also helps since good and healthy food is really cheap here, too (like 3 eur for a solid and healthy lunch).

<comment><USER3> Do you mind if I ask how you go about learning how to build Mac OS apps? I've seen a ton of tutorials for iOS but hardly anything for Mac OS.

<comment><USER2> Not much to add, the other comments are pretty good. I learned the most from Apple's sample source code, and from reading through open source projects on GitHub. Also, my former company send me to WWDC and the sessions are pretty insightful, too. If you pay for an Apple Developer membership, you get free access to these videos, and many of them are worth it. Though nowadays it's mostly iOS. In 2007 or 2008 there were lots of introductory Mac development presentations.

It's probably best to start with a small project and tackle one project after the other.

I also read this book which helped since it tackled all the basics that one needs to know for a full Mac app. It's german only though ([http://www.amazon.de/Objective-C-Cocoa-Nachfolger-Tiger- XCod...](http://www.amazon.de/Objective-C-Cocoa-Nachfolger-Tiger- XCode/dp/3908497426/ref=ntt_at_ep_dpt_5)) alternatively the aforementioned Hillegas ([http://www.amazon.com/Objective-C-Programming-Ranch-Guide- Gu...](http://www.amazon.com/Objective-C-Programming-Ranch-Guide- Guides/dp/0321706285/ref=sr_1_3?ie=UTF8&qid=1343053788&sr=8-3&keywords=AARON+HILLEGASS)) which is really good.

<comment><USER4> Are you interested in becoming a passive mentor for someone who has a decent grasp on core obj-c/cocoa concepts? I'm looking for someone I can bounce ideas and questions off of. I think InstaDesk is fantastic!

</comment></comment></comment></comment><comment><USER5> Certainly still an option. There's a long history of folks like that, the market for e.g. Mac apps was if anything helped by the launch of the Mac app store (some devs more than others, long story, ask them for the specifics). I could give you two dozen examples from my social circles but most of them would not appreciate the publicity.

That said: can I talk you out of it? I've done both, and from a business perspective doing it as a web app is a MUCH better option.

[http://www.kalzumeus.com/2009/09/05/desktop-aps-versus- web-a...](http://www.kalzumeus.com/2009/09/05/desktop-aps-versus-web-apps/)

<comment><USER6> What is definitely dead are Java Swing apps. I believe desktop BCC was a Swing app. Swing app installation and updates are a major pain.

Native apps on an App Store dont suffer from these issues, and their ability to integrate with special OS features make them more compelling vs a web app. Not so with Swing.

<comment><USER7> Swing vs Native isn't the issue. The issue becomes users using old versions of your software and having to support them when bugs pop up, even though it may be fixed in the newer versions. It is hard to get everybody up to the latest version (even if the upgrades are free). It can eat up a lot of time doing support.

Whereas, when you make your app a web app, the changes you make are instant (for better or worse) and you don't have to worry about supporting various versions.

<comment><USER8> >It is hard to get everybody up to the latest version (even if the upgrades are free)

Automatic patching helps with this, although it requires a little more work designing a patching system (you might not want everyone hitting your servers at once), and it doesn't affect everyone (some people's computers are offline or require a proxy to be set up for patching.)

<comment><USER7> That is true, but even that has its caveats. Depending on who your target is, the user may be skeptical of a program "phoning home" on its own every so often.

</comment></comment></comment></comment></comment><comment><USER9> In 2003 I began to supplement my contractor income by writing OS X apps as a sole indie developer and eventually went full time. In the first six years I made enough to live on.

In 2008, mostly out of curiosity, I wrote a free iOS app and started a small company to publish it. This company made no revenue in its lifetime but was acquired this year. My return from that acquisition exceeds the revenue I earned from my desktop business (for every year _combined_ ).

Chances that I return to desktop app development? Zero.

To be honest, it is bittersweet. I love the desktop, but that's really not where users are anymore. Skate to where the puck is going to be and all that.

<comment><USER6> > I love the desktop, but that's really not where users are anymore.

Depends on the application and the targeted user. There will always be a demand for apps for the "truck" users. But you are right, the desktop is overkill for the vast majority of people only using computers for email and social media. If they are your target, good luck. For the majority of developers, prices for apps that target these users is a race to the bottom.

</comment></comment><comment><USER10> We are (at <http://www.blumentals.net>). Windows apps, in fact, and not for big companies but regular people. I don't know what to tell you, the market is far from dead, maybe it will be dead someday, but right now things are fine. The hardest thing about making mass-distributed Windows apps is getting your good app to the customer through a pile of crappy ones.

<comment><USER11> I don't want to offend you or anything, but maybe a redesign of your site would give you some extra boost!

<comment><USER12> It looks fine to me.

In fact I've become a little suspicious of sites that are highly polished but seem to have little history.

</comment></comment></comment><comment><USER13> My Mac app grosses around 3k € / month (<http://jabakobob.net/mdbviewer/>). Might not be much for someone living in SF, but it's more than my day job at an Austrian research institute pays.

<comment><USER14> The website looks great :) .

Also, I'd love to make 3k € / month ! . I'll probably be in Vienna for a few months next year, are there Hacker Meetups or similar?

<comment><USER13> I was at a couple of Cocoaheads meetings (<http://cocoaheads.at>), nice people there, but I am too busy lately...

</comment></comment></comment><comment><USER15> Desktop apps still have a place in some B2B settings. For a year I worked for a company that developed software that managed fork lift battery inventories for warehouses. These were warehouses that had little to no internet connectivity on the floor and so having a desktop application was crucial. It was a niche market but highly profitable.

<comment><USER16> It always amazes me how a business can be built out of anything, "fork lift battery inventory" You just need to find a pain point.

<comment><USER15> Surprisingly, its such a pain point that a company would spend $50,000 - 150,000 for a single installation.

</comment></comment></comment><comment><USER11> I think there are three kinds of desktop app developers that make real money today:

* People who make huge profits fast, because they built a desktop client for popular webservices (see terhechte and his InstaDesk)

* People creating good software for niches that REALLY NEED that piece of software to get work done.

* Companies building large software suits for big companies that spend huge amounts of money in licences and support.

I personally think everyone in the middle is also doing well, but not enough to make a living out of it.

<comment><AUTHOR> do you have examples for the second section ?

<comment><USER17> A good example of a developer in a specific, unfashionable, but successful niche is Progressive Solutions [1].

Their target market is far from glamorous, but it's a very successful business (they've actually just been acquired last month).

1 <http://www.progressive-solutions.co.uk/products.php>

</comment></comment></comment><comment><USER18> It depends.

If you mean desktop apps in the like of Twitter clients, mail apps, media players and etc I'd guess the answer is no. There are a lot already and new ones are not needed.

But if you mean desktop apps in the like of 'fat clients' for big companies, Eclipse or NetBeans RCP based apps for example, the answer is yes. There are a lot of companies who have a lot of data which they'll be happy to have a good UI to be able to use it in their own purpose.

<http://platform.netbeans.org/screenshots.html>

<http://www.eclipse.org/community/rcpcp.php>

</comment><comment><USER19> I assume by desktop you mean either Windows or Mac or any Linux distro. I mostly work on Windows as an engineer, there are some great products from small or one-man company: Emeditor: a text editor | UltraEdit/UltraStudio: a text editor/project IDE | Beyond Compare: a compare utility --> they have Linux version | Source Insight: a source tree oriented code editor and browser |

Those are all paid software and I bet the authors are making good lives from their software

</comment><comment><USER20> I'm an independent contractor working on a Windows desktop app used in the casino industry.

</comment><comment><USER21> I do. I split my time between firmware and desktop apps. I work for a small company of about 5 people. Before that I worked at a larger company, but was the sole developer of an Audio Recording app. I also worked on speaker modelling and configuration apps. All the apps I've worked on recently have very small user bases and tend to be part of a larger system.

</comment><comment><USER22> There most definitely is still a market for people making desktop applications. Take Sparrow (<http://sparrowmailapp.com/>) for example. They seemed to be doing well for a desktop application - so well they got acquired by Google. An number of other applications I have purchased on my Mac are done by small teams: Alfred, 1Password, TextExpander, Things, Coda, Tweetbot. As other comments have mentioned, it may be easier on the Mac due to a perceived higher quality & richer client base. Independent games are also doing very well. Look at games like Braid & Limbo (true these also were XBLA titles). Games are still desktop applications after all.

So yes, I'd say there most definitely is a market for desktop apps & I wouldn't be surprised if the market was the strongest it had been for a while with the rise of the Mac App Store.

<comment><USER23> _They seemed to be doing well for a desktop application - so well they got acquired by Google._

I think the general consensus was that the correct characterisation of that was that they were doing so _badly_ that an aqui-hire was an attractive exit. Google certainly didn't buy them for the app...

</comment></comment><comment><USER24> I used to develope desktop applications for security printing. In such a niche market, it is very hard to gain customers. Now I moved to web application and launched online Torapp guilloche designer (<http://www.torapp.info>). Hopefully things will be better.

<comment><USER14> What's your market? Aren't you replicating the problem? (it's still a very niche market). I hadn't heard of guilloche before now.

Also, the website doesn't look professionaly designed - maybe you don't need it to, but it might help.

<comment><USER24> Yeah, the security printing software is still a very niche market. I need to consider using some of the expertise to something on mobile.

</comment></comment></comment><comment><USER25> I do to an extent and that too on Windows. I have this watermarking software I developed 6 years ago and I keep updating it whenever I get time and its on an auto pilot. People buy, download, I get money in bank. I am considering doing it full time making a Mac desktop version and iPad one.

Desktop apps are here to stay. People will still do their business on a real desktop/laptop computer. Main advantages are larger screen and large physical keyboard. If you want to process a video, photos or type a 10 page legal contract - you would rather do it on a full sized computer than on a mobile phone or a tablet. So there will always be a market for software for desktop computers.

</comment><comment><USER26> I wish people would make desktop application which transcends various browsers and cloud. For example, look at the Bookmarks and History in browser. I would wish to keep my bookmarks to myself wherever I go and it should be browser agnostic. Currently, there are tons of web-services out there socializing your bookmarks on the cloud but none would liberate your browser's bookmarks/history for yourself. A local application could remedy such situation.

</comment><comment><USER27> Desktop apps are still used for a lot of equipment command and control scenarios. I work on a small team who make a desktop app that needs to communicate with some custom hardware over an RS-232 (serial port) based protocol. For this sort of application, laptops which have a real serial port (or via a port extender) are the only option.

</comment><comment><USER28> I make a nice living (so far) out of making windows desktop apps, but they are very niche oriented. Mostly statistical analysis of millions of rows. All though it is possible to make them in html, it would be really hard to meet the UI, performance, and mobility requirements with web apps.

</comment><comment><USER29> of course there are tons of companies, even big ones who make serious money from desktop apps. But each of those including ours, is happy that making money this way is not sexy anymore and all you startup guys focus your attention elsewhere so we can keep the market to ourselves :)

on a serious note, just look at download portals - like download.com etc. there are tons of very popular software and they all make money, either requiring users to pay or ad-supported.

</comment><comment><USER6> Im make about $2k/mo off a Mac App

<comment><USER30> How did you build it up to that level?

<comment><USER6> Its really all due to the Mac App Store. Having a free lite version helps. My conversion from lite to paid is around 6%

</comment></comment></comment><comment><AUTHOR> good example of mac shop don't know much about them but it looks like they do cool apps "only" for mac <http://www.belightsoft.com/company/overview.php>

</comment><comment><USER31> Of course there are. They just aren't as noisy which is why you don't think they exist.

Away from the buzz of the tech cities, the trendy "apps" culture and tech giants, there are lots. In fact, these people are actually the silent (and better paid) majority in the industry.

However, there is not much fanfare and most of them produce specialist software for niche industries.

I myself produce specialist financial modelling software which is all Windows desktop (C# + WinForms). I spent a few years doing logistics software (C# + WinCE + WinForms) and before that I spent 10 years writing a large desktop based system for distributed logistics and asset management for the defence industry.

</comment><comment><USER32> Steve Ballmer? ;-)</comment>


Malibu homeowners foiled by $30K Kickstarter campaign - <AUTHOR> http://sub.garrytan.com/malibu-homeowners-who-hide-access-to-beautiful-beaches-foiled-by-$30k-kickstarter-campaign <comment><USER2> Just for a little context for those unfamiliar with Malibu. Some beaches are public, some are private and open only to those who live in particular neighbourhoods. The residents here are remarkably wealthy, we're talking Speilberg, Streisand, Geffen, and at times have hired their own private security to check people's ID to ensure they belong there. Broad Beach (I think) is public, but there's gates that block access to it requiring a key. So this app informs people which gates are legit and which ones are erected under false premise.

Malibu problems.

<comment><USER3> "some beaches are private" is actually incorrect - all beaches in California are public from the water to the high tide line.

<comment><USER4> "all beaches in California are public from the water to the high tide line."

There is also a federal law that makes all navigable rivers open to the public up to the high water line. However, as far as I know there isn't any database that contains a list of all the rivers that are considered to be navigable, meaning that actually using this protection might require an expensive affirmative defense.

<comment><USER5> As a whitewater kayaker in Texas, I can concur with this saving us. But the police don't often know the federal law and will still harass or arrest you.

<comment><USER6> Also, federal law won't necessarily save you in court, unless you have the money and time to escalate. I took a traffic fine to court once, showed the judge copies of the federal regulation and photos of the area proving that the signage was invalidly placed, and he upheld the fine anyway--he literally said "I don't care."

</comment></comment></comment></comment></comment><comment><USER7> This app was led in part by an LA journalist and lover of Malibu beaches, Jenny Price. She had been reporting on these public beaches in a series that ran on laobserved.com, a popular LA blog.

Here's the first such piece, which I notice ran in 2006:

[http://www.laobserved.com/intell/2006/08/guide_to_malibus_hi...](http://www.laobserved.com/intell/2006/08/guide_to_malibus_hidden_beache.php)

Here's a link to the announcement of the kickstarter campaign:

[http://www.laobserved.com/archive/2013/05/time_ticking_for_j...](http://www.laobserved.com/archive/2013/05/time_ticking_for_jenny_pr.php)

which contains pointers to some of her other articles.

It was a genius idea on someone's part to get her to build an app around this knowledge. She's a journalist, not a computer nerd.

<comment><USER8> Why do you assume that the idea wasn't hers?

<comment><USER7> Since this is HN, I was trying to point out that it's a case where latent knowledge was transformed into highly useful software.

I do pretty much assume the app wasn't totally her idea. This is because I've been aware of her work (e.g., [http://west.stanford.edu/node/901](http://west.stanford.edu/node/901)) for probably 10 years now, but hey, I could be wrong. The agency that developed the app is here: [http://escapeapps.com/about](http://escapeapps.com/about)

</comment></comment></comment><comment><USER9> It seems to me that if they really wanted to disrupt the Malibu beach scene and provide more access for the public to the beaches, that they would just release the data as an annotated geojson file, rather than raise 30k(!) to create an app that will no longer be updated in a year.

Props to them for doing a civil service, but it seems to me that it is also very-much motivated by money.

<comment><USER10> I don't see anything inherently wrong in building a business around a civil service.

Your exclamation mark indicates that 30K is too much for an app like this, but I disagree because someone has to do the research to find each beach access point, identify false ones, organize the data into a database and build a app/web service around it.

For an average Silicon Valley salary, $30K is a quarter of a year's worth of salary. My guess is that more than three months of work was put into this.

<comment><USER9> I also have no problem with people building businesses around a civil service. However, this is a kickstarter campaign which seems to be trying to raise money for work that has already been done.

I put the exclamation point there because it is my outsider perspective that the data has already been researched and compiled by the California Coastal Commission. An iPhone application has even already been submitted to Apple and approved (that's my understanding, their kickstarter page has changed over the last few weeks). They are raising the money so that they can "release the iPhone app for free", instead of charging for it. That is the reason for my exclamation point -- to believe that the app would compile 30k worth of purchases may be disingenuous.

</comment></comment></comment><comment><USER11> Given that the project goal is to permit as many people as possible to find these beach entrances isn't it a bit odd to target a total of two platforms for the application? I'm surprised they aren't doing something this simple with the web.

Put another way, isn't accessibility a prime concern for a beach accessibility application?

<comment><USER12> You can just go here to get the information for free:

[http://www.coastal.ca.gov/access/BroadBeachCoastalAccess.pdf](http://www.coastal.ca.gov/access/BroadBeachCoastalAccess.pdf)

They are just providing a better user experience and advertising, but it is public information and it is free.

<comment><USER11> I'm asking why the "better user experience" can't be accessible to people without an iPhone or Android device.

<comment><USER13> Because perfection is the enemy of the "good enough," and iPhone + Android covers an enormous share of the market. Should they support Lynx on SunOS 5, too? No? Why? Because a vanishingly small number of people use that platform.

<comment><USER11> The app is simple enough that it seems within the realm of possibility that it would take _less_ time to build it using the web thereby getting support for many more operating systems for free.

</comment></comment></comment></comment></comment><comment><USER14> Can they make this app also tell you when valet parking companies are falsely putting cones and signs in front of parking meters, etc? This happens in every area of Santa Monica, Venice, LA, etc. They make it look like several parking spots are legally blocked from 6pm to 2am for their valet service, when in fact they are not. It's a way bigger problem than this beach thing, but seems like it would rely on similar technology.

<comment><USER15> Why are the cops letting them do that?

</comment></comment><comment><USER16> Tell me that the homeowners who put up the misleading signs get fined, preferably heavily, knowing how wealthy those homeowners likely are.

<comment><USER17> Isn't there a free speech issue here? Can't they put up signs proclaiming whatever they want _on their own property?_. Yes, I am aware that there are some specific public-safety oriented exceptions, like impersonating police, but I don't see that here. Scumbag? Yes, but it absolutely should not be illegal.

<comment><USER18> This argument makes no sense. Why not paint the curb in front of your house red or yellow to discourage parking, then? Why not pop a few "free speech" stop signs on the road as part of a private traffic-calming initiative? Why not leave it up to the informed motorist to figure out whether the curb is painted red for a safety reason or merely because the homeowner is a jackass?

Trying to enforce one's will over public property and public behavior with misleading, official-looking signs is scarcely any better than impersonating a police officer for the same effect--it's just a matter of degree.

<comment><USER19> Well, while I agree with the spirit of what your saying, 100%, I do disagree with his argument not making sense.

Everything you're suggesting would be illegal, because the person would be defacing public property. There's a clear line between repainting a city owned curb or a posting a sign on a city owned streetside.

It's not -exactly- the same as painting a curb on your own property, or putting a sign on your own lawn.

Again. I agree that these Malibu owners are being crappy, but there's a difference.

<comment><USER20> The whole problem is finding out exactly where the property line is. There is a whole army of professionals that do that, full time -- surveyors. And there are databases of lots and zones that local governments maintain (some even behind pay walls). So finding out where exactly "private" stops and "public" begins is not that simple.

The issue might not be that big in areas where nobody cares about land that much, but in NY, LA, or other big city, where the cost of land is so high, every inch counts.

So you paint the curb red and install a fake fire hydrant. Is the curb yours or not? I don't know. Can you "impersonate" a fire hydrant to stop others from parking in front of your house? Not sure. It seems like it would be illegal. Kind of like putting a fake "highway entrance" green sign on the side of your house. It is your property but if it start directing traffic into your neighbor's pool you might just get fined or sued. At least a law will quickly be created to deal with the issue.

</comment></comment></comment></comment></comment><comment><USER21> Finally, someone started taking my advice! This is very interesting. I never considered that homeowners might put up fake signs to detour the public.

"Special logo thanks! ---> We'll put your logo / icon (280 x 280 px) PLUS a link to your website on a special thank you page in the app! Plus, an advance copy of the app. Estimated delivery: Jun 2013 "

[https://news.ycombinator.com/item?id=5794094](https://news.ycombinator.com/item?id=5794094)

<comment><USER22> Although note that they're only putting the link in the app, not on a website, from what I can tell. So, not really buying a link in the traditional sense.

</comment></comment><comment><USER23> The first thought I had was: Why doesn't someone organize an "Occupy Malibu"? Hundreds or thousands of people peacefully (and cleanly) making use of the public beaches in these "exclusive" areas for the entire summer. Keep it clean, civilized, respectable, don't leave trash behind and be considerate. In other words, give absolutely no reason to label you negatively in any way.

<comment><USER24> Probably because there are about a million other more important injustices to work on first.

<comment><USER25> Yes, but doesn't this just feel deliciously like "sticking it to the man?" These are public beaches that the most well-off among us would like to keep for themselves. Not only that, they use extremely underhanded tactics to do so.

<comment><USER26> _" sticking it to the man?"_

In the grand scheme of things, I'd argue that occupying a beach to stick it to the man isn't a great way to spend time.

<comment><USER27> If you are going to a beach it's much better to be sticking it to the man while you are there.

<comment><USER25> Besides, who doesn't like the beach?

</comment></comment></comment></comment></comment></comment><comment><USER28> Here's the Kickstarter campaign - [http://www.kickstarter.com/projects/escapeapps/opening- this-...](http://www.kickstarter.com/projects/escapeapps/opening-this-summer- the-malibu-beaches-0)

<comment><USER29> Is it just me or is $30,000 a _lot_ for an app?

I know there's some research involved but that still sounds highly expansive.

</comment></comment><comment><USER30> Regarding Broad Beach... here is a PDF [1] with some good detail on beach access. There are 2 access points that are open to the public from Broad Beach Road. The PDF also has photos of all of the properties, and detail on what part of the beach is available to the public.

[1] [http://www.coastal.ca.gov/access/BroadBeachCoastalAccess.pdf](http://www.coastal.ca.gov/access/BroadBeachCoastalAccess.pdf)

</comment><comment><USER31> I read this as Malibu homeowners scammed by $30K Kickstarter campaign.

</comment><comment><USER32> 99% Invisible had a story on secret staircases in California, left over from the WPA, and a time when public infrastructure projects for pedestrians was a thing.

Thing about the WPA, it had a lot of really talented artists and sculptors contributed to public works, so you get some magnificently beautiful constructions, if you can find them.

Apparently a lot of landowners try to fence off or discourage access to the public walkways though, and there's an underground movement to keep access open to these public city spaces.

[http://99percentinvisible.org/post/45876810693/episode-75-se...](http://99percentinvisible.org/post/45876810693/episode-75-secret- staircases)

</comment><comment><USER33> I think the real story here is the use of Kickstarter to remove the risk from further developments on the Android app. If you want to go ahead and create something, but are worried about it panning out, this starts to open up new options.

It's not the first time it's been done, but it's encouraging to see creators being able to deliver to those who want their products with less question marks in the process.

<comment><USER34> I think the real story is how easy it is to scam people out of 30k for doing what could be done in a weekend with Google maps and some info from the authorities.

</comment></comment><comment><USER35> Seems like some of these homeowners would pay $30k to not have this program, or for some control over the final product. I could imagine some rich guy paying $15k to keep his section of beach off the program.

<comment><USER36> Perhaps this is their idea of monetization for their app!

:P

</comment></comment><comment><USER37> In the comments to the Sean Parker / Big Sur Wedding story that was posted recently, at least one person described the California Coastal Commission as a bunch of thugs. It's largely thanks to the CCC enforcing easement requirements on beach front homeowners, including some very powerful people, that there is any public access at all in places like Malibu.

</comment><comment><USER38> This happens too with public land trails in the Rockies (near Boulder). The nearby landoweners remove signs, plant over trails, etc.

</comment><comment><USER39> The iPhone app is now live: [https://itunes.apple.com/us/app/our-malibu- beaches/id5656361...](https://itunes.apple.com/us/app/our-malibu- beaches/id565636167?mt=8)

</comment><comment><USER40> Ah yes. I remember in 2005 some friends and I hung out at Carbon Beach in front of David Geffen's house soon after he lost a court battle... [https://en.wikipedia.org/wiki/David_Geffen#Court_battles](https://en.wikipedia.org/wiki/David_Geffen#Court_battles)

edit: photo [http://i.imgur.com/zCQEfZY.jpg](http://i.imgur.com/zCQEfZY.jpg)

</comment><comment><USER41> Those same things happen in Brazil too, wealthy people put gates, make the entrance hard to find and even do lobby to have people enforcing paid parking to restrain access to _public_ beaches, there is no such a thing as private beach, but somehow they manage to fake the "ownership".

</comment><comment><USER42> Glad that Californians have this option. Beaches should be public on the East coast as well.

</comment><comment><USER43> "Malibu homeowners intentionally obscure public beach access areas with fake signs and hidden access. This is not only ridiculously selfish, it is illegal."

Better or worse than just flat out preventing access whatsoever?

[http://www.indiawest.com/news/9799-Surfers-Sue-for-Access- to...](http://www.indiawest.com/news/9799-Surfers-Sue-for-Access-to- Billionaire-Vinod-Khosla-s-Beach.html)

</comment><comment><USER44> Reminds me of the challenges Half Moon Bay is having with Vihnod Kholsa and beach access. At least, when they sue, the Malibu residents own up to it -- see Streisand vs Adelman. Vihnod is hiding behind things. sad.

[http://www.pehub.com/2013/03/15/the-surfrider-foundation- tak...](http://www.pehub.com/2013/03/15/the-surfrider-foundation-takes-ubervc- vinod-khosla/)

</comment><comment><USER45> This a great project. Living on the east end of Long Island, we tend to have similar (although seemingly less extreme) situations with public beaches and waterways. I'd love to see something like this here too, so when I'm getting yelled at I can point out that I am in fact on a public beach.

</comment><comment><USER46> When access is blocked illegally, it is just totally wrong and this app will certainly help those who just want to enjoy some beach time. It would be nice if the entire coast could have an app like this, on both East and West...oh and South.

</comment><comment><USER47> Awesome. I've never been to Malibu, but I can definitely see this as a useful app if I ever do decide to go. If the locals have trouble finding the public beaches, I can't imagine I'd be able to do it without some help.

</comment><comment><USER48> 'Right to roam' in Nordic countries comes to mind.

[https://en.wikipedia.org/wiki/Freedom_to_roam](https://en.wikipedia.org/wiki/Freedom_to_roam)

<comment><USER49> Not just Nordic countries, we have in Scotland as well:

[http://en.wikipedia.org/wiki/Freedom_to_roam#Scotland](http://en.wikipedia.org/wiki/Freedom_to_roam#Scotland)

</comment></comment><comment><USER50> I'm thinking if you pay me $30K to port a relatively simple IOS UI to Android, then _that_ is the business. No need to sell anything (else).

</comment><comment><USER51> Why does this need to be an app? Seems like building out a website to distribute the information would be better.

<comment><USER52> Websites already exists and have been linked to by other people. This app just makes it easier to find and use that info from a mobile phone.

</comment></comment><comment><USER53> Why would you drive all the way up to Malibu when LA has an uninterrupted stretch of beach that is 50 miles long?

</comment><comment><USER54> Wow, they could use this for Hawaii. We deal with a lot of the same stuff here.

</comment><comment><USER15> I'm in Santa Monica (just down the road from Malibu) right now and decided to go checkout the public access path next to David Geffen's house[1] after reading this today.

I was able to park across the street with no problem (plenty of spaces) and walk alongside his house onto the beach. I walked really far and passed many people who I assume were homeowners based on how they were dressed (no shoes/bags/purses or beach toys) and acting (walking close to the houses etc). All offered polite smiles and several let their dogs run up to me and seemed to expect me to pet/play with them. Not a single person gave me an odd or disapproving look - though one couple (really old white guy with a 20-something black girl) went pretty far out of their way to avoid the path I was walking on. I figured at least one of them was famous or something, as the reason.

When I was leaving though, I went back past Geffen's house (only way out) and what I assume was his private security guard (plainclothes but looked like a Marine) came walking straight at me staring at me and then got in a car in the driveway. I look across the street to my car and I see a cop car parked in the turning late in the middle of the road with two cops in it. I decided to take an extra long time wiping the sand off of my feet to soak it all in. The security guy eventually pulled the car out of the driveway and alongside the cops, I assume they were talking through open windows but with traffic and distance couldn't hear. Then the guy pulls his car in front of the cops in the turning lane, does a U-Turn and parks right in front of my car on the opposite side of the street.

There was no cross-walk and I didn't want to give the cops a reason to legally harass me, so I walked on the sidewalk right in front of David Geffen's house and gestured to the cops asking if I could cross the street illegally. They both just sorta shrugged and looked back at traffic and nodded - meaning if you want to risk getting hit by a car, go for it.

So after a couple of minutes with these cops staring right at me, I find an opening and dart over to my car. The whole time the security dude is still sitting there parked in front of my car. I put my stuff inside and pull away, on the left two cops are staring at me driving off and on the right the security dude is also staring at me. I waved to all three of them and drove away.

So I can confirm the beach is public and the homeowners seem like really nice people who don't mind that at all - other than David Geffen, who seems to try to use his private security and the police to intimidate people into not using the path.

I'm taking a date back there tomorrow.

[1][http://www.nytimes.com/2005/06/05/fashion/sundaystyles/05bea...](http://www.nytimes.com/2005/06/05/fashion/sundaystyles/05beach.html?pagewanted=all)

<comment><USER55> This sounds right out of Raymond Chandler's The Big Sleep (or Big Lebowski if one wants something more modern)

</comment></comment><comment><USER56> This has been thoroughly covered in the NYT, on BBC, and NPR weeks ago. Is this news to anyone still?

</comment><comment><USER57> why does this app cost $30,000? They should be able to get a high quality app like this developed for 1/10th the cost.

<comment><USER58> With 1/10th of the cost ($3000) you can pay a good programmer for something like a week at most. Do you think this app will be completely done within one week?

<comment><USER59> As someone who has written many GPS apps like this, once you have the data you could write it in a day. And since there is a free PDF with all the data in it, you just need to extract that data.

<comment><USER60> Sounds like you should have started a kickstarter and provided an app for whatever you felt was reasonable. Or even done it for free.

But you didn't.

<comment><USER59> You are right, but I can't do kickstarter because I am not an american. And I missed this issue. But I think these guys are having a huge laugh to the bank, getting such a huge sum.

</comment></comment></comment></comment></comment><comment><USER61> Beaches in California are public only by historical accident. There are plenty of public beaches with facilities for visitors like lots of beach space, parking, restrooms, and restaurants. Santa Monica, for instance is about 15 minutes from Malibu and has all that. Why is the homeowner the bad guy for wanting a little privacy without hordes of people partying all night in his back yard, blocking his parking, leaving fast food trash everywhere, and pissing in his bushes?

<comment><USER62> While I do sympathize with the homeowners when it comes to resenting poor behavior by visitors, that thing you are calling "his backyard" is not his. He never paid for it.

English Common Law encodes many centuries of traditions about easement for travel. This topic is not a new thing. That an area might bear ever more visitors over the march of years is just a fact of life.</comment></comment>


God, Darwin and My College Biology Class - <AUTHOR> http://www.nytimes.com/2014/09/28/opinion/sunday/god-darwin-and-my-college-biology-class.html?_r=0

<comment><USER2> A worthwhile read. A nice, concise summary of the science/religion divide.</comment>


New paper claims that evolution has stopped in a bacterial species. Is it true? - <AUTHOR> https://whyevolutionistrue.wordpress.com/2015/02/04/a-new-paper-claims-that-evolution-has-stopped-in-a-bacterial-species-is-it-true/ <comment><USER2> > _if there's no selection pressure on the organism, it will not evolve_

This is (and the article agrees) a statement not compatible with modern evolutionary understanding. Primary school-level knowledge about biology should be enough to debunk this claim: a set of genes survives if there are organisms that pass those genes on, it's as simple as that.

If there is a mutation in a homogenous group of individuals, and that mutation is not lethal or otherwise causes the individual to die before procreation, that mutation survives - selection pressure or not.

There are also genomes that remain highly preserved over long stretches of time, which should likewise not be surprising. This occurs even at the gene level: there are genes in all of us pretty much unchanged compared to early eukaryotes, mostly because the proteins they produce work well, but also because mutations to those sequences are generally lethal.

While most mutations are lethal, it's not true that the remaining ones are beneficial either. This means there are lots of individuals with sometimes distinctive properties which are still causally disconnected from selection pressure.

Anyone who spent some time experimenting with evolutionary models on a computer should know this, because those are intrinsic properties of genetic systems. We _expect_ them to behave that way. We expect ancient versions of organisms to stick around if there was no reason for them to die out. That doesn't mean the reverse is true in the sense that no change in selection pressure leads to genetic stagnation.

</comment><comment><USER3> Even if it had stopped in this bacteria, and it sounds as though there is nowhere near enough evidence to make that claim, it doesn't mean it cannot start again.

Evolution is an event driven process and given there is time between events, there can be a long time between events.

And if there were no possibility of time between those events, everything would look like the end of Akira.

</comment><comment><USER4> There are so many different species of bacteria that it is hard to estimate how many there even are, but according to Wikipedia, it might be between 10^7 and 10^9. I'd be willing to bet that there is a healthy species of bacteria that has stopped evolving, that perfectly copies its dna when it divides, and never transfers dna horizontally. There's no technical reason not to, and the numbers are so huge that they almost guarantee it.

<comment><USER5> > I'd be willing to bet that there is a healthy species of bacteria that has > stopped evolving, that perfectly copies its dna when it divides, and never > transfers dna horizontally

There are several flaws in your argument: 1) There is no known polymerase that has a fidelity of 100%. There will always be some number of replication errors when DNA is synthesized. 2) There are lots of mutagens in the environment. UV light, mutagenic chemicals, hell, even radioactive decay of mostly-stable elements will occasionally hit a base and cause a mutation.

So, no, there is certainly no species that meets your criteria for non- evolving.

</comment></comment><comment><USER6> Well organisms do get stuck in local optima all the time. If you only climb up, eventually you will get to the top of the hill and stay there.

Second, sexually reproducing organisms, _theoretically_ , will decrease their mutation rate over time until eventually they no longer mutate at all. And so no longer evolve.

Most (non-neutral) mutations are harmful. So any gene that decreases mutations (e.g. better DNA copying or repair) will have fewer unfit, mutant children. These children will than propagate the gene more. Even if a gene that causes higher mutations eventually creates beneficial mutations, they will just mix into the general population after a few generations, and not provide a fitness advantage.

<comment><USER7> 1\. The notion of "local optima" for biological species is ill conceived. The world is complex and extremely dynamic; "local optima" isn't a very meaningful concept in the context of evolution.

2\. "Most mutations are harmful" -> this is patently false. A lot of mutations are inconsequential, some are harmful, some are beneficial.

3\. "sexually reproducing organisms, theoretically, will decrease their mutation rate over time" -> this isn't true. Mutation rate is variable over species and over time.

4\. DNA duplication is a complex biological process with many moving parts. There isn't such a straightforward thing as a "gene that decreases mutation".

<comment><USER6> >The notion of "local optima" for biological species is ill conceived. The world is complex and extremely dynamic; "local optima" isn't a very meaningful concept in the context of evolution.

Changing environments can help organisms break out of local optima, but that doesn't imply they don't exist. There are countless examples of organisms getting stuck in local optima. E.g. horseshoe crabs haven't changed in hundreds of millions of years.

Most traits in general are stuck in local optima. Theoretically large changes could improve them, but it's unlikely to happen by random chance.

>"Most mutations are harmful" -> this is patently false. A lot of mutations are inconsequential, some are harmful, some are beneficial.

Who are you quoting? I never said that. I said most _non-neutral_ mutations are harmful. Neutral mutations don't do anything and so don't matter.

>Mutation rate is variable over species and over time.

>DNA duplication is a complex biological process with many moving parts. There isn't such a straightforward thing as a "gene that decreases mutation"

There are many mechanisms that control mutations, like DNA repair and copying mechanisms, or shielding from radiation and mutagens, etc. Of course it's probably very difficult to reach perfection, which is why organisms still evolve. I just said theoretically, evolution is always pushing towards less evolution.

<comment><USER7> > E.g. horseshoe crabs haven't changed in hundreds of millions of years.

No. They may have barely changed in morphology, but that doesn't mean they are "stuck in local optima". And even then, it seems they have changed morphologically in some ways. [https://whyevolutionistrue.wordpress.com/2012/09/14/horsesho...](https://whyevolutionistrue.wordpress.com/2012/09/14/horseshoe- crabs-arent-living-fossils-2/)

> I said most non-neutral mutations are harmful.

That is just false, and I don't know how you came to that idea.

> Neutral mutations don't do anything and so don't matter.

Again, false. Mutations can have no impact on a population until that mutation interacts with another mutation (e.g. because the population bred with another population that has other mutations), resulting in a net evolutionary advantage for the species over time.

> Of course it's probably very difficult to reach perfection, which is why > organisms still evolve.

There isn't a notion of "reaching perfection" in evolution. That's a fundamental misunderstanding of how it works.

> I just said theoretically, evolution is always pushing towards less > evolution.

No. There is no "theoretically"\- evolution is a well observed and documented process. And if you observe and document the real world, you will notice that the evolutionary process is certainly not pushing towards "less evolution".

Please stop posting misinformed comments that may confuse or mislead readers who take them to assume you have a good understanding of the topic. If you wish to comment on the topic, please take the time to inform yourself first from scientists who work in the field, rather than from your own baseless speculation. A good start is here: [http://evolution.berkeley.edu/evolibrary/misconceptions_faq....](http://evolution.berkeley.edu/evolibrary/misconceptions_faq.php)

<comment><USER6> >They may have barely changed in morphology, but that doesn't mean they are "stuck in local optima".

That's exactly what that means. Their morphology is stuck in a local optima at the very least. And unless you really believe horseshoe crabs are the ultimate form of life and it's impossible for organisms to improve at all, then it is "local".

>That is just false, and I don't know how you came to that idea.

And I don't know how you disagree with it. Do you really believe that most mutations are beneficial? Really? If so, exposing yourself to radiation would be beneficial for your health. Or your childrens fitness.

This is just utterly ridiculous and defies all logic. Mutations are almost all negative.

>Again, false. Mutations can have no impact on a population until that mutation interacts with another mutation (e.g. because the population bred with another population that has other mutations), resulting in a net evolutionary advantage for the species over time.

Then, by definition, it's not a neutral mutation. It's slightly positive, or slightly negative, or really positive, or really negative, but if it has an effect at all, it's not neutral.

>There isn't a notion of "reaching perfection" in evolution. That's a fundamental misunderstanding of how it works.

Perfect as in having the best fitness possible. A global optima. Where no mutation could improve it at all.

>No. There is no "theoretically"\- evolution is a well observed and documented process. And if you observe and document the real world, you will notice that the evolutionary process is certainly not pushing towards "less evolution".

I'm sorry you don't know what the word "theoretically" means. My hypothesis is "If there is a gene that decreases mutation rates in a sexually reproducing population, it should be selected for over time."

This hypothesis would be difficult but not impossible to test in the real world. If we could find a gene that decreases mutation rates and introduce it to an animal that doesn't have it, and observe them for many generations. It could also be easily tested in computer simulations.

>Please stop posting misinformed comments that may confuse or mislead readers who take them to assume you have a good understanding of the topic. If you wish to comment on the topic, please take the time to inform yourself first from scientists who work in the field, rather than from your own baseless speculation.

Please stop being pedantic and misinterpreting everything I say.</comment></comment></comment></comment></comment>


Research In Motion (BlackBerry now) finally announces Z10 and Q10 - <AUTHOR> http://www.ihelplounge.com/research-in-motion-blackberry-now-finally-announces-z10-and-q10/

<comment><USER2> Nice try RIM :)</comment>


MySpace: How To Devalue a Platform in Three Easy Steps - <AUTHOR> http://www.25hoursaday.com/weblog/2007/09/05/MySpaceHowToDevalueAPlatformInThreeEasySteps.aspx <comment><USER2> I think this might be an exercise left to the readers(us).

So let's make our own.

1\. Flashing Xbox/IPod Ads

2\. Extreme Fox-related whoring (i understand why though)

3\. Tom's cutesy messages about your friends NOT being deleted.

</comment><comment><USER3> Client is Offline

        25hoursaday.com

        The DNS2Go customer you are trying to reach is currently offline.

How ironic.</comment>


Japanese scientists launch face recognition-blocking glasses - <AUTHOR> http://rt.com/news/glasses-block-face-recognition-544/ <comment><USER2> I know who that is! That's the guy with the funny glasses!

Technology like this does not prevent recognition unless lots of people are using it. One glance at the glasses, and I doubt there will be much uptake.

<comment><USER3> Exactly. Line up with online purchase data and your friends database, and you have even better recognition.

Also: RGPs, as in <http://en.wikipedia.org/wiki/GI_glasses>

[When I was 10 I had black nylon frames like those, and yes, I was made fun of a lot, so I became a kernel hacker :-) ]

</comment></comment><comment><USER4> As someone who's worked with computer vision, I doubt this is fully effective. It might prevent an exact match, but a good facial recognition algorithm can still whittle down the total possibilities. That's because your cheeks, ears and nose are also used as identifying features. The only effective cover is something that covers whole face.

<comment><USER5> Yeah, for it to be truly effective it would be to have some sort of halo of IR LEDs that are brighter than the ambiant surrounding light. This is probably not viable due to power requirements/cost.

</comment></comment><comment><USER6> You could wear these glasses, perhaps in addition to CV Dazzle[1], and be instantly recognizable in real life, and yet unrecognizable to computers. It's an interesting trade off.

[1]: <http://cvdazzle.com/>

</comment><comment><USER7> I doubt you would wear them 24/7, and you'd only want to wear them if you intentionally did not want to be recognized (at an airport/casino/robbery) but the fact that you had them on would draw attention to yourself, plus I suspect it'd be easy to trace back to the purchaser if the adoption rate were low.

</comment><comment><USER8> I don't get how near IR is able to distort facial recognition software.

Let's say I have a camera that cannot record in IR range, just the full spectrum. I can still run a facial recognition software using those photos.

I am well and truly lost about how it works

<comment><USER9> Almost all image sensors see near IR very well. Most consumer lens block IR very well, to make image similar to that perceived by human. Not so for CCTV lens: they don't block IR to allow human-invisible lighting via LEDs just like in these glasses.

<comment><USER10> Which implies that this wouldn't do anything to diminish facial-recognition from consumer devices (e.g., facebook auto tagging, Google Glass, etc.)?

<comment><USER11> Try filming an IR remote control (while pressing a button) with your phone's camera. It'll light up. I think it's pretty cool actually :) (might need to do it in a dark room, depending)

I suppose the GP was talking about actual non-phone photo cameras?

</comment></comment></comment></comment><comment><USER12> One step closer to Ghost in the Shell ([http://en.wikipedia.org/wiki/Laughing_Man_(Ghost_in_the_Shel...](http://en.wikipedia.org/wiki/Laughing_Man_\(Ghost_in_the_Shell\)))

<comment><USER13> Since you brought it up, the Laughing Man does the exact opposite, using image recognition to hide himself.

</comment></comment><comment><USER14> See Elton John for sunglasses that mean you cannot be recognised, apart from "Who the hell is that in the glasses - Elton John?"

</comment><comment><USER15> Wouldn't some old fashioned mirrored aviator glasses work just as well.

<comment><USER5> This obscure's the nose's biometrics. But other than that I think you're right.

</comment></comment><comment><USER16> <http://cvdazzle.com>

</comment><comment><USER17> They must have never heard of Groucho Marx glasses</comment>


SelectorGadget: point and click CSS selectors - <AUTHOR> http://www.selectorgadget.com/

<comment><USER2> I tried it on [http://selectorgadget.com/](http://selectorgadget.com/) and it doesn't work inside the comments (iframe issue?).

Otherwise pretty cool...</comment>


Porting a Golang and Rust CLI tool to D - <AUTHOR> https://pingfrommorocco.blogspot.com/2020/08/porting-golang-and-rust-cli-tool-to-d.html <comment><USER2> > For example, it fetched rpassword, a tool that hides password characters as > you type them into a terminal, much like Python's getpass function.

I want to note that you can call actual C functions from D without much extra effort.

Here's a program that calls getpass: [https://glot.io/snippets/fqf04b6wg2](https://glot.io/snippets/fqf04b6wg2)

<comment><USER3> Thanks! I added it in this PR: [https://github.com/azihassan/hashtrack- client/pull/11](https://github.com/azihassan/hashtrack-client/pull/11)

<comment><USER2> Oh, oops.

I forgot to edit my comment to add that, for some reason, it doesn't seem work on macOS. But if that's not a problem for you, then I'm happy I could help.

Edit: I just read the code, and it seems like you found out about that before I could warn you. :)

<comment><USER3> I didn't know actually, I only did it so that it would also compile on Windows (which I haven't tested yet tbh). Good to know it would still compile on macOS

</comment></comment></comment></comment><comment><USER4> I'm surprised that the rust binary is 3.5 times bigger. D is already templated to the nth degree, what more is rust doing? On top of that D links in a whole GC whereas rust does not?

<comment><USER5> Rust is statically linked by default, not sure how D works. Rust still includes some debug features that can give you a stack trace. Size will also depend on the compile options, if LTO was enabled, how much generics were used, how much string printing was used (print is a macro in Rust that generates code at the callsite), etc. Most, if not all, of these can be resolved.

See [https://github.com/johnthagen/min-sized- rust](https://github.com/johnthagen/min-sized-rust) for aiming for small binary size.

This article shows a 93% size reduction, 2.7m -> 200kb, with some relatively simple modifications [https://www.collabora.com/news-and- blog/blog/2020/04/28/redu...](https://www.collabora.com/news-and- blog/blog/2020/04/28/reducing-size-rust-gstreamer-plugin/).

Here is someone using Rust for a 3kb demoscene program [https://www.codeslow.com/2019/12/tiny-windows-executable- in-...](https://www.codeslow.com/2019/12/tiny-windows-executable-in- rust.html).

<comment><USER4> D is usually dynamic although I try to be static for the most part. IIRC The runtime is linked statically (or not at all) but Phobos is dynamic by default

Rust compiles seem to blow up pretty easily, e.g. I was cleaning out my SSD the other day an I noticed that a rust GUI framework (Iced?) was sat on about 2Gb of dependencies despite being significantly incomplete (but very promising)

<comment><USER6> > Phobos is dynamic by default

That depends on your distro. The packages from dlang.org all do the static link config out-of-the-box, but some distro packages dynamic link by default instead.

Given the size of that file, it looks static linked. It dynamic links libc, pthread, and a couple other OS-level things, but all D libs including druntime, phobos, etc, are statically linked.

Might just be difference in dependencies.

</comment></comment></comment></comment><comment><USER7> How can D use so little memory despite sporting a GC?

        Go Memory usage: 13mb
        Rust Memory usage: 9mb
        D Memory usage: 7mb

<comment><USER8> Another answer for this particular case is that the D program has less features. Quoting the blogpost:

> Rust downloaded a lot of crates, but that's probably because the Rust > version of the code has more features than mine has. For example, it fetched > rpassword, a tool that hides password characters as you type them into a > terminal, much like Python's getpass function. That's one of the many things > I don't have in my code.

<comment><USER3> Thanks, that could be part of it. I added some of the missing features, namely colored terminal output and getpass (thanks to the reply above), but the memory usage didn't fluctuate much. The D version is still missing websocket support for the "watch" command, but none of the clients use it in the benchmark.

</comment></comment></comment><comment><USER9> I've never really dived into D, but why was it never more popular? It seems like it was posed to take off, but never quite did.

<comment><USER10> D had an unfortunate early history. For a long time being a one man project, surviving through Python2 to Python3 akin transition and slowly maturing during all these years. Many top D features were added along the way but were not available from the start. Also in the beginning D focus was to be a better C++ with GC which is not something that excited C++ crowd who smirked as soon as they heard about GC and never actually approached the language. It is only later that it became clear that it is a separate unique language. I think D just grew and matured naturally into something very solid. D has a small but a very skilled team of seasoned C++ veterans and language designers. I dare to say, I am yet to see better forum answers than on forum.dlang.org both on the account of the language and programming in general.

<comment><USER9> Interesting, thanks for the synopsis. :) Sounds worth looking into.

</comment></comment></comment><comment><USER11> ...go Lang AND rust? Why would anyone do this to themselves?

<comment><USER12> If only there was a link to a post with more context somewhere, like in the first sentence on the page.

<comment><USER11> That doesn't resolve the question. It's a very odd combination of languages to decide to sling together arbitrarily.

<comment><USER12> Two statically compiled languages that get a lot of attention for writing tools in doesn't seem that odd choice to compare?

<comment><USER11> I mean you can statically compile a lot of languages and literally every language is used to write tools.

Go doesn't even use a stack compatible with the system abi and has probably the worst FFI of any language I've ever used, it has a very, err, unique type system. I mean there's a shit ton of great stuff too (compile times, great test patterns and pretty good tooling, the http stack and string manipulation and green threading is fantastic), I don't have it out for go! Meanwhile rust has a completely different memory model and type system and concurrency model, has probably the best FFI of any language outside of maybe some lisps and cpython and probably D (never used it), and they've taken forever to role out production ready http client/server stacks (though I think this is finally smoothing out!) I just don't see why they're tied together except a) static compilation and b) they emerged at roughly the same time.

Rust and go are very, very different languages aimed at completely different niches.</comment></comment></comment></comment></comment>


An Attack on Telegram - <AUTHOR> http://www.alexrad.me/discourse/a-264-attack-on-telegram-and-why-a-super-villain-doesnt-need-it-to-read-your-telegram-chats.html <comment><USER2> "Some viable alternatives I can recommend are Threema or TextSecure."

The problem with Threema and TextSecure is that it's hard to convince my friends to use them because

\- Threema is not free and does not have desktop/web clients, and multi-device setup is not supported afaik \- TextSecure is not really multi-platform

The only popular, multiplatform messengers at the moment are Whatsapp, FB Messenger, Viber/Line and Telegram. Whatsapp doesn't have a desktop client, Messenger requires a Facebook Login, Telegram and Whatsapp does not have voice chat and I hate Viber's design -> so I keep using Telegram for messaging and Skype for voice.

The network effects can be very nicely observed in messenger usages. In my home country almost everyone uses Viber, but in other countries I have worked (W-EU) almost everyone uses Whatsapp. In Germany people seem to know Telegram, in other places nobody heard about it.

<comment><USER3> Threema, Facebook, WhatsApp are not open source. TextSecure and Telegram have open source clients allowing for verification and trust of the protocol.

<comment><USER4> Not to mention, the source code on Telegram's website is woefully out of date. There has not been any new postings for a long long long time.

</comment></comment></comment><comment><USER5> I don't know why ChatSecure by the guardian project never comes up in these discussions: [https://guardianproject.info/apps/chatsecure/](https://guardianproject.info/apps/chatsecure/)

It uses Otr for encrypted chat, so you can use any otr client for the other side of the chat. I personally use pidgin on my laptop and ChatSecure on my cell. It currently supports at least iOS and Android, which encompasses most people that I know.

<comment><USER6> If I recall correctly the issue with ios xmpp clients is that you cannot run them in the background. Instead you must either have a provider that does push notifications or the client has to run constantly, draining the battery and closing automatically every now and then. At least that was the fatal result when I tried to convince friends to use xmpp a while ago.

<comment><USER7> _If I recall correctly the issue with ios xmpp clients is that you cannot run them in the background._

Why isn't this a problem for Android or Windows phone?

<comment><USER8> iOS has limited support for background processes.

</comment></comment></comment></comment><comment><USER9> Huh! Just yesterday I was fed-up with Textsecure being so buggy and bad that I looked at the Telegram homepage and thought "nice" apart from not completely being free software (or is it?). It says "Telegram messages are heavily encrypted and can self-destruct." which made me believe that all messages are heavily encrypted.

Now this post says "By default, messages (...) are logged and stored on Telegram's servers". Damn.

<comment><USER2> "By default, messages (...) are logged and stored on Telegram's servers".

Because most of the users need this for keeping the message history and they would not use Telegram otherwise.

<comment><USER10> It also provides the user the ability to use several clients, e.g. on smartphone + laptop + tablet. That's a big advantage over e.g. WhatsApp.

<comment><USER11> This is why I use Telegram.

I was spending far too much money sending SMS messages to my friends overseas. A few hundred per month at EUR0.12 each starts to add up pretty quickly. Data is cheap, so instant messengers tend toward being almost free.

Telegram has official clients for my FirefoxOS phone and for my Linux desktop.

I've never used their secret chats. I appreciate their open source nature and am happy to support them.

</comment></comment></comment></comment><comment><USER12> I find it interesting in how there is some dependence on the fingerprint secret being shared across the Telegram channel in order to verify identity.

What if a user sends the screenshots of the fingerprint over, say, a medium decided in the chat on the fly? Unless you can MITM every service they're using, you could just /tweet/ the fingerprints, for instance, and check on a different machine for a matching key. Or what if the screenshot is tampered with by hand, like, signing the center of the square with a finger drawn, transparent signature? How would an attacker replicate that?

Of course, the "supervillain" model still works and enough computation time and power might find it, but there are a multitude of ways to ensure that the secrets match on everyone's devices.

</comment><comment><USER3> Every one of these new chat systems have similar problems with key authentication. they fail in similar ways and try to solve the problem in similar and different ways. This articles contribution, while very valid with its "greater than though" tone, is gets on my nerves. I have no idea why it always seems to be a constant when people talk about Telegram without really investigating the dramatic headlines authors claim. Is it that we just hate anything engineered in Russia, China. Its boring already.

<comment><USER13> Do you have a data point to suggest real bias against the geographic engineering behind Telegram?

All the substantial warnings I have read against it revolve around its lack of a respected crypto team (in fact, not having any experienced crypto team and conflating a bunch of maths PhDs with a real crypto team), not using acknowledged crypto design best practices (and flagrantly ignoring them for counrer-intuitive designs), and most importantly, using a contest instead of a real audit.

Contest != audit. An audit has a specialized team of cryptographers who try to break the application in any scenario. A contest has restrictive scope that sets up a strawman and doesn't attract real, serious crypto auditing. As an example, this article's MITM doesn't qualify despite being a real attack.

A contest means that you have no real knowledge of whether the crypto is broken if nobody succeeds. An audit means you can be significantly towards certain. You might already know this, but consider that if someone hosts a contest instead of an audit, and has all the _other_ issues stated above, they will be met with hostility.

<comment><USER3> Valid criticism but I feel the items you mention get blown out of proportion. The Cryptocat team had similar areas where it was lacking and yet did not suffer the same backlash. This could be because they never ran a competition and worked to find a way to fund an audit several years later instead.

The data point(s) that lead me to wonder of a geographic bias have to due with the tone of prior analysis of telegram I've read over the past year. This article included. And also a general, very male, arrogance in the security community that seems to constantly search for any reason to ridicule. I will have to go back and trace the history of my perception to find the tone I mention, which I can do tomorrow if you likewise can provide a datapoint for your understanding that they flagrantly ignored crypt design best practices.

In watching the evolution of Pond, Telegram and TextSecure we see that to solve security or usability problems designers are required to venture to some degree into uncharted territory, away from best practices. So I question the flagrant claim.

But I agree contests are just marketing ploys, little else. If Telegram wanted to "claim" otherwise they would need to start with paying the analysts from this article the full bounty.

<comment><USER14> You might be the first person I've ever heard suggest that Cryptocat didn't have a "backlash". Cryptocat comes pretty close to being reviled. It's 10x more so in private conversations between technical experts, but it's also very visible publicly.

(I think the project deserves the flak it takes, and continues to endanger its users today).

The "Russia" thing is just dust people throw into the air to thwart reasoned discussion. People don't like Telegram because it is _prima facie_ cryptographically incompetent. There's no one resource that sums up all the brokenness and weirdness --- certainly not Alex's post here, which concerns itself with a specific bug he and Juliano found. You have to collect all the data and paint the picture yourself.

<comment><USER15> You're always present when crypto comes up and I honestly usually _wait_ for that opinion.

Now, let's ignore Telegram for a second. I haven't installed it, ever, but the feature set seems compelling and the UI (screenshots, demos) is nice.

Would you agree that the Better Stuff™ is just less usable and less accessible right now? Is there a way we can fix that?

If Telegram gets the UX right, but fails in the underlying implementation, can we take a decent implementation and fix the UX issues?

See, Moxie's solution just plain doesn't work. I'm sure it's sound and great, but .. it uses a phone number as the identifier (like WhatsApp, and that's not something I'd like to be compared with). What about my laptop or tablet? What about cross-platform solutions? I'm trying to migrate to FxOS as soon as they fix some mail related shortcomings. There seems to be a Telegram client. No (official) WhatsApp client and I doubt that most of the 'better' alternatives offer something here.

If we distill this post into one line: How can we have a decent user experience, without throwing out privacy and security?

What would be the best candidate to start from, because .. all of them suck right now?

<comment><USER13> This wasn't directed towards me, but I'll participate.

 _> > Now, let's ignore Telegram for a second. I haven't installed it, ever, but the feature set seems compelling and the UI (screenshots, demos) is nice._

Agree. I think Telegram has a nice design.

 _> > If we distill this post into one line: How can we have a decent user experience, without throwing out privacy and security?_

Here is the thing, this is a relatively new ground. The technology for secure messaging systems has been around for a much longer time but it wasn't as popular or fashionable.

You _can_ and _will_ have secure messaging built on solid crypto with an attractive user interface and available everywhere. That's Moxie's long-term goal.

But this is how you get there (choose your adventure):

1\. Build the world's sexiest user interface for secure messaging apps and focus on cross-platform compatibility, while building it on top of an _okay_ crypto system (or worse, a weird custom one that ignores industry practices). Once you have mindshare, gradually improve your crypto (Telegram is demonstrably not doing this by conflating a contest with an audit, but that's another comment). You'll start off with a lot of hype and users, but not much respect from the information security community because, well, you haven't earned it yet.

2\. Take a respected crypto team, build out the world's best crypto system for a secure messaging app, leveraging both established best practices and professional peer review. Focus on building a really good prototype in one area with an acceptably attractive and functional user interface, putting other things on the backburner in order to finish a _core product._

3\. Go for the hail mary and try to build out the most amazing crypto system with the most amazing user interface and the most amazing features running on everything from iOS 4.4 to bleeding edge Debian to please everyone. In a year, burn out and die off because you almost certainly don't have the Herculean development resources this would require in completely orthogonal disciplines.

Which of these tracks sounds most like what successful startups do?

I acknowledge your point that no offering is perfect right now. But TextSecure focuses on the right things.

If I could sum this up entirely: nothing is perfect (yet), but TextSecure is the best offering on the market for a secure messaging application, and if what you want is a secure messaging application, start from solid crypto and work your way to everything else, not from a sexy user interface to okay/passing crypto.

Telegram might very well have the best of intentions in mind and it might have solid crypto under the hood. But that's the sort of thing you consider false until proven true, and so far their behavior is similar to a company that promises a fantastic new service in financial trading but prioritizes ubiquity and design without ever auditing the core trading system itself.

<comment><USER15> Hey. Thanks for getting back.

So, you're basically saying TextSecure is the real thing (unsurprisingly) and that it might just add the UX related stuff (multiple devices, devices that .. well .. don't have a phone number) later.

I'm still unconvinced.

I can follow your argument if we're talking crypto only (Disclaimer: I .. shouldn't talk about crypto). So, ignoring Telegram again, TextSecure is putting encryption first. Great. Except that I don't see a way to remove the base assumption here. "Your identifier is a mobile number".

That is absolutely crap. Both for UX reasons (see above and up-thread, devices that I own that cannot claim my mobile number) and .. because I don't want to share my mobile number for random IM chats. Again: Yes, my mobile number _might_ uniquely identify me. No, that is not a cool 'user name' in any sort of messaging app.

I fail to understand how TextSecure can go from this fatal and flawed assumption and .. fix that. It's broken. The encryption might be sound, but the idea is crap. Granted, I'm not the best programmer and far from a crypto expert, but .. it seems to me as if changing this fundamental assumption would be hard to do for TextSecure. Their partnership with WhatsApp makes it worse, because those guys do the same insane bullshit and just tell your mom, your ex and your aunt twice removed that you're now available to chat on WhatsApp.

Let me state it differently: I have TextSecure installed. I cannot run it. It is, at this point, utterly unusable. I wouldn't know how I could market this to friends or family, because it is unusable.

How can we fix that? How can we - again, I've never installed or used that one, but it's the thread's topic right now - approximate Telegram?

<comment><USER16> I would have to agree with you on that one - TextSecure seems like a great option, with the exception of its reliance on mobile numbers. This is mostly because they're centrally controlled, and at no point do you actually "own" your mobile number.

Changing this wouldn't be a big deal, as TextSecure doesn't really use mobile numbers for anything important as far as I can tell. I get the feeling it was more intended for ease of use among the average person, but it is frustrating for someone who would rather get rid of mobile numbers altogether.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER17> "If there was a way to efficiently cycle through DH parameters, an active man- in-the-middle attacker could spoof the fingerprint."

Isn't this a rather big if? In my limited understanding of the math involved, the whole reason dhe is still secure is because this isn't the case. Which means an attacker couldn't just use any old sha1 collision, it would have to corellate to a valid set of dh params, which would have an effect on the computational complexity, right?

<comment><USER18> This is not a attack on DH, it is a attack on the verification mechanism. So the trick is, the attacker does not need to break DH, he just needs to find two sufficiently similar DH parameters, that the verification still works.

<comment><USER17> I understand that this is not an attack on DH. I have not analyzed telegram but the statement I quoted seems to indicate it would need to be able to quickly generate many DH params. That doesn't seem to be a a computationally trivial task. [http://security.stackexchange.com/questions/51129/can-you- ge...](http://security.stackexchange.com/questions/51129/can-you-generate- diffie-hellman-parameters-quickly)

It seems like for this attack to be realistic you would need the math underlying DH to be broken somehow. At which point I think there are many applicatons who's security would be compromised that are far more disturbing than the security of telegram.

Again I am asking for clarification because I may be misunderstanding the use of the quoted text and I have not looked at the code myself.

As I read it, this analsis seems akin to someone stating that, a wall provides no security if we lived in an alternative universe where solids could freely pass through one another. That statement maybe true but who cares, that universe wouldn't continue using walls for security measures anyways. Excuse my metaphor there, I hope it clears up what I was asking about.

<comment><USER18> As far as I understand the attack, the attacker brute forces his own DH secret, not the DH parameters. So attacker has the parameters for both connections, gets the public keys from both chat partners and then brute forces two secrets such that the hashes of the resulting DH shared secret match. For this the attacker needs 'only' to brute force the keys, not the parameters.

</comment></comment></comment></comment><comment><USER19> They still didn't release the server code, didn't they?

<comment><USER20> And what would this accomplish exactly?

<comment><USER19> It can start a discussion on trusting it. Without that code it doesn't even start.

<comment><USER21> Wrong, the whole point of end-to-end encryption is that security doesn't rely on intermediaries working as expected; they're only transports. Which is why having Telegram's server code wouldn't be useful from a security POV.

What it could be used for instead is running alternate "pods" to distribute load over multiple servers.

<comment><USER19> It's not all end to end. And there is a difference if the server is a malicious one.

Anyway, since the service is centralized and not federated even if it will become all end to end encrypted, it's enough of a reason not to use it.

</comment></comment></comment></comment></comment><comment><USER22> Isn't all this pointless when Telegram could just MITM everyone at will of any agency, as the client is closed source?

Unless the whole client code is audited by third parties (and it is ensured that app store version = audited version), this whole exchange of keys with colorful qr code could be a charade.

<comment><USER3> wtf? client is all OSS [https://telegram.org/source](https://telegram.org/source)

<comment><USER13> I believe the OP was referring to the fact that you have no assurance the application binary you receive on mobile is the same as the public open source version. This goes hand in hand with a third party audit.

Whether or not it's open source doesn't mean much if you can't audit it. Open source counts if you're a developer and can read the code to see that a piece of software isn't e.g. calling home with user credentials in cleartext and storing them or worse.

But this is a custom cryptosystem. Most people can't audit it, and the people who can are not going to use their (extremely lucrative) skillset on the software without personal investment like "I want to use this."

Are they going to pay a consulting firm like Riscure to completely audit the codebase? No? Then it is insecure until proven secure. Open source isn't good enough.

<comment><USER3> Okay this problem of binary verification you should blame on Google and Andriod app ecosystem. At least on andriod if you install the apk yourself with Telegram and TextSecure you know exactly what you are running. For everythign else, you have no clue.

<comment><USER23> > if you install the apk yourself [...] you know exactly what you are running

No, you don't. You know what you're running only if you compiled the sources or if you can compare the binary signature with the build of someone you trust (you or others that built from sources).

<comment><USER3> Indeed. Or to go further, you can't trust even compiled sources you place on dev mode device if you didn't also compile the entire OS and drivers. Still, not Telegram/TextSecure's fault

<comment><USER23> I think that since these programs are all about security, they do have some obligation to distribute securely their binaries, more than a torchlight app. For example I'd be more at ease if the binary distributed by Telegram had the same signature present in a document signed by whoever did the audit (maybe it's even like that, I don't know).

Of course I still have to trust my OS, but if the OS is compromised I have utterly lost.

<comment><USER3> The scenario that merits trusting the OS, or app store, is one that assumes you are not individually a target. This means you trust Apple/Google and US/EU. I don't know, I could see there being reason for scenarios that fit this use case but have trouble bringing any to mind other than making fun with crytpo to feel better about yourself, or just muddy the lines for the FBI. If you're an activist, most definitely you fall outside this scenario and shouldn't be using these phones.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER24> So the attack is due to the fingerprint of the key being smaller than the actual key and therefore theoretically possible to find another key with the same fingerprint..

Doesn't textsecure and threema have the exact same problem? Both show a fingerprint to the user instead of the actual key.

<comment> semi-extrinsic If that's the attack, then it's well known that PGP is also vulnerable to the same thing: [http://www.asheesh.org/note/debian/short-key-ids-are-bad- new...](http://www.asheesh.org/note/debian/short-key-ids-are-bad-news.html)

</comment></comment><comment><USER25> "This past spring, Juliano Rizzo (@julianor) and I came up with a cryptographic attack on Telegram's MTProto "secret" chat communications which can be performed in O(2^64) time."

Using asymptotic notation without an argument (usually "n") makes me cringe. O(2^64) = O(1)

</comment><comment><USER26> [https://crypto.cat/](https://crypto.cat/) is another alternative.

<comment><USER27> There is still no Android app so I'm not sure we can consider it as an alternative.

</comment></comment><comment><USER28> O(2^64) is the same as O(1)

Pretty pointless estimate.

Just for reference to see how large 2^64 is,

2^64 microseconds = 584,555 years

Even if you find 10,000 computers capable of 1 million checks per second (a huge "if"), it would still take 58 years.

<comment><USER29> Maybe it's the historian in me, but I found your numbers really, really funny!

>Even if you find 10,000 computers capable of 1 million checks per second (a huge "if"), it would still take 58 years.

I'm sorry if I'm missing the context but it sounds straight out of 1958! Like, when a PC takes a room, costs $2.9 million (2014 $23.1 million), and comes with a with a processing speed of around 100 Kflop/s [1]

Like, "even if you find TEN THOUSAND" computers - like where would anyone find ten thousand computers in 2014

(Amazon and Microsoft's cloud farms only have like a million servers instnatly available on their clouds).... capable of a MILLION checks per second! That's a full Megahertz!

It would still take you 58 years :)

:-D Sorry!! It would have been a good argument in 1958 though :-D

[1] [http://en.wikipedia.org/wiki/IBM_7090](http://en.wikipedia.org/wiki/IBM_7090)

<comment><USER30> 2^64 is expensive, but breakable.

<comment><USER29> I was specifically referring to the OP's awed overtones of 10,000 x 1 mhz, resulting in 58 years. Which I found really funny.

The idea of 2^64 being inherently a large number... when a single graphics card costing a couple of hundred incidentally goes through 2^64 flop's all by itself every few weeks.

There's nothing expensive about 2^64 as such. I mean it's expensive in the sense of, we're talking dozens of dollars here :)

</comment></comment></comment></comment><comment><USER31> I like [https://icrypt.me/](https://icrypt.me/)</comment>


Survey: IT staff would steal secrets if laid off - <AUTHOR> http://www.itworld.com/security/54579/survey-it-staff-would-steal-secrets-if-laid

<comment><USER2> Surprised? Not really. Ethics are at an all time low in the corporate world, and if some anonymous entity is going to lay you off, people wonder why they shouldn't gain a little "payback" value from it by stealing secrets? I'm not recommending people do this, but the motivation is obvious.

</comment><comment><USER3> 1) Cyber-Ark sells security products. Any security-related "facts" coming from them are suspect.

2) Everyone takes passwords with them when they leave, what am I supposed to do, _erase my memory_? I bet the "survey" was worded to include this...

</comment><comment><USER4> thats why companies let people go on Friday and tell them to leave right away.</comment>


In smart apartments, is privacy for rent? - <AUTHOR> https://www.bostonglobe.com/2020/02/11/business/smart-apartments-is-tenants-privacy-rent/ <comment><USER2> Not for me, because there is zero chance that I'd be willing to live in a place that does this.</comment>