I know the websites you visited - <AUTHOR> http://lcamtuf.coredump.cx/cachetime/ <comment><USER3> Thanks for all the insightful comments about how this "didn't work for you" or "I'm paranoid so I survived this"?

It works. It works enough of the time and on enough browsers to be very relevant to anyone who cares about the privacy/security of internet users at large.

This is an impressive proof of concept, and an important thing to be discussing, yeah?

[EDIT] To clarify, I tested this on Firefox 8.0.1 on my 2011 iMac with Lion and it worked flawlessly one by one as I visited the sites "Facebook, Reddit, Flickr", they turned from gray to green in each subsequent test.

<comment><USER4> I don't know if it's accurate enough to be a concern. What could an attacker do with such information that is so scary? They could publish "IP address X has been to Y, Z, and W recently", or they could use it to target ads, I guess, but it doesn't seem like it's reliable enough to cause any serious harm. You could just say, "Um, no I haven't" if it becomes an issue.

It did correctly detect some sites for me, but it gave one false positive and three false negatives. With that kind of error rate I just don't see it being taken seriously in anything that matters.

<comment><USER5> You are a sample size of 1.

<comment><USER4> Read the rest of the comments here. Everyone else is having similar problems. Also, please spare me the expected "This is all anecdotal/sample size of 30" follow-up. Perhaps you can answer the real question -- is this valuable to anyone if it has a significant error margin? I think it wouldn't be allowed a margin of more than 1% if it were to be useful, and even that is kind of pushing it if you intend to do anything important with the data -- if 20 sites are tested per visitor, a 1% error rate would mean that an incorrect detection would occur every fifth visitor or so. That's enough to allow plausible deniability in my book.

<comment><USER6> FWIW, I added several improvements, and according to the built-in survey, it works for about 95% of all visitors. If you had bad results initially, clear you cache and give it a second try.

</comment></comment></comment></comment></comment><comment><USER7> Very simple summary of the technique:

To test if a user has recently visited Facebook, see how long it takes for the Facebook logo to load when called from your own page. If it's relatively fast, you can assume the image has been cached by the user's browser ... meaning the user has recently visited Facebook. If it's relatively slow, you can assume no cached version of the logo is available, so the user probably hasn't visited Facebook recently.

Results are fuzzy because "relatively fast" and "relatively slow" are not precise.

<comment><USER6> Author here. It's not exactly that; the <img> approach is commonly suggested, but it has some serious limitations (explained in the source code).

Instead, I time <iframe>s, which allows SOP violations to be trapped the moment the browser barely starts thinking about rendering the target page. The other benefit is that <iframe> requests can be aborted quite easily when they are taking long enough for us to suspect cache miss - before the request is completed and cached.

The results should not be fuzzy, although the PoC uses hardcoded timings instead of doing calibration, which makes it a bit tricky with "outlier" clients (very fast or very slow).

I made some minor tweaks today, and the success rate should be greatly improved; there's now a mini-survey on the page, looks like ~90% of the people who bother to complete it are getting accurate results.

<comment><USER8> If it loads the page in an iframe, wouldn't future loads give a false positive?

Also, does this work for Google+ (I don't have an account)? I'd be surprised if it did, since it uses X-Frame-Options.

<comment><USER6> If you allow the load to complete, yes. But the idea here is to very quickly decide that you're not getting a cached copy, and abort the request (by changing src=) before the browser has a chance to read anything back and figure out what to do with it.

</comment></comment></comment></comment><comment><USER9> It is missing some sites which have https-everywhere rules. Still a scary thing; looking at the comments in the source, would coalescing load events deter the attack, or at least make it probabilistic and slow? And why isn't Firefox displaying requests to the sniffed sites while it attempts to access them? The request is already issued, even if the script manages to abort it before it completes.

</comment><comment><USER10> Let's hope it doesn't attract the typical browser developers' slapdash response of "let's fix this by breaking the DOM," as happened with the :visited trick.

<comment><USER11> Seemed like they fixed :visited as best they could. What would you have done?

</comment></comment><comment><USER12> I accidentally fireproofed myself against this attack. I have the Web Developer extension installed and I forgot I had the Disable Cache option on.(The script works as advertised with it off.) Not really practical solution if you want pages to load fast.

<comment> mike-cardwell The conventional wisdom is that you need web cache for a fast browsing experience. I disabled mine completely a few months ago and cant tell the difference under normal usage. Try it, you'll be surprised.

</comment></comment><comment><USER13> As it turns out, I'm one of the minority of users who keep NoScript in paranoid mode until I really want to see something supplied by JS -- and then I'm likely to only give temporary permission and turn that off when I'm done.

Obviously, this didn't work against me.

<comment><USER14> Same here. I enabled it after reading the code and it detected Facebook and G+. The latter is possible (links from HN), but I never go to the former. It also failed to detect some of the others.

</comment></comment><comment><USER5> Why the need for a "sub-ms" timer implementation? Just do a while loop and constantly check for the SOP exception (or for Xms to have elapsed). Set a timeout between checking URLs. The ~10ms blocking of each URL check will not be noticeable to the UI.

Nice PoC though, and thanks for the lack of press release ;)

Edit: I just tried this out and it appears that the looping JS blocks the iframe from loading. I would have figured the iframe would be a separate JS thread. I'm wondering -- do all iframes share the same JS thread? Can one iframe block another? Anyway, it's clear that some sort of asynchronous solution is necessary.

<comment><USER6> Chiefly because if you have a fast machine, good connection, and a nearby CDN node, ~10 ms may be enough to establish a connection, make a request,and see the response.

Plus, if you do setInterval(..., 1) and then measure new Date().getTime() deltas, you will probably see that even if the browser isn't doing anything taxing, you get 100 ms or more every now and then...

I'm assuming there is someone working on JavaScript-RT as we speak, though ;-)

</comment></comment><comment><USER15> It reports completely bogus entries for me, which I never visit:

         Blogger - <USER2>
         Bing
         Google search (UK)
         eBay
         PayPal
         MySpace
         LiveLeak
         Playboy
         Sears
         Lowes
         Newegg

These are besides entries like Wikipedia, Google, Facebook, Youtube, LinkedIn, Reddit - which most other people here are visiting.

If this is based on actual info taken from :visited selectors, apparently they are useless (maybe these are reported because of banners or scripts loaded from those sites or something?) and one could do a better job by just faking it.

<comment><USER14> _If this is based on actual info taken from :visited selectors, apparently they are useless_

It's not, it's based on trying to load some URL from the website and measuring the time it takes. If you went there, it should be on the cache and take much less time to load.

It doesn't seem to work that well, though.

</comment></comment><comment><USER16> People may be using it wrong. My browser cache clears every exit (likely for most people at HN). I had a new session going so it didn't detect where i went because there was no history. When i went on facebook and tried it again, facebook showed up. So the attack does work in some cases.

The one good thing that could come out of this is that websites with the gianto bar of "follow me/like me" icons could be different sized based on if you detect that the user has went to certain social media site.

<comment> mike-cardwell Clearing your cache between sessions is not good enough. Just disable your cache altogether. It works better than you'd expect.

</comment></comment><comment><USER17> it detected some sites ive never been to (arent in history) oddly. they dont seem in cache or via adverts either. some others i went to were detected, but..

<comment><USER18> Maybe you just have a really fast internet connection?

</comment></comment><comment><AUTHOR> The webtiming paper provides more information on this form of attack - <http://sip.cs.princeton.edu/pub/webtiming.pdf>

The summary of the paper makes me sad - > We are not aware of any practical countermeasures to these attacks. There seems to be little hope that effective countermeasures will be developed and deployed any time soon.

<comment><USER19> Didn't work in Firefox 8.0.1

<comment><USER20> Try the original: <http://lcamtuf.coredump.cx/cachetime/orig.html>

It worked for me on Chrome. The one linked now gives some weird entries.

<comment><USER21> Still doesn't push through noscript.

</comment></comment></comment></comment><comment><USER22> Very random results. I used this on Firefox (beta nightly) and on a fresh start got no entries. When I opened Facebook in another tab then quickly ran again, it said I had gone to Facebook, Twitter and Blogger. When I retried, just Facebook. It also said I went to almost all the eCommerce websites without me having visited any.

</comment><comment><USER23> The firefox version from the tor browser bundle does not seem to be vulnerable to this attack.

<comment><USER24> Of course. It shouldn't be caching anything to disk.

<comment><USER25> Or even RAM?

</comment></comment></comment><comment><USER26> I have largely varying results in FF9.

The idea is interesting but, considering that the performance of the client (-box) can affect the results, it doesn't feel very viable.

What about DNS cache probing? Is it possible? I guess it will suffer from similar results but at smaller scale.

<comment><USER26> The old script works better form me. Less false positives and rather stable results.

</comment></comment><comment><USER27> It got just youtube right for me. Considering the websites it's saying you might have visited, there's a high probability of getting at least some right because a large population on the internet visit those sites. Looks bogus to me!

<comment><USER28> just give it a try: I visited none of these websites before checking, it got it right, then I opened Amazon, Twitter, ... and they were detected perfectly!

<comment><USER27> I opened twitter. And now it thinks I visited youtube for some reason :-/

This is on Firefox 8.0 on Fedora Linux. Maybe the OS has a lot to do with the success rate?

Edit: I just read through the technique now and there's no way it could depend on the OS. Anyway, this is way too inaccurate to be of any practical use.

</comment></comment></comment><comment><USER29> You can also use the same method (or similar) to check if a user is logged-in in any 3d party websites.</comment>


JavaScript in One Pic - <AUTHOR> https://raw.githubusercontent.com/coodict/javascript-in-one-pic/master/js%20in%20one%20pic.png

<comment><AUTHOR> Link to repo - [https://github.com/coodict/javascript-in-one- pic](https://github.com/coodict/javascript-in-one-pic)</comment>


Braid 10th anniversary critical compilation - <AUTHOR> https://www.critical-distance.com/2018/07/24/braid-10th-anniversary-critical-compilation/ <comment><USER2> I love Braid so much.

First, the soundtrack, songs by Jami Sieber and Shira Kamman, were phenomenal. The gorgeous cello and violin are so atmospheric, and they also sound good backwards and sped up -- necessary for a game like Braid, and chosen for that reason.

Secondly, the artwork - that naive 2D platformer style but combined with gorgeous and subtle shading and depth that really showed it was something special. We're used to games doing this now, maybe.

Thirdly, the structure of the game itself as a critique of the traditional Mario-style platformer with its jumps, princesses and castles. It was like playing a postmodern game.

Then there's the relationship between the level's gameplay theme and the lesson it's trying to teach. This was something I saw Elizabeth Sandifer point out. The first level is all about being able to undo the mistakes of the past. But then we learn some mistakes are too big to undo. We learn about how a ring can change things in a relationship...

And then there's the two levels of twist ending and how they relate to games and gaming, especially a decade ago when it was much more a male pursuit.

Honestly I could talk about Braid for hours.

<comment><USER3> > Honestly I could talk about Braid for hours.

Please do. I wouldn't mind more elaboration on any of your points!

</comment></comment><comment><USER4> That first rewind moment in Braid!

Few games trigger that "wow" reaction. For me it was like the bullet time moment in the Matrix; an almost hallucinatory experience that changes your perception of what a medium can be.

This was something new — something different — something great.

If you loved Braid and are looking for a similar feeling from more recent games, I highly recommend Inside and Limbo from Playdead:

[http://playdead.com/games/inside/](http://playdead.com/games/inside/)

[http://playdead.com/games/limbo/](http://playdead.com/games/limbo/)

<comment><USER5> I argue against both of those recommendations. Braid is a strong puzzle game with finely crafted puzzles that can leave you bewildered for ages. Both Inside and Limbo are obvious on-the-rails platformers with no puzzles to speak of. I've played all three to 100% and, of them, only recommend Braid.

For good puzzles, look to Stephen's Sausage Roll, English Country Garden, HexCells. Also, many recommend The Witness, made by the creator of Braid.

<comment><USER6> As a fan of puzzle games, I just want to chime in and say Stephen's Sausage Roll is possibly the most perfectly designed puzzle game ever made.

<comment><USER7> disagree, the tower of sausage level is a clear, horrible mistake.

other than that, yes.

<comment><USER6> On the one hand I can't disagree too much with that because Lavelle admitted it introduced too many concepts, but on the other hand I thought it was a good way to challenge the player to overcome their initial intimidation, and wasn't nearly as hard as people make it out to be.

</comment></comment></comment></comment></comment><comment><USER8> Braid is maybe favourite game of all time.

The way it plays with the time dynamics and weaves it into it's story is brilliant.

I love the way it fed you story via the books and the way the levels play style were linked to the story.

It also has a brilliant soundtrack, e.g.:

[https://www.youtube.com/watch?v=4bTZMKVTM9k](https://www.youtube.com/watch?v=4bTZMKVTM9k)

<comment><USER9> Piggybacking on the great game OSTs topic: the one of FEZ, by Disasterpeace

[https://music.disasterpeace.com/album/fez- ost](https://music.disasterpeace.com/album/fez-ost)

<comment><USER10> Also check out his Hyper Light Drifter soundtrack, and newly released "Disasters for Piano"

<comment><USER9> Thanks!

</comment></comment></comment></comment><comment><USER11> Jonathon is an active HN member, though I am sure he is tired of discussing Braid in depth.

[https://news.ycombinator.com/user?id=jblow](https://news.ycombinator.com/user?id=jblow)

<comment><USER12> Do you think? I always got the impression he was very generous with his time and loved sharing his work with others.

<comment><USER13> I think there are particular topics and arguments that he finds tiresome, like people demanding that he explain Braid's point in words, or claiming that he doesn't like Linux development because he just doesn't understand how it works (and not because he's legitimately flabbergasted that the UX can be described as a time warp to the '80s, if one is feeling generous).

</comment></comment></comment><comment><USER14> Some remarkable recommendations of "similar" games appeared in this thread. I'd like add _The Company of Myself_ [0] and its perhaps even better prequel _Fixation_ [1]: I think it neatly fits this "philosophical indie platformer" niche. If you haven't yet, try them while you can (yup, Flash based).

[0] [http://2darray.net/portfolio/the-company-of- myself/](http://2darray.net/portfolio/the-company-of-myself/) [1] [http://2darray.net/portfolio/fixation/](http://2darray.net/portfolio/fixation/)

</comment><comment><USER15> A Great interview to Jonathan Blow for Tone control podcast, that talks about his history up to The Witness: [https://www.idlethumbs.net/tonecontrol/episodes/jonathan- blo...](https://www.idlethumbs.net/tonecontrol/episodes/jonathan-blow)

</comment><comment><USER16> That final level of Braid, when you start to understand what's going on. I get chills just remembering it. One of my fondest memories gaming.

</comment><comment><USER17> The importance of Braid is primarily that it was the first game which was intended to be a piece of art, rather than a toy for children, which had any kind of mass market appeal.

It was the way people engaged with it seriously, in terms of gameplay and narrative and how the two interacted that made it important.

I think Amnesia and Portal were two other games that came out around the same time that were also similarly important.

<comment><USER18> > the first game which was intended to be a piece of art

There have to be earlier contenders than this, surely? Yes it's the ancestor of the modern wave of artistically-aspiring games but game development dates back to the 1970s.

<comment><USER17> I dunno. I've been playing video games since the Atari 2600 and I don't think I recall any mainstream games that interacted with the 'art' world in a serious way. There were rpgs and such with serious stories, but I don't think they were taken seriously by art critics in the way that Braid was.

<comment><USER6> Given the primitiveness of the medium as one goes farther back in time, I think it is unfair to say that none of them really attempted to communicate artistically with the player. Notably Missile Command was made to be unbeatable as a statement about the futility of nuclear war, and Donkey Kong was designed by an artist who injected thematic elements not previously utilized in the medium. That the "art world" didn't really engage with them doesn't mean much because art, like all communication, requires shared understanding to have meaning, and very few people would have been exposed to the (still in its infancy) culture necessary to understand artistic expression in the medium.

<comment><USER12> > Missile Command was made to be unbeatable as a statement about the futility > of nuclear war

I'm a huge Atari fan and this is the first I've heard of this. Pretty profound if true. Thanks for the insight!

<comment><USER19> Originally intended to be called Armageddon. End of game screen of "The End" instead of Game Over as a result of that same futility. Dave Theurer talked about it in some depth here: [https://www.polygon.com/features/2013/8/15/4528228/missile-c...](https://www.polygon.com/features/2013/8/15/4528228/missile- command-dave-theurer)

</comment></comment></comment></comment></comment></comment><comment><USER20> are there any games like for the mobile (especially android) ? I always though the mechanics of Braid would have been better adapted for a mobile touchscreen

</comment><comment><USER21> Braid is a masterpiece.</comment>


TLA+ in Practice and Theory, Part 2: The + in TLA+ - <AUTHOR> https://pron.github.io/posts/tlaplus_part2 <comment><USER2> Thanks so much for this introduction! For anyone interested, here is a link to Lamport's video introduction to TLA+, which I found really helpful and interesting [http://lamport.azurewebsites.net/video/videos.html](http://lamport.azurewebsites.net/video/videos.html)

</comment><comment><USER3> I'm really enjoying reading about tla+ in the articles that have been posted lately.

</comment><comment><USER4> It seems odd that the math is defined in such detail when this isn't supposed to be a tutorial or a reference. The emphasis on justifying and motivating TLA+ as a practical thing to learn suddenly disappears, and it's just one definition after another.

(It's also unclear to me whether these definitions are actually TLA+, since it's using non-ascii symbols. How esoteric is this language?)

<comment><USER5> > It seems odd that the math is defined in such detail when this isn't > supposed to be a tutorial or a reference. The emphasis on justifying and > motivating TLA+ as a practical thing to learn suddenly disappears, and it's > just one definition after another.

My goal isn't to justify TLA+ as a practical thing to learn. The articles and tutorials I linked to in part 1 already do an excellent job at that. My goal is to do a deep-dive into the mathematical theory of TLA+, intended either for those who already know TLA+ or those who are interested in the theory of formal methods and formal mathematics. A little like how som Haskell programmers want to learn category theory.

> It's also unclear to me whether these definitions are actually TLA+, since > it's using non-ascii symbols.

Yes, it's actual pretty-printed TLA+ code. You type it using ASCII symbols (`==` for `≜`, /\ for ∧, `~` for `¬`, `\in` for `∈`, `\A` for `∀`, `\E` for `∃`, `[]` for `◻` etc). In the IDE you edit in ASCII and can view the pretty- printed version. There's work on displaying in Unicode as you type.

> How esoteric is this language?

It's not as popular as Java or Python, but it's more popular than Coq. Amazon uses TLA+ to specify and verify most of AWS, Oracle and Microsoft do the same for some of their cloud services, and if you head over to [https://www.reddit.com/r/tlaplus/](https://www.reddit.com/r/tlaplus/) you can see other uses.

</comment></comment><comment><USER6> It'd be nice if "TLA+" were defined somewhere early in this piece.

<comment><AUTHOR> here you go; [https://pron.github.io/posts/tlaplus_part1](https://pron.github.io/posts/tlaplus_part1)

</comment></comment><comment><USER7> Title should be fixed. It's "The + in TLA+", not "The and in TLA+"

<comment><USER8> Thanks, updated!</comment></comment>


Why we do not have Internet users Association  - <AUTHOR>

There is almost millions of associations to protect the rights of its members. But we do not have 'Internet users Association' that could protect our rights. It perhaps could be the strongest of all, due to its number of members worldwide. <comment><USER2> Isn't that the EFF?</comment>


Apply HN: A clustering engine that identifies people congregation areas - <AUTHOR> Here at Wisebud we're building a SaaS clustering engine that identifies people congregation areas and helps analyze how masses behave in real-time. Think Apache Storm but context aware and with support for complex computations. It is also fully decentralized and brokerless. The engine can ingest spatio-temporal data from mobile networks, mobile apps and IoT. The clusters are contextualized to find user behavior patterns – what and when are people doing at any given location. Companies analyze their own user base, let it be app users, mobile network subscribers or IoT users. There will also be a free global view of the population for researchers, users, governments or anyone else who's interested. <comment><USER2> I have a Certificate in GIS and wanted to go into urban planning, so I like the basic idea here. But I am wondering what you envision as a use case. What can be done with this? Who would use it? Why?

Thank you.

<comment><AUTHOR> From the business customer standpoint, any company that has a location-based element in their daily activities may stream their data through the engine. It in turn performs continuous clustering on the data and displays real-time results on an interactive map. By using the map's features the company analysts may, for example:

1) See the details (count with demographic info) of the flow of people congregated within their selected polygon boundaries.

2) Set handlers that monitor any given area for unexpected behavior and respond to changes automatically by invoking their predefined logic (ex. a retailer gets notified of an unexpected increase of customers at a shop and may want to take action by notifying suppliers or deciding to offer a sale at good prices).

3) View snapshots of the map's history to identify trends of people masses. For example, a large company would want to know if people congregation is increasing within their area of interest over the years, months, days, or not.

4) We hope to push forward from the [3] use case and simulate future behavior of masses by performing deep learning. This could enable predictive analytic as a potential use case as well.

The beauty also comes from the point that such information, we believe, is invaluable to governments, defense agencies and any researchers in general. In return for reduced SaaS expenses, companies can donate anonymized data to the public engine. This way we can collect data from multiple different angles and, basically, approximate the behavior of the entire population. This public map would be available for all to use, including the data generating users themselves, if they wish. We hope to classify congregations to identify the reasons of their formation. Users want to find what people are up to and what is the most trending at the moment - maybe it's that free concert at Old Town tonight. Governments want to see that the concert gathered 100 000 people and growing - way more than was expected, maybe some additional forces should be allocated for peace-keeping. Maybe some locations form constant traffic jams or some regions of the city are just too densely populated - this could help in urban planning for users just like yourself! Not to mention potential web or mobile applications that could be built on top of this.

We see many use cases for the engine and understand that some may even emerge completely unexpectedly as the project grows. That is why our main goal for the moment is to build out the engine topology itself and then enhance it with analytical features demanded by our clients/users/community.

If You would like to know more about this, do not hesitate to ask. Thank You for the questions, btw!</comment></comment>


Spotify Now Has 15M Paying Users, 60M Overall - <AUTHOR> http://techcrunch.com/2015/01/12/spotify-now-has-15m-paying-users-60m-overall/ <comment><USER2> I had the unfortunate experience of signing up for Spotify, creating a playlist of a couple of my favorite artists and then having those artists' songs disappear the next day. Come to find out, they (or their label) didn't renew with Spotify. Went back to purchasing individual tracks that can't be deleted from my devices.

I do like the Spotify model, but find between iTunes, Pandora and Sirius my music needs are saturated.

<comment><USER3> I recently ditched the Zune "all you can eat" subscription for a Spotify subscription.

Pretty much the same deal. Stuff comes and goes, and there's no warning to the user (I imagine that a warning that content is going to go away would increase piracy).

This is why I still buy CDs.

</comment></comment><comment><USER4> Most likely this huge growth over the last couple months has been the $0.99 for three months offer - [http://www.cnet.com/news/get-a-3-month-spotify- premium-subsc...](http://www.cnet.com/news/get-a-3-month-spotify-premium- subscription-for-99-cents/)

It's a great way to inflate subscriber numbers for an IPO, but I doubt it's a long-term trend.

</comment><comment><USER5> I decided around two years ago to abandon "owning" most of my music. I started with Rhapsody and moved to Spotify. I find that Spotify has almost everything I want to listen to and the $10 / month (actually, $20 since I have two more accounts on the Family plan), is well worth it.

For people who like to listen to a wide variety of music and like to discover new music, I don't think you can beat what Spotify offers. If you have a more tightly contained bucket of music and don't want to expand in too much, it probably makes more sense to own your collection.

I've discovered a ton of stuff and enjoyed things one-off like live CD's that I would have never have purchased outright through iTunes.

I ultimately chose Spotify over Rhapsody because of playlists. I think when I first started, I actually prefered Rhapsody's mobile UI but Spotify's has gotten better since. I remember using Rhapsody's web/desktop service in the mid 2000's, but it wasn't an iPod replacement then because it's offline capabilities were limited and limited to devices that I didn't like. Once mobile became realistic to stream music, the services started making a lot more sense to me.

<comment><USER6> > For people who like to listen to a wide variety of music and like to > discover new music, I don't think you can beat what Spotify offers.

Eh... Sort of. If I want to listen to something within (making it up) the top 50% most successful recording artists, or something relatively recent otherwise, it's normally got _something_ at least.

If I want to listen to underground hardcore records or weirdy free improv or something, I'm S.O.L. on streaming services.

Still, I pay my £10 a month, because it's good for a lot of things, and convenient.

<comment><USER7> I disagree. It is actually a very rare for me to not find a band on Spotify, and my listening is mostly focused on esoteric or small bands in a variety of niche genres.

<comment><USER8> there are tons of good bands that are not on Spotify, even modern (florida noise punk scene is really easy example)

<comment><USER6> Yeah: I listen to a lot of very obscure 90s emo records, which were all fly- by-night bands on tiny vinyl-only labels (and other similar corners of the music industry). This stuff is not on Spotify. I did not expect it to be on Spotify, and thus was not disappointed.

For contemporary stuff of that level of nicheness, Bandcamp is a much better source. And selling one $5 download/print-on-demand CD is probably more lucrative than all the Spotify streams most bandcamp bands could ever hope to get put together, so it's hardly surprising that they go this way. Spotify seems a more sensible partnership for labels with significant back catalogue than individual artists. (Which makes it peculiar that I can't browse by label, but there you go.)

I like Spotify for classical music and jazz, but my tastes are more 'mainstream' in those categories. It also has a surprisingly good collection of house/techno/etc singles, but I kind of need the files for those for DJing purposes and such.

<comment><USER9> You can use "label:xyz" in the search field.

<comment><USER6> Well... the more you know.

</comment></comment></comment></comment></comment></comment></comment><comment><USER10> I'm a paying user. My fiance pays as well. It's a great service, but I wish they would come out with a "family plan" or something. Often we are both listening at the same time to a single account which negates the utility of having two separate accounts quite a bit. However, at work we both listen to our separate accounts and listening to the same account would not be feasible. Netflix allows for multiple queues for different users, I think Spotify should follow suit.

<comment><USER9> If you're in the US, they have this already:

[https://www.spotify.com/us/family/](https://www.spotify.com/us/family/)

It launched a few months ago.

<comment><USER11> Thanks for this! - UK version here [https://www.spotify.com/uk/family/](https://www.spotify.com/uk/family/)

</comment></comment></comment><comment><USER12> Despite Spotify occasionally being in the news for not paying the artists much, I bet this does add a lot of new revenue for the music industry.

Before I joined spotify (about a year ago) I hardly ever bought CDs or MP3s (defintely less than the £120/year that Sptofy costs) - there must be many other people also who are paying for Spotify now who never used to spend much on music before

<comment><USER13> One data point: I haven't bought a CD since the 90's but I now have a paid Spotify account.

<comment><USER14> Same. Spotify is just too damn convenient not to pay for it.

Not having to copy over my playlists to my phone, but just being able to sync, that feature alone is worth the €10 subscription to me.

I discover a song, add it to a playlist from my mac, and I can listen to it next time I leave the house.

<comment><USER15> Spotify is really sort of a separate internet for music. Anywhere you are, if you hear about a new genre, you can immerse yourself in it within seconds. Imagine doing that back in the days of Tower Records? Even the Tokyo location, or Amoeba Music can't cover the territory like Spotify can. I've tried.

<comment><USER14> And that's why I love their product. I haven't seen any streaming service do it that well.

</comment></comment></comment></comment></comment><comment><USER16> My biggest issue with Spotify is still their catalogue. I listen to primarily foreign electronica, and it constantly feels like none of it was there. When I finally did want to grab music from American artists, half weren't on Spotify.

Something I've wondered for some time, is if the world needs a music service that both allows smaller artists to stream their music from it, but also negotiates with companies like iTunes/Spotify/AmazonInstant to allow their music there as well.

<comment><USER17> Some sort of deal to get SoundCloud and Bandcamp artists' content available on Spotify would be great.

<comment><USER18> This! I think Spotify/Rdio/Deezer/etc should make a deal to license music on Soundcloud. The best indie music, mashups and mixes are on SoundCloud.

</comment></comment></comment><comment><USER19> The "incrementally even more convenient than piracy" for Spotify (and also iTunes Rentals on Apple TV) has really surprised me.

I used to use oink/what.cd to download all my music, but now that I use Spotify I never stray from it. A friend emailed me J.Coles newest album in MP3 but I opted to just wait until it was on Spotify for the sake of simplicity and accessibility.

Similarly with movies, whereas I would once always simply torrent them, sitting in front of my TV and just renting them for $4 feels so much cheaper than battling an advertising laced torrent site and figuring out how to stream it from laptop to TV.

Pirating stuff was much easier than buying CDs or DVDs, but purchasing stuff online has became even easier than piracy.

</comment><comment><USER20> When I was in high school (quite a long time ago now), I'd try to buy 2-4 albums a month. That was an average cost of $25-$50 to listen to 20-50 new songs... some of which I enjoyed, some of which I didn't.

$10 per month to listen to almost anything is such an astounding underpricing of the value I personally derive from the service. I can hardly believe my good fortune to be alive at a time when I can pay so little to listen to so much with so little effort.

<comment><USER21> And this is exactly why the music industry is failing.

Even if every American paid $100 per year, that maxes the revenue at $30 billion with no further growth possible.

Now _how_ much of that it going back to the music creators? Almost zero.

If I take your high school numbers and extrapolate ($250/year across 300 million) with a $.50 per CD (20 albums per year) we get a $75 billion business with $3 billion actually going back to artists. For 20,000 CD's (roughly the number of releases last year) that's 150,000 per year back to the CD creators.

That's an _ENORMOUS_ difference.

Yes, these are all bounds (not everybody would buy--there were fewer CD's in the past--CD's were more expensive to produce), but you can see the difference.

Now, this isn't all Spotify's fault, but the middlemen are taking _WAY_ too much out of the pie.

In addition, there are so many entertainment options that music has to compete with that it will never get back the privileged position it had in the late 60's to early 80's before both VHS and videogames.

<comment><USER8> this is my whole point I've been ranting about -- Spotify absolves peoples' guilt but they are just feeding the middleman, who seems to be taking the WHOLE pie.

i think pure torrents + physical sales would actually result in better money for artists than the same situation + Spotify.

</comment></comment></comment><comment><USER22> Shameless plug: I'm a paying Spotify user but they don't get hiphop mixtapes and they miss some hiphop singles, so I built [http://hooked.fm](http://hooked.fm). It's new hiphop music and notifications when your favorite artists release new music.

</comment><comment><USER8> if the money never gets to the artists what is the point? its good to build up an infrastructure but this is more to keep the industry's pockets lined than the artists, so i've seen at least a few who encourage to just torrent their work instead.

there are some who argue that the pricing model is not really incorrect/askew, but i think even they tend to admit that its insignificant income from the perspective of the artist.

(as someone who is not into pop music, i really don't care about building a whole economic/industrial mechanism just to make sure that beyonce & WMG keep getting a disproportionately large piece of the pie compared to independents, that is not really in the spirit of the internet IMHO it is just a web-based continuation of the old system that smaller artists hated...)

<comment><USER23> It's so hard to put a value on something like Spotify. I use the Spotify Pitchfork app pretty much every day to find new music. Before that I'd have to read Pitfork.com and then either torrent or buy that artists music. This forced me to be super selective in who I gave the time of day (because reading + downloading would take hours). With Spotify I can listen to 4 whole albums in one day.

If I find an artist I like I will definitely go to one of their live shows. I feel like I spend more on an artists now than I did when I bought their album outright.

<comment><USER8> hah great for Pitchfork... i'm sure they are making much more than the artists off this deal.

regardless, they don't cover the bands i like and half the music i like isnt on spotify so i just do it the old-fashioned way using discogs.com, downloads, and some good sites that have "related artist" webs. wouldn't you know it, the best site i know for related artist webs isn't a major industry service, its a torrent site! & they accomplish it trivially through user-edits...

so i guess my point is i think its true that Spotify can be convenient for some people, but it doesnt refute my point that they are not trying to do anyone favors (unless it fits their current branding strategy). Spotify is not some techno-anarchistic's grand vision of the music industry. it's not helping music fans discover more about their tastes, it is generally colluding with industry to guide listeners toward their profit sectors. I wouldn't be at all surprised if there is a complex sequence of kickbacks between labels, Spotify, and the venues themselves, designed to minimize artist royalty/payouts. If you follow the music industry you know the deals for artists are generally pretty bad & I don't really believe in the "but I go see them live!" rationale because some artists don't tour or aren't big arena acts. AFAIK it's really hard to recoup tour costs unless you are playing decent-sized venues at every stop.

i guess it is just hard for me to get into the feelgood mentality of the music scene when i feel like the technology available could allow us to be much more taste/trend/industry-agnostic but instead seems to just be an extension of industry power (Pitchfork being a major industry player as well...), and I generally feel like the quality of the artistic output is in decline so I don't want to buy into most of the over-produced crypto-pop junk they are selling (fans of 60s/70s/even 80s music are accustomed to a much greater wealth of musical diversity). As I mentioned though, I am not into music journalism i just use artist webs. Maybe if there were some tastemaker I really wanted to follow I would see this as more convenient but I just don't experience music that way. Or at most I'd be like "well, convenient for me, sucks for the artist".

I think I mentioned in my previous comment -- it's not that I can even prove the pricing model false, I just know it doesn't do shit for the artists... 1 sale of a self-published physical album is more profitable for most of them then a year's worth of Spotify listens.

i bet a solely torrents + physical sales model would actually be MORE profitable than involving Spotify... Spotify to me is really only a mechanism for absolving people from the guilt of theft, and conveniently it funnels money back to yet another corp.

</comment></comment></comment><comment><USER24> They just had a buy 1, get 2 months free promotion during December. I wonder if that 15M paying users will be more or less come end of March.

<comment><USER25> I think premium is too expensive for my needs. So I found a way to use trials from time to time. Basically create a new paypal account every time you want sign up for a new Spotify 30 days trial...

<comment> k-mcgrady Or pay the $10/£10 the times you need it and cancel the subscription straight away. Seems like an awful lot of work to setup PayPal accounts to avoid paying $10. I understand that can be a significant amount of money for some people but why is it so important to have Spotify from time-to-time that you would go through that process?

</comment></comment></comment><comment><USER18> That is an outstanding conversion rate. I wonder how it compares to its competitors.

</comment><comment><USER26> I assume that means they also make a healthy profit? Oh, nevermind.

</comment><comment><USER27> How does Spotify count users? They can game the proportion of paying/non- paying users by discounting infrequent unpaid users, for example. A more interesting number might be the number of /plays/ by paid vs. unpaid users. I.e., normalize it for activity.

<comment><USER28> Say they do? that's still 15M people paying 10$~ per month. 150M a month is a revenue of 1.8 bln dollars per year that's quite a big sum of cash...

At some point people stop looking at the paying to non-paying ratio of your costumers and when you starting bringing close to 2bln a year you are probably there.

No one really looks at how many "free apps" people download from the app stores and says Apple are padding their numbers when the app stores brings higher revenues than the GDP of many countries.

<comment><USER27> It's important because as it says in the article, artists (Taylor Swift, e.g.) care about how much people get for free. So the ratio of paid to unpaid is pretty much the heart of this news.</comment></comment></comment>


Sentry stays on Python 2.7 even after 2020 - <AUTHOR> https://github.com/getsentry/sentry/issues/1152#issuecomment-37828763 <comment><USER2> It boggles the imagination that anybody is still clinging to Python 2 at this point in the game. I guess they have their reasons, but man, oh man... from an outsider perspective, this feels very questionable.

<comment><USER3> Presumably because they assume it will cost less to maintain Python 2 than porting the application to Python 3.

The Calibre author said something like that himself [https://bugs.launchpad.net/calibre/+bug/1714107](https://bugs.launchpad.net/calibre/+bug/1714107) .

<comment><USER2> _Presumably because they assume it will cost less to maintain Python 2 than porting the application to Python 3._

That strikes me as incredibly hard to believe, but hey, if they've "run the numbers" and that's their conclusion, then so be it.</comment></comment></comment>


XKeyscore Exposé Reaffirms the Need to Rid the Web of Tracking Cookies - <AUTHOR> https://www.eff.org/deeplinks/2015/07/xkeyscore-expose-reaffirms-need-rid-web-tracking-cookies <comment><USER2> Its sometimes annoying (having to type in login credentials etc.) but I use Firefox with Self Destructing Cookie addon. It seems to control this problem quite well (at least I think it does). I whitelist sites I want to keep cookies for but basically everything else is destroyed as soon as the tab closes.

Someone please correct me if I'm wrong that this addon deletes this kind of cookie / localstorage.

Firefox is kinda good at storing passwords so I don't have to retype all my logins which removes most of the annoyance.

<comment><USER3> It would stop some tracking, but the people doing the tracking have many clever (and some not so clever as sometimes the simplest things just work!) ways to fingerprint you beyond cookie values. See things like [https://en.wikipedia.org/wiki/Evercookie](https://en.wikipedia.org/wiki/Evercookie) for an example of how much trouble you really need to go to in order to try avoid being tracked.

I keep toying with the idea of writing an add-on that doesn't just destroy tracking cookies (well, any non-white-listed cookies) but instead shares them around randomly - so next time you visit a site you might have the cookie from last time I did, or someone the other side of the world... That would also not affect anyone using mixed techniques like Evercookie (the discrepancy between what each state store has recorded could be seen and used to throw out the data instead if letting it pollute the tracking pool). Of course care would need to be taken here: if you share cookies from sites that take authentication you could open up session hijacking vulnerabilities. Only storing/sharing cookies from HTTP sites might help (no site requiring authentication should be running through un-Sed HTTP) but wouldn't be a perfect solution.

<comment><USER4> With the current state of affairs I think that poisoning the well is a better tactic than trying to prevent being tracked.

</comment></comment></comment><comment><USER5> There's a great op-ed by Stanford's Jonathan Mayer and Princeton's Ed Felten explaining this problem.

[http://www.slate.com/blogs/future_tense/2013/12/13/nsa_surve...](http://www.slate.com/blogs/future_tense/2013/12/13/nsa_surveillance_and_third_party_trackers_how_cookies_help_government_spies.html)

Their two labs also wrote a solid academic paper on the topic.

[http://randomwalker.info/publications/cookie- surveillance-v2...](http://randomwalker.info/publications/cookie- surveillance-v2.pdf)

</comment><comment><USER6> This really makes me want to see what happens if I could make my browser only accept secure cookies (cookies sent over https only). Unfortunately I can't find a chrome extension that implements this.

<comment><USER7> This may not be effective in some cases, given the NSA's history of targeting the plaintext before it gets wrapped in SSL. (i.e. the infamous "SSL added and removed here! :-)" sketch of Google's network[1]).

Additionally, far too many sites use cloudflare (or similar) to provide their SSL creating a single point of failure and a tempting target for eavesdroppers. (and who knows how many don't bother to encrypt the requests from the SSL proxy back to the actual serve?)

[1] [https://www.washingtonpost.com/world/national- security/nsa-i...](https://www.washingtonpost.com/world/national-security/nsa- infiltrates-links-to-yahoo-google-data-centers-worldwide-snowden-documents- say/2013/10/30/e51d661e-4166-11e3-8b74-d89d714ca4dd_story.html)

</comment></comment><comment><USER8> The EFF might not like it, and most internet users might not like it either, but being able to track users pays for most of the free content we consume on the internet. Thats just the reality.

Less pragmatic people might argue "micro payments" or some such idea, but the fact is people have never really paid for news. News has always been subsidised heavily by advertising. Almost everyone who argues this is running an Adblocker.

Also third party cookies (and ads) are something any internet user can disable in a few clicks.

<comment><USER9> I sort of agree with you, but I do remember having newspapers that didn't have ads, or at least extremely few.

The bottom line is, in my mind, that if you can't make money selling your product, and needs to resort to ads to make a profit, then your products existence isn't justified. Displaying ads move money from profitable product, typically physical one, to products that doesn't provide any real value of their own.

The Internet is ruined in some degree, because we never paid for anything initially, so when companies moved in, it was expected that their stuff would be free to. Now we're stuck in a situation where the online only companies for the most part can't make money, without pimping the wares of companies with physical products, or selling their users data.

<comment><USER10> I run some forums that offer value to mostly teens. How do you propose I make money from them?

The more money I make from a forum, the more time I can invest in the forum which enhances its value to its community.

Adsense pays good money. Donations are always a joke. And somethingawful.com had to get impressively big before it could charge $10/registration. Oh, and teens have no money and nobody pays for forums.

"If it needs ads, it shouldn't exist" is just tone-deaf at best. Much of what people are willing to pay for and how they're willing to pay for it are perceptions that you have little control over.

The thing about ads is that people generally don't associate a cost with them. It's just how it is. The second you charge $1 for something, then your website now charges money while all of your competitors are "free" regardless of their ads. Whether it's acceptable to charge that $1 mostly comes down to convention and what people are already used to.

<comment><USER11> _teens have no money_

Teens have lots of money. At least my daughter does (she has a part time job).

Your problem is that even when teens do have money, they won't spend it on your forums. E.g. if my daughter already has four swimsuits, why does she need to buy a few more? And does she need to spend $4 on a sugary drink several times a week?

The "free" website is more valuable to a teenager than the one charging $1. There's not much you can do to change that. As you say, "It's just how it is".

If I asked my daughter if she would be willing to spend $1 (per month?) on a website, she'd probably find that laughable. Most teenagers would.

The Freemium model for phone apps does work in extracting money from teenagers. Perhaps you can do something along those lines?</comment></comment></comment></comment>


Hacker Dojo 10-Yr Anniversary- Oct 05 and 06, Santa Clara, CA - <AUTHOR> Hacker Dojo 10 year Anniversary Oct 05 & 06 Premiering HD/SHDH Documentary
Artist performing: Vector Hold, Roger Linn, Tim Thompson, Maha, Ani, Codame, Ge Wang (Stanford Laptop Orchestra), Moldover, d0n.xyz, Aure, Electric Kitchen
Speakers: Peter Norvig- Head of Research, Google, Chris Messina, Inventor of Hashtags, Max Hodak - President of Neuralink, David Weekly, Jeff Lindsay, Tom Harrison, Joel Franusic - Founders of Hacker Dojo and Super Happy Dev House, and more to be announced.
Dub Clinic Auto showcase SVACA Pet Adoption Drive Robotics Demos
Workshops and of course, to keep traditions alive, there will be a bouncy house.
https://www.eventbrite.com/e/hacker-dojo-10-year-anniversary-return-of-the-happy-dev-tickets-63933786677 <comment><USER2> So cool a space to be celebrating their 10yr.

<comment><AUTHOR> 30% of non-profits make it past 3 years in operation. This is a huge milestone for this community. Thanks!

</comment></comment><comment><USER3> Very exciting, looking forward to it!

</comment><comment><USER4> Great place to work from.

</comment><comment><USER5> So awesome! Interested in seeing d0n.xyz</comment>


Ask HN: What features do you want in a modern spreadsheet app? - <AUTHOR>

Hi HN, I want to build a new spreadsheet app which works on all devices. Excel is great for what it does but it doesn't understand the internet and collaboration. Google docs is great for collaboration, but is still a bit clunky and lacks a lot of useful functionality. The Google drive mobile spreadsheet apps have terrible UX.
So I want to build a new spreadsheet app that works great on desktop browsers and also on phones and tablets.
These are some features I have in mind:
1. Hook into all the rich web APIs around us and pull in data from places like Evernote, Twitter, Fitbit, Basecamp, etc straight into a spreadsheet to play with. I can't believe we don't already have this!
2. Reliable format conversion between CSV, JSON, TSV, Excel, Gdocs, etc (as suggested by couple of people in the comments).
3. Shortcuts for common data manipulation functions like basic arithmetic, concatenating strings, converting delimited data to columns etc. I'm imagining simple big buttons for these to make them easy and fast to do on a touch device.
Now I want to find out what things HN would find useful to help me prioritise some features for v1.
Any ideas and comments welcome. Thanks! <comment><USER3> tl;dr: Use spreadsheet for simple small business accounting, directly, with ability to export to accounting package (and to gen timesheets and invoices), out of the box, without me having to grow my own macros, etc.

This may be a very limited use-case, but....

I'm a one-man shop. Every month, using my (relatively quick and lightweight) spreadsheet software, I enter time worked for various clients, prepare timesheets and invoices for them... and then re-enter said data into my (slower, less friendly) accounting package.

The regular monthly stuff is almost always the same, very cookie cutter.

Having an accounting package is almost overkill, but it supports "accountant interoperability"[1] - and using the latter to do the former is definitely overkill. And I've never been able to figure out the automation/recurring capabilities, they seemed geared for more complex enterprises.

I hate the fact I enter data multiple times, I hate that I have to use the accounting package to manage expenses, etc., etc. - but integration and automation are complex, definitely overkill for my needs.

What I'd really like is the ability to use a spreadsheet for basic double entry bookkeeping (there are only a handful of accounts I use regularly; I can use the accounting package for the infrequent ones) and for entering my time, and have dirt-simple spreadsheet functions for generating client timesheets (sometimes based on the client's format, since my clients are often middlemen), for generating invoices (based on my format), and for generating a file that can be imported into my accounting package periodically.

+1 if the spreadsheet knows about regular monthly things and reminds/walks me through them.

Lightweight, fast, cross-platform. All the things my accounting package (Windows-only, so runs under a VM) is not.

[1] Accountants are like lawyers, IMHO: If you're unsure whether you need one, you probably do; my annual taxes cost me more than doing them myself, but I have greater assurance of minimizing my tax bill while staying off Revenue's radar - audits are expensive.

</comment><comment><USER4> What is a spreadsheet, really?

It's an interactive programming environment with an interface optimized for data entry and some other things. The difference between Excel and, say, Matlab or R, is excel's strength at data entry, visual/intuitive nature, and total lack of accessible higher-level programming features.

So the ideal solution in this problem space, to me, looks not much like excel at all, but more like a high-powered computation environment a-la mathematica, except with roughly the execution model and visual/accellerated/intuitive interface strength (and then some, as you suggest) of spreadsheets. For example, the whole grid thing might have to go, instead making tables first class objects in the language, and then have a strong visual representation with an accelerated (not plain text) interface for manipulating them.

But maybe you want to take it in a different direction than I do? In any case, excel can trace a pretty direct line to VisiCalc, with very little fundamental reevaluation applied since 1978 or so. So you might want to consider not being bound too closely to the "this is how spreadsheets have always been done" thing.

</comment><comment><USER5> Best of luck to you! I suspect you don't know how large this particular iceberg is under the surface[1], but I wish you the best. :)

1: There's a reason that POI-HSSF, the Apache Java-to-Excel library, stands for Poor Obfuscation Implementation-Horrible SpreadSheet Format!

</comment><comment><USER6> What I want is for people to stop using spreadsheets for anything but numbers.

There's a terrible habit just about everywhere computers are used to use Excel as a catch-all table generator for whatever grid-like data someone wants to capture (task lists, for example). It's a _terrible_ tool for that - the cell editor is actively hostile to entering text. And frankly, I think the majority of Excel use is for exactly this sort of clunky, awkward crud, not actual spreadsheeting.

Rather than trying to build a better spreadsheet, build a better grid-oriented text capturing device with some spreadsheet functionality.

<comment><AUTHOR> You have struck the nail on the head. I have wished for this exact thing - <USER2> better grid-oriented text capturing device_ \- so many times. By inverting the focus, you have helped me look at it in a way that might just be the thing I needed. Thank you so much.

<comment><USER6> Drop me a line at the email in my profile... I'm really interested in how you go about this. I've thought about exactly this product, but stuck on the "If you have a hammer, every problem looks like a nail" effect, which is why businesses use horrid Excel for this duty in the first place. How do you get them to buy in? Your multi-platform approach might be the answer.

ps: Have you used any of 37signals' products? Look to them for UI simplicity. I think there's a real danger in adding too much functionality here.

</comment></comment></comment><comment><USER7> Make number 1 into an API and that's your business. In other words: all these services can easily provide a button: see this data in excel, and your service sends the data to Google docs (or your own excel version if you must).

</comment><comment><USER8> I'd like to be able to tie blocks in block diagram to the cells in a spreadsheet.

The use case is to view which specifications are required per functional block in a large system.

</comment><comment><USER9> Just today I had a couple issues with Excel if I wanted to save something as JSON or if I wanted to save something as an UTF-8 encoded CSV (Excel converts it to ASCII).

<comment><AUTHOR> I've come across several data format conversion issues, in my personal use cases and of others. Would a reliable format conversion app be of value on its own?

<comment><USER10> My company uses the French version of MS Office and after upgrading, I can't quite get it to generate CSV files in the right encoding needed to work with the company's proprietary software. So I need to go through the hassle of manually generating the CSV files in the correct format. An easy way to work with different encodings and formats will be especially useful for collaboration.

One thing that would be simple and useful is the ability to generate or convert between different CSV file formats. For example, French CSV files use semicolons instead of commas to separate values, and use commas as decimal points.

<comment><AUTHOR> Thanks for your comment, Jongseong. I'd like to learn a bit more about your file conversion issues. Can I email you somewhere?

</comment></comment></comment></comment><comment><USER11> seems like you need to define who you are tagerting first. If you want to replace excel it's bankers, consultants etc. Anything that does not integrate backward compatibility with excel and vba macros has 0 chance in the marketplace - too many complex models built on this s* by banks

</comment><comment><USER12> Wolfram Alpha and MatLab integration.

<comment><AUTHOR> Thanks for the suggestion. Can you tell me how you would use such an integration?

<comment><USER13> At least for me, what would be really valuable is the ability to easily add data from WA to a cell. For example you could type "population of Russia" into a cell, and it would grab the integer from WA for the math. Really a low- latency, tabular form of Wolfram Alpha would be the spreadsheet of tomorrow alone.</comment></comment></comment>


Employee Stock Options on Ethereum (2017) - <AUTHOR> https://blog.neufund.org/tokenizing-startup-equity-part-1-employee-incentive-options-plan-esop-on-ethereum-blockchain-dce2416f4505 <comment><USER2> The developer seems to be confused about information asymmetry.

For one, _cap tables are convoluted and not always available for inspection so it is impossible to translate given amount of options into percentage of equity owned._ This cannot be solved using a smart contract. A convoluted, complex cap table doesn't automatically become easier to read because "smart contract". As even a junior developer will tell you, there are tons of ways to write a program which looks like one thing but does something else.

While making it public sounds like a good thing, smart contracts and Ethereum EVM is new tech. So, not every employee especially from a non-tech background will be able to read it. So, this basically takes one complex thing and replaces it with other.

Secondly, pricing is not only dependent on cap tables. There are tons of things going on. How profitable is the company? Are they booking revenue front up to make things rosy? etc. and even publicly available information doesn't tell you what price should an ESOP be. Take an example of Uber and Softbank. Some of the stocks were thought to be worth more than others:

[https://www.bloomberg.com/opinion/articles/2017-11-16/softba...](https://www.bloomberg.com/opinion/articles/2017-11-16/softbank- thinks-some-uber-shares-are-worth-more-than-others)

This information might not be public all the time.

<comment><USER3> I think you're right about the naivety. Taking the existing complexity and opaqueness and implementing it in Ethereum isn't really doable.

OTOH... I do think that private company equity/ESOP is due some changes. Companies are staying private a lot longer and there are some (like Uber) that now have >$bn ESOP schemes which could be managed in a better way.

It's hard. There are a lot of different interests at play, some competing. Purposeful obscurity and such.

You'd need to convince these companies to do things differently. In effect, any idea that "does ESOP on Ethereum" is an idea for a stock market of some sort.

Not a bad idea, but a big scary one with lots of hard problems (not technically hard) and risk. Naivety might raise your chances. The existence of blockchain is a tool for solving some of them, but Im not sure that it's a pivotal piece. Running centralised would be fine too. Ultimately, a single company originates all the contracts anyway.

If I were scheming such a scheme, I'd probably focus on things that aid fundraising.. that's really the purpose of a stock market, which is what a liquid ESOP system is.

TLDR: The problem isn't "ESOP needs to be Ethereum." The problem is "companies aren't using the regular stock market, find an alternative."

<comment><USER2> I think you have misunderstood what is happening now.

Companies are staying private lot longer not because there is some obscurity or different interests etc. They are staying private for the same reason public companies are buying back more and more shares.

And giving them another market is not going to help, naivety or not. What is going to help is tightening interest rates and rising yields. It should change the flow. But that's not going to happen in short term. And certainly not with naive blockchain options.

That said, a quick google search throws up tons of places to sell your private stakes. Example - EB Exchange (source: [https://www.cnbc.com/2017/06/12/uber- insiders-are-eager-to-s...](https://www.cnbc.com/2017/06/12/uber-insiders-are- eager-to-sell-shares-but-they-cant-find-a-market.html))

<comment><USER3> I think we might be misunderstanding eachother. :)

I have no opinion on _why_ companies are staying private. But, since they are.. there are big, private ESOP schemes that exist. These lack liquidity.

Google will return all sorts of brokers who "arrange liquidity discreetly." But, this is pretty limited, difficult to access, and comes with massive transaction costs.

There's a big difference between a sanctioned and efficient way to buy and sell equity & brokers who can make a market for anything.

</comment></comment></comment></comment><comment><USER4> The majority of the article is about how illiquid the stock options are. But that's the deal. If people wanted to provide liquidity, employees would be given non-vesting shares.

The article also doesn't address very common clauses in stock option contracts. What about tag-along and drag-along rights?

<comment><USER5> Really liquid stocks/options/etc can really destroy an early-stage startup. The focus of the stakeholders goes too easily from building the business towards speculating with the stock.

Also see: ICO-tokens (shittokens), where there are countless of cool business ideas, lots of trading and speculation but no actual businesses built.

<comment><USER6> Really liquid stock options are likely the only reason why one should value said options above $0 and (potentially) take a lower salary. It seems to be beneficial to be able to sell your options to an established investor.

<comment><USER5> If the stock/option is liquid, then why not just take hard cash instead? Also shouldn't be a problem for the company, they could just sell directly to the investor and compensate the employees with cash.

</comment></comment></comment></comment><comment><USER7> If something like this was ever part of a hire offer, it would be an instant "nope" right there for me.

<comment><USER8> You could just do the same as with normal equity benefits and value them at 0 (which for most startups is true).

<comment><USER5> Also makes me wonder if many stock option schemes make sense at all, if employees think they are worth zero.

<comment><USER9> They usually _are_ worth zero, but they also cost the company zero, right?

<comment><USER5> How is the cost for the company zero? If you issue employee options/stocks, you devalue existing shares. Often investors have invested to the company and have paid cash for the shares.

From company shareholders perspective the cost of issuing shares to employees is definitely not zero.

</comment></comment></comment></comment></comment><comment><USER10> Hey think this is very smart low friction way in creating a secondary market in options

One question - how does this handle "bad leaver" clauses which are typical too - where the company revokes the grant ?

[https://www.personneltoday.com/hr/how-to-get-the-most-out- of...](https://www.personneltoday.com/hr/how-to-get-the-most-out-of-good- leaverbad-leaver-provisions/)

<comment><USER11> In the case of a bad leaver event it is up to the employer to decide. So in most cases the bad leaver wouldn't receive anything.

</comment></comment><comment><USER12> How did this deal with theft? Usually you came still someone's stock options by stealing a key / password, and a judge can order certain people do, or do not, have options.

<comment><USER11> the stock options are secured by a key and additionally by a contractual agreement. so even if somebody would steal them they wouldn't be able legally enforceable.

<comment><USER12> In which case, what value is the digital tokens providing, when they can just be overruled anyway?

</comment></comment></comment><comment><USER13> And when the blockchain forks, you get double the stock options!

</comment><comment><USER14> I actually thought this was talking about the Ethereum Foundation paying its employees in ETH at first.

</comment><comment><USER15> I'd rather not...</comment>


How I deploy Haskell Code - <AUTHOR> http://www.alfredodinapoli.com/posts/2015-11-03-how-i-deploy-haskell-code.html <comment><USER2> To be honest, I'm more interested on what the author did before he switched than on how he does things now. A "How I deploy Haskell Code" post gathered my attention just because it's a problem I never expected anybody to have, just like "How I deploy C Code".

<comment><USER3> Fair question:) GHC binaries dynamically link certain C libraries, which must be present (and in the right version range) at runtime. This can cause trouble.

I'd be curious to hear if there's a convenient way to build an entirely statically linked GHC binary. I've searched around some but haven't found an easy answer yet.

<comment><USER4> You'll find this Reddit thread useful:

[https://www.reddit.com/r/haskell/comments/3kjpwe/how_to_easi...](https://www.reddit.com/r/haskell/comments/3kjpwe/how_to_easily_create_portable_binaries_for_linux/)

<comment><USER3> Sweet, thanks!

</comment></comment></comment></comment><comment><USER5> I hope that Docker will increase the popularity of languages like Haskell by taking away most of the problems with deployment and dependency management. If I can just create a Docker container for my ops team to deploy, without them needing to know what is inside of it, I can pretty much use any language I want.

<comment><USER6> > If I can just create a Docker container for my ops team to deploy, without > them needing to know what is inside of it, I can pretty much use any > language I want.

If you can get them to deploy anything you want without them needing to know what is inside of it... your ops team is too trusting, in my opinion.

<comment><USER5> You think your ops team _really_ knows what they are pushing? Whether you are deploying jar files, Debian packages, or Docker containers, or whatever else, the ops people rarely look inside. Their main concerns are security and performance, and those can be audited using black-box testing. Code quality has to be enforced by engineers, because ops people are not capable of doing code reviews.

<comment><USER6> > because ops people are not capable of doing code reviews

That's probably specific to your organization.

<comment><USER7> Not really. Ops people are generally just that. Even DevOps aren't the ones writing the apps. Except for one specific place, nowhere I've worked in the last 25 years has Ops people that would be qualified to review either the apps or the libraries it uses.

PenTests and security is a pretty different thing than app dev. And both are different than ops. Only recently have the roles been blurred, but even now, I see truly cross-functional people very rarely.</comment></comment></comment></comment></comment>


Ask HN: Problem with research supervisor regarding research interest - <AUTHOR> What'd you do if your supervisor force you to work on something you aren't interested?
I am a new graduate student in the USA. I came here like 3 months ago from third world country. So the problem is when I was applying all the documentation (cv, cover letter, research interest) of mine, was showing I am interested in doing system software research and I came here with the intent of working on the hardware-software interface. But recently my supervisor pushes me toward stuff which I am not interested (AI, ML, Image Processing), didn't have the intent to work on, and totally wastes my time (I don't have anything against those topics, I am only not interested to work on them as my thesis).
The problem is he trying to define my thesis subject. Which is very important to me and I don't want to stick on a subject which I don't like at all. I was pretty good at what I like (that was the reason they paid me to come here). But the problem is the topic is way different than my research interest.
So, besides that I am from third world country and I am on a student visa. So you can imagine how horrible is the feeling of "what if they couldn't find another supervisor?" or "what if they did cut my funding?".
What would you do if you were in my situation? What is the reasonable thing to do? <comment><USER2> There may be cultural differences affecting your communication. It could be that you're accustomed to being deferential in this situation and your supervisor is accustomed to students being more vocal about their preferences. Does he know you dislike the research direction he's advocating, or could he be too busy or distracted even to be aware of it? Are you sure he's forcing you and not just making suggestions?

Assuming communication isn't the problem, how clearly have you defined the scope of the research you want to pursue? If you don't at least have an outline for your thesis having been there for three months, maybe he's justifiably worried about a lack of direction on your part and is trying to give you some. The more clearly you have it planned out, the more comfortable your supervisor should be with having you run with it.

Assuming communication isn't the problem and assuming you've presented a well thought out plan that he rejected, you should take a hard look at whether he has a point. One school of thought holds that Ph.D. is a time to do what you like without worrying too much about how fashionable it is, but another regards a poor choice of dissertation topic as career suicide. What reasons does he have for you to work on those topics instead of the one you had in mind?

I know what it's like to be passionate about a research topic, and although you don't believe this now, your interests are subject to change as you mature intellectually. My own view is that a Ph.D. is neither a free-for-all nor a matter of life and death, but your opportunity demonstrate your competence with a decent piece of work and start your career. The main thing is to do a good job and not get too hung up on things that don't matter in the long term.

<comment><AUTHOR> Thank you so much. This comment is literally a gold mine for me.</comment></comment>


F-Droid: The Android Market That Respects Your Rights - <AUTHOR> http://www.thepowerbase.com/2012/08/f-droid-the-android-market-that-respects-your-rights/

<comment><USER2> Actually it is good to have an Alarm app without having to give it full Internet access and permissiouns to read your identity and use file system.

</comment><comment><USER3> Just heard about F-Droid in slightly unauspicious circumstances... Moxie Marlinspike had a row with them over distributing an old (and slightly buggy) version of TextSecure, after which they ultimately agreed not to distribute his (fully open source) apps at all. I hope they patch things up and get TextSecure and RedPhone back in, because I like what F-Droid is trying to do here.

<comment><USER4> Interestingly, that was the first time I'd heard of f-droid as well. =)

I think my objections to f-droid are actually connected to the hesitations I have around a lot of what's happening in the "open" Android space. The "rooting" community is a perfect example: people want to be able to write certain kinds of software for their devices, but aren't able to, and so they've developed "open" solutions that allow them to. Their original constraint, however, was the Android security model, and the problem is that their solution was just to destroy it.

I really like the fact that Android has a security model focused on application rather than user isolation (what typical PC environments do). My only complaint is that I wish it were stronger. Rather than adapting this nice security model to meet their needs (adding additional permissions, etc) the "open Android" community converged on just running shit as root instead (a reversion back to the PC environment).

I think f-droid is potentially another example of an attempt to make Android resemble the PC environment. It feels to me as if they're trying to be the "debian" of Android, in the sense that they're taking random OSS software that they find, packaging it, and distributing it through their own repository. There's a tool to pull down packages from a repository and install them, just like with Debian.

The first big problem with this approach comes with application signatures. Where signatures in Debian are only relevant to the debian tool itself, signatures in Android are relevant and _enforced by_ the system. The owner of the key for a signed APK is the only person who can distribute future versions of that application, meaning that as a developer, I'm not capable of distributing software to users who've installed the f-droid version without f-droid's assistance. In the case you mentioned, users were running a version of my software that needed to be updated, but I had no ability to give them the update.

Given the way f-droid works, this also means that all the signing keys for all software are being stored _online_ in one place, which probably isn't a great idea and will almost certainly bite them eventually.

I could go on about why I'm not enthusiastic about this project, but all of my objections are connected to this theme. I think it's possible to develop an open ecosystem that's as secure or even more secure than what Android's default security model provides, but I think it requires making choices that are going to be more work than just flattening the security model back to PC- land.

<comment><USER3> Glad you shared this. I just got my first Android not too long ago and haven't hacked it yet, so it didn't occur to me that the modding community was achieving their goals by defeating Android's security model.

With F-Droid, if they were to just distribute preexisting APKs that correspond to free/open-source software — like your TextSecure APK — it sounds like it would have your signature on it, and updates wouldn't be a problem. But they compile the apps themselves to let you be "absolutely sure the binary package[..] is identical to the source". So ironically, they're actually adding a kind of _security_ feature, and it is this that takes away your ability to provide updates (they might say by design, since you could otherwise push a closed-source update to their users).

Theoretically that problem could be avoided if you signed the source code, F-Droid distributed that, and any necessary compilation was done directly on the smartphone. I suppose this is impractical, but such a setup might work on Mozilla's forthcoming Firefox OS where all the apps are written in HTML5/JS. Just as long as you signed a non-minified copy of the code, it wouldn't be an issue.

On the other hand, I think the problem with updates, if we're continuing the F-Droid/Debian analogy, really comes down to how much you can trust the "distro". I use Ubuntu on my desktop and if there's (say) a Firefox vulnerability, the security update for that will come from, and be signed by, Ubuntu, not Mozilla. And it works because I trust Ubuntu. They monitor high- profile applications like Firefox and if a fix is needed, they'll ship it ASAP. Whereas, the F-Droid people were apparently not watching TextSecure closely enough, and either didn't notice there was a new release, or couldn't be bothered to update their copy in a timely manner. I'm not convinced their model is inherently insecure; it just requires I put my trust in them rather than in you (in this case perhaps a questionable decision).

</comment></comment></comment><comment><USER5> Good to know there's a place where RMS can get apps for his phone.

<comment><USER6> RMS refuses to have a cell phone because they are tracking and surveillance devices.

</comment></comment><comment><USER7> F-Droid has some really cool apps. While browsing all I can think of is why I didn't think of that.</comment>


Nvidia Starts Publishing GPU Hardware Documentation to Help Open-Source Drivers - <AUTHOR> https://www.phoronix.com/scan.php?page=news_item&px=NVIDIA-Open-GPU-Docs <comment><AUTHOR> NVIDIA has released some MIT licensed documentation of their hardware interfaces, and it sounds like there is more on the way. This could be a big help to the open source Nouveau driver, although information on re-clocking some of the newer cards to get the most performance out of them is not (yet) available. AMD has long been doing this with their cards, though their releases have been both more complete and more timely. Time will tell if NVIDIA gets to parity with them or not. It is AMD's support of open source that have made me a customer.

</comment><comment><USER2> I remember when you bought a fridge and it came with a schematic.

<comment><USER3> TV sets, videorecorders, even early 80s computers.</comment></comment>


Ask HN: Please suggest review papers in CS topics - <AUTHOR> The one paper I have read is - Deep Learning in Neural Networks: An Overview - Juergen Schmidhuber - https://arxiv.org/abs/1404.7828, I would like to explore more review papers on various topics, just to broaden my horizons. <comment><USER2> Check out The Morning Paper. [https://blog.acolyer.org/](https://blog.acolyer.org/)

Near daily reviews and write ups of technical white papers.</comment>


Did You Know All Your Emails Were In One Basket? - <AUTHOR> http://blog.louisgray.com/2011/04/did-you-know-all-your-emails-were-in.html

<comment><USER2> It doesn't make sense for these companies to run their own e-mail marketing. Sending legitimate bulk mail is massively complicated, and requires a whole department of people to maintain personal relationships with individuals at all the major ISPs and webmail services (Gmail, Hotmail, etc). That's the only way to get reasonable deliverability of the mail, as every mailing they do results in tens of thousands of false spam reports, triggers all kinds of throttles on the receiving servers, etc. On a daily basis, the mailer needs to do cleanup, getting its mail servers removed from automated blacklists and adjusting for major recipients' throttling and other rules.

The only way to handle all that affordably is to outsource it to a company whose full-time job is to manage all that complexity. Everyone bringing it in- house would not be practical, not just because it's expensive but because there would be too many people trying to interact with the ISPs/webmail/blacklist people every day.

</comment><comment><USER3> I use my domains very specifically as far as email is concerned. Some years ago I registered a domain for registering for shopping, online accounts etc. and created a catch-all address, so I could sign up with slord- news.ycombinator.com@<domain> and I'd know if it had been leaked as the address would start getting mail from elsewhere.

I don't publish the domain anywhere online (hence <domain>) earlier, I also did this after I signed up for HN, but you get the point.

<comment><USER4> I follow the exact same protocol.

This also makes it extremely simple to successfully sort and filter my email. I maintain Inbox Zero for my personal email folder and any firstname.lastname@example.com folders. And then once a week I'll go through the lower priority folders and process them.

</comment></comment><comment><USER5> The alternative to one large basket run by people whose core competency is, most likely, managing this sort of thing specifically would be many, many smaller baskets run by people who may or may not have the slightest clue what they're doing.

Think of all the sites you've seen that store your passwords in plain text. Hell, PlentyOfFish sends (or did in the past) weekly emails with your password in them. Think of how horribly wrong these companies are getting really basic things. Now, do you want to trust them _all_ to do everything properly, or do you want that responsibility delegated to someone who'll do it right?

</comment><comment><USER6> Unfortunately, security through obscurity isn't going to work. Someone will always find a way to grab large collections of email addresses. We need a better solution to help verify senders and highlight fake content/links.

</comment><comment><USER7> If only they were 'just' all in one secure basket, instead they're all duplicated in dozens of very large baskets with dubious levels of security and varying levels of attached personal information.</comment>


App-pocalypse Now - <AUTHOR> http://blog.codinghorror.com/app-pocalypse-now/ <comment><USER2> Previous discussion from last week: [https://news.ycombinator.com/item?id=7296178](https://news.ycombinator.com/item?id=7296178)

<comment> rkuykendall-com Thank you. I was getting major Deja-Vu.

</comment></comment><comment><USER3> Surprised HN hasn't taken this down - in the time i've browsed through this site anything that goes against monetizing a user is blasphemy. Given that most of HN are developers of some sort I gave the benefit of the doubt, this is how they make their money blah blah blah. More to the point, this article organizes all my complaints and then some. Agree with it or not, whenever I see a new start-up or app or whatever I immediately think, "I don't want to give you $1.99, even if I pay more for chips that go stale." Too much competition makes me very untrustworthy to buy anything.

<comment><USER4> I think your point about this audience is a fair one (and I myself make games for iOS), but I have trouble understanding the complaints.

My attempt to summarize: \- Charging up front won't work (some 2.99 apps are terrible therefore this one might be also) \- Free w/IAP for features are annoying because you can never truly buy the whole app \- Free is scary because of the way companies monetize free users

Each of those is true individually, but that doesn't leave a lot of options for a developer.

I don't the market is terrible because developers are so good at taking advantage of people. Rather, customers are willing to choose low quality apps over high quality apps if they are marginally cheaper.

<comment><USER3> Yea it's something of an impossible situation, and that really sucks. I would gladly give money to something that would enrich my life somehow, but trudging through the crap isn't worth it. Most of the time is wasted trying to figure out exactly what it is i'm looking for, as opposed to looking for that one app that fits my need.

</comment></comment></comment><comment><USER5> Why are apps so crappy? Well the Koolaid is so potent it took someone as sophisticated as Jeff Atwood four fucking years to realize that the model was

        AOL keyword: https://news.ycombinator.com

Hopefully it won't take for more years for people like him to realize that the reason we have app stores is that they are easier to enforce than forbidding users to install alternate browsers on the OS - in part as blowback from all the litigation against Microsoft that it's competitors championed in the early days of the web.

<comment><USER6> I partially disagree, the main reason we have app stores is because it was a model that worked fairly well for the iPhone and everyone else badly copied it. The lockin effect is an ancillary benefit.

<comment><USER7> Also for the billions of dollars it funneled into Apple via distribution lock in.

</comment></comment></comment><comment><USER8> The vast majority of apps that are not worth the bandwidth to install are basically mobile versions of the parent site with better data tracking.

I wouldn't be surprised to see a browser-like umbrella app appear that allowed for cross platform shit-app development where the native data tracking features were supported in that app and exposed as a standardized API for the second-layer apps. It wouldn't improve the quality of "Download our app!"-apps, but it would at the very least standardize them. I know that there are cross-platform development efforts now, but I'm thinking something more limited and targeted.

Also, wrt therobot24, Atwood doesn't express issue with monetizing. Rather, with the information asymmetry that exists in app stores you must gamble the $0.99-3.99 to see whether or not it was worth it. When you do, you're more than likely to find out that the app is shit and you've also handed over a bunch of your data anyways.

<comment><USER3> i only brought up monetizing because it's the core issue that causes said gamble - i understand that money needs to be made in order to ensure quality, but because of it i've also lost all trust over any app or startup at a first glance

</comment></comment><comment><USER9> Until javascript can animate at a consistent 60 fps in mobile browsers, the web will continue to have its ass deservedly kicked.

<comment><USER10> I don't really believe that this is the issue.

Developers are dying for a cross-platform solution for mobile development. If one existed that had complete parity with existing mobile platforms (including integration with OS and distribution model), except with current mobile web's performance, you really think that most developers would continue to just do everything twice?

<comment><USER11> I'm really not sure I want to see the day that Javascript webapps have the same level of access to system resources (camera, microphone, address book) that native apps now have. Even if the OS asks the user for permissions. Especially considering how broken the permission systems on both major mobile platforms are.

</comment></comment></comment><comment><USER12> Personally, I appreciate that each mobile platform has its own look and feel, design cues, etc. It's what makes using iOS and OSX so nice, at least for me. (But this applies more to offline apps, since web-centric apps like Facebook will look similar on every platform. And I agree that apps for every website is a crappy way to go forward.)

</comment><comment><USER11> Anyone remember 2007? Apple's 'web apps are good enough' stance and everyone clamoring for a native SDK? Seems like things have gone full circle.

<comment><USER13> The existence of shit-apps does not in any way suggest that a native SDK is unnecessary or inferior.

<comment><USER11> Of course it doesn't. I'm firmly in the native camp, and I honestly didn't find this article convincing. I'll believe that mobile webapps are as performant, secure, and capable as native apps when I see it happening on a regular basis.

</comment></comment></comment><comment><USER14> I find it interesting that Ghost, the blogging platform underneath Coding Horror, can't handle HN Front Page. The text on the webpage is blank for me.</comment>