Microsoft killed my Pappy - <AUTHOR> http://www.hanselman.com/blog/MicrosoftKilledMyPappy.aspx <comment><USER2> There is a big difference between "We stopped being evil at some point" and "we stopped being successful enough to pull off the evil shit that we really, really wanted to do". The DRM[0] that Microsoft were trying to bundle with the Xbox One just scant months ago is the same Microsoft I remember - and they thought that they could pull it off because they were the market leader last console generation. If Microsoft gets any headway with any other of their products, I know exactly what they're going to use it for, whether good- hearted programmers working there support it or not.

For me, it's really not a matter of hatred, I've gotten over it. It's just straightforward ROI. I'd need a really compelling reason to consider Microsoft technology, to offset the expected amount of integration pain, license cajoling, oh-but-it-really-only-works-if-you're-using-a-full-MS-stack bait and switchery that I've experienced in the past. There's more than enough fantastic tech out there to keep me busy that doesn't have that baggage attached. Sorry, guys.

[0][http://en.wikipedia.org/wiki/Xbox_one#Initial_used_games_and...](http://en.wikipedia.org/wiki/Xbox_one#Initial_used_games_and_Internet_verification_policies)

</comment><comment><USER3> This was a great point:

        That's 20 years ago.  And for bundling a browser
        in the operating system that couldn't be uninstalled
        or easily replaced? Sure, no operating systems do that
        in 2014. I wonder if I can swap out Chrome from Chrome
        OS or Mobile Safari in iOS. Point is, it's common now.

I lived through this time "hating" Microsoft for some of the stuff it was doing then, and it's probably well past time to bury those hatchets.

But they still do rather icky things: Rockstar Bidco lawsuits and the "Scroogled" campaign come to mind. I'm biased, but they've got to can it with these things (and just innovate) until I'll look at them as a pleasant company.

<comment><USER4> Google and Apple actually update their browsers, though. I don't think there would be as much concern if IE8 on XP automatically updated to IE11.

<comment><USER5> I'd like to see a PPC iMac update to Safari.

[http://en.wikipedia.org/wiki/IMac_G5](http://en.wikipedia.org/wiki/IMac_G5)

I mean, dear god. WindowsXP is _OLDER_ than PowerPC iMacs. And people _expect_ Microsoft to support it for free? Where the hell is my iMac G5 support?

Oh yeah, thats right. Its in the trash. When Apple declared the PowerPC (or was it Mortorola?) dead, and switched over to x86 Machines.

<comment><USER6> Actually, Apple transitioned from Motorola 68k to PowerPC in the mid-90s and the 2000s transition from PowerPC to x86 was their second successful transition.

</comment></comment></comment></comment><comment><USER7> When you stop shaking down your competitors with software patents, let me know. Until then, your talk about openness is just talk. Extracting settlements from android OEMs over FAT patents is contrary to all the values you've mentioned in this post.

<comment><USER8> I agree. I don't know anything about that part of the company, though. I work on the web.

<comment><USER7> Unfortunately, that part of the company is still part of your company. And it's a big, visible part. Because of MS's transgressions in the past, you don't get the benefit of the doubt from younger devs. Because you're still behaving like jerks with patents, younger devs know that the company hasn't changed.

Microsoft is still extracting software patent royalties from android OEMs this very minute - that's not anyone's pappy, and it's not a vendor overreaching. It's a calculated, evil decision by the highest levels of management.

<comment><USER9> No it really isn't. They need to pay for a license or not infringe on the patents.

<comment><USER7> You nearly had me, until I saw your username. Well played.

</comment></comment></comment></comment></comment><comment><USER10> Every time I have to suffer through the archaic UI of Word and enjoy late 1990s performance in the mid 2010s, I am reminded that my Pappy is still dead, even though MS could have made amends. They haven't. And in addition to my Pappy there's a whole other cast of characters that are dead, and they've saddled the entire world with mediocre-to-bad computing experiences. No amends for that either. Perhaps can't make amends, because they are themselves too stuck in the past, unwilling to fix their ways or legacy programs.

The world of computing could have been and would be today a better place if they hadn't dominated through business practices, but instead dominated with products.

<comment><USER5> Yes. Microsoft Word killed your pappy. Best argument ever.

That is absolutely weak man. If you don't like Word, then don't use it. There are plenty of alternatives. TeX, LaTeX, Abiword, Open Office, Wordpress...

I kid you not, I submitted _every single_ college paper manually typeset in TeX / LaTeX document, created using Vim + Makefiles I hand crafted. Graphs were generated in GnuPlot, maybe R if it were statistics related. Gnumeric was my spreadsheets program, and occasionally I'd use Abiword for times when I needed a more classic "double-spaced 500-word" homework assignment.

<comment><USER11> Exactly. I use LaTeX for almost everything that most people use Word or Powerpoint for. Yes, with vim and makefiles. There is no matching my productivity there in a word processor.

And I use Gnumeric (and assume you do too) because of the latex export function.

If Microsoft wants my business back, having really good LaTeX export from every MS Office program would be the place to start, along with native Linux clients.

What? They won't do that?

<comment><USER5> I use Gnumeric because its one of the most reliable spreadsheet programs on Linux. Its simply a high quality piece of work, and I've had no issues with it.

MS Word however, will forever be incompatible with the notions of LaTeX. It solves a different problem than LaTeX anyway. An export tool would be nice though.

<comment><USER11> > It solves a different problem than LaTeX anyway.

There's a fair bit of overlap though. I know people who typeset books with Word :-(

</comment></comment></comment></comment></comment><comment><USER12> He's not mentioning Microsoft's patents related attacks on Android, their involvement in SCO's war on Linux, their refusal to implement web standards that compete with their own homegrown solutions, or the Nokia partership that basically killed Nokia.

I really like Hanselman and his blog and I even like some of the stuff Microsoft has been doing, but this is a distasteful marketing piece.

And BTW, in society trust is a fragile thing and many people don't forget so easily. Other companies should pay attention to this fact. Fool me once shame on you and all that.

<comment><USER13> This is plainly rubbish.

1\. Android patents is part of an all our war between all vendors. Everyone is shitting on everyone's lawn. Apple, Google, Samsung are all just as bad. The whole mobile market is lawyer driven.

2\. SCO is gone, dead. They went after Microsoft as well for Xenix. They weren't involved other than to cheaply get them to go away.

3\. Web standards. There were no web standards. There are barely web standards now and IE10/11 do a pretty good job with supporting them.

4\. Nokia yadda yadda. Nokia was dying and knew what was going to happen. Nokia is a big company and handsets were a dead end for them so it made sense to lose them cheaply to Microsoft. The Nokia board made a killing.

All companies are assholes but facts are facts.

<comment><USER12> 1\. Bullshit. Out of all companies you enumerated, Microsoft is the only leech I'm seeing. Plus that's not a good enough excuse, because I couldn't give a shit about how things work in a certain market as long as it has a negative impact on me as a user or developer or on the industry as a whole.

2\. [https://en.wikipedia.org/wiki/SCO%E2%80%93Linux_controversie...](https://en.wikipedia.org/wiki/SCO%E2%80%93Linux_controversies#Microsoft_funding_of_SCO_controversy)

3\. IExplorer 11 is lagging behind all other popular browsers: [http://html5test.com/results/desktop.html](http://html5test.com/results/desktop.html)

4\. Nokia's fate was sealed the minute it signed that agreement with Microsoft.

Did you know that Nokia N9, the last MeeGo/Maemo phone they released as a limited edition, was a success with raving reviews? Do you realize that almost everybody that has held a Nokia Lumia in their hand thinks that the models are awesome, including the cheaper ones, too bad it isn't on Android? And besides the phones it produced, Nokia was huge and as a result had amongst the best distribution networks and brand recognition - it wasn't too late for them to turn around, they could have been bigger than Samsung. But ALAS, that Microsoft shill had to become their CEO - and Nokia's board I'm sure got bonuses, but what about the shareholders? Not happy ...

[http://thenextweb.com/eu/2012/05/04/nokia-and-execs-hit- with...](http://thenextweb.com/eu/2012/05/04/nokia-and-execs-hit-with-lawsuit- alleging-fraud-over-meager-lumia-sales-failed-turnaround/#!wP5V6)

<comment><USER13> 1\. What negative impact? I assume you understand the purpose of patents. Also the patents licensed for the fee are not disclosed. I had a windows touch screen phone 5 years before the iPhone and way before Google even existed. Microsoft was first out of the door there so it's understandable they want patent revenue from prior inventions. I think that's perfectly fair. Just because it costs your favourite company some money doesn't mean it isn't right.

2\. Still bollocks. Caldera/SCO owned patents. Microsoft had Xenix and SFU out in production and wanted to avoid litigation as well. This was a pay off. The whole capital arrangement was similar to how most corporations bet on capital funds for pay offs. Granted it looked bad on paper. I'd understand if you listed the "get the facts" campaign which was nasty. SCO and their litigators and the legal teams were the only bad actors here.

3\. They can't pump out browsers as quick as the other vendors. They're the only browser vendor that can offer a support lifecycle and paid up support. Google don't give a shit about support. Mozilla close anything that isn't easy to fix. I can phone up MS and get a paid fix in under a week. Not only that, most of these browsers are pushing broken shit out half the time and trying to get one over on the competition.

The whole browser market is a complete mess.

4\. Typing this on a Nokia handset (Lumia 820). They have market differentiation with Windows Phone. They have a reliable stable platform, no fragmentation and a backer with more cash than you can imagine. Its sensible. Shareholders and staff for screwed yes, but what do you expect from a corporation. Just because they're a brand you trust, doesn't mean they aren't populated by money grabbing assholes.

And Android is a royal mess. A fine example of fragmentation and a rave to the bottom. Google have really poorly managed the platform resulting in a rotting mess. We've shot 200 Android handsets from our company because they're constant trouble (various including Nexus, HTC, Samsung). Over to iPhones and WP8 devices.

I know the prevailing opinion amongst the tech culture is that Microsoft are a bag of shite, but you need to look deeper. The whole industry is horrible.

At the end of the day, all I get from people is childish tribalism rather than facts and a fair process. It's like Slashdot in 2001.

I'm sitting here with a Windows phone, a MacBook Pro, ssh'ed into a FreeBSD machine with VS2013 running in parallels.

Please everyone just grow the fuck up.

<comment><USER14> 1\. Software patents are a horribly harmful idea. The Federal Circuit Court of Appeals should never have allowed them.

2\. WTF? Xenix and SFU were in no way central to Microsoft's business, and I don't see how Microsoft arranging other banks to invest in SCO's scam had anything to do with licensing. Besides, the SCO case was about copyright, not patent, and Microsoft funds other companies to attack open source.

3\. Microsoft actually disbanded the IE team after IE 6. Nobody can develop more slowly than not at all. I'm still not comfortable with modern IE, because Microsoft is trying to standardize DRM.

4\. Fragmentation was never a problem for Nokia before, and Microsoft is still on the hook for S40 dumbphones. It doesn't help to differentiate by standardizing on an OS that (almost) nobody wants, or else Think Penguin would have a huge market. Nokia was a horribly mismanaged company, but Microsoft was not without fault for its rapid collapse.

Microsoft was never fair to us. It's still not a fair company.

Society works well when we have diversity. Most people "grow up" and become jaded and don't change anything. But society depends on people keeping their ideals and trying to change things for the better. One way is by reminding people that what we have actually is pretty awful compared to what we could have. So, it's instructive to remind people that Microsoft is still evil.

</comment></comment></comment></comment></comment><comment><USER15> This is a shockingly honest and open assessment of Microsoft's PR from someone who actually works at the company. I think the underlying notion is spot-on, and -- as someone who doesn't bear any particular ill will towards Microsoft besides the travesty that is Excel for Mac -- its interesting to see the seeds being sown of irrational Google hatred.

</comment><comment><USER16> Even if I concede all that, in the meantime, we've had the "Secure boot" fiasco and some other things I don't remember distinctly. I just remember constantly trying to fight the instinct to hate, to give MS the benefit of the doubt, but I just can't do it.

When discussing past wrongs of an institution, the question to ask is not "how long ago did they do it?" but "has the institution changed since?". In Microsoft's case, the answer seems to me to be "not enough".

<comment><USER17> In what way has the "secure boot fiasco" actually impacted you? I read a lot about it a few years ago, but in my experience that was nothing but FUD.

<comment><USER18> Give it time.

So far the worst effect has "merely" been to introduce needless hassle and obstacles when installing non-Microsoft operating systems [1]. Microsoft's current hardware certification spec (that manufacturers tend to implement so they can put "Certified for Windows 8" on the box) requires that the user be able to switch off Secure Boot (generally taking the entirety of UEFI with it) as long as they are not on an ARM system. They could change this at any point, and unification of ARM and "PC" is a current trend at Microsoft of which the move to Secure Boot on both platforms is already a part. Forgive me, but I'm not ready to accept Microsoft having me by the balls just because they haven't clenched their fist yet.

Secure Boot's purported threat model is a solution looking for a problem ("boot sector viruses" in 2014?). It doesn't really make much sense to make the boot process entirely unmodifiable on the grounds that "malware might modify it". Malware might modify anything else on your system too, and you are pwned either way. So it's probably safe to assume Microsoft had a different motive. I don't think it's wise to think of it as over-and-done-with.

[1] [http://mjg59.dreamwidth.org/9844.html?thread=328308](http://mjg59.dreamwidth.org/9844.html?thread=328308)

</comment></comment></comment><comment><USER19> > Do I hate Japan for World War II? [...] I said, "No, we're cool with Japan. > We've done some good stuff together." And he was like, "Cool."

No we are not cool. [https://en.wikipedia.org/wiki/Unit_731](https://en.wikipedia.org/wiki/Unit_731) is not cool, still not cool. I won't repeat the horrific things that happened there, read it for yourself, but no, just saying "we are cool" about it goes a little too far.

> Is Microsoft circa 2014 worse than Google, Apple, or Facebook? We're not > nearly as organized as we'd need to be to be as evil as you might think we > are.

Microsoft has been, as most people perceive today, de-fanged. It was a scary monopoly, it was pushing crappy APIs, not following standards, perverting them. That legacy crap is still there. It is still maintained. Someone deals with it. So it wasn't just about browser wars. Imagine perhaps Facebook merging with Google so now everything you do online or anywhere on your computer is controlled by one company. That was kind of how Microsoft was viewed.

So, true, there isn't as much reason to hate anymore. But there is a lot of reasons to not forget as well.

What does that mean in practical terms? It means I won't be jumping on or using any Microsoft technologies if I have a choice. F# looks awesome, but nope, I am not touching it. Maybe Visual Studio 2014 is going to be really great, but I won't even try it. If it is tied with .net anything, not touching it.

> Moreover, I think that Microsoft is very aware of perceptions and is > actively trying to counter them by actually being open.

Too late. Open source Windows if you want to be open. Open source your browser if you want to be open. Go back and fix your broken APIs and start following standards. Google as much as many don't like it (and I am in that camp too, when it comes to privacy), has to be commended for being open and contributing to Open Source. So use Google as your example in that respect.

<comment><USER20> > No we are not cool. > [https://en.wikipedia.org/wiki/Unit_731](https://en.wikipedia.org/wiki/Unit_731) > is not cool, still not cool. I won't repeat the horrific things that > happened there, read it for yourself, but no, just saying "we are cool" > about it goes a little too far.

I think you've missed the point. You can't blame a Japanese child for the sins of his grandfather. The same goes for a German child whose family has a Nazi past or an American whose ancestors slaughtered native American women and children like they were animals.

<comment><USER19> No I didn't miss it, it was just a bad original point. Microsoft is not a child, it is a little too cute of a metaphor. Microsoft is a bureaucratic organization. Just like Google and also governments. Most important, it is effectively the same entity. Japan is still Japan. US is still US. Google is still Google, and Microsoft still Microsoft.

<comment><USER21> Yes, nothing ever changes. What a sad world.

</comment></comment></comment></comment><comment><USER22> Past behavior is a great predictor of the future, and winning back trust is both hard and slow. This post would be more believable if MS isn't still exhorting companies with their large patent portfolio.

Maybe Nadella can change the culture but I have my doubts.

Scott, actions are much louder than words.

EDIT: I'm not saying other companies are much better. However I think it's more productive to have an internal company awareness campaign and mission of "Don't be an asshole", instead of publicly whining about people who still remember past misdeeds or current ones.

[http://www.zdnet.com/microsofts-most-profitable-mobile- opera...](http://www.zdnet.com/microsofts-most-profitable-mobile-operating- system-android-7000015094/)

</comment><comment><USER23> It's been a while since I've acted the angry young man, but it hasn't been all that long since Microsoft found itself happily embroiled in controversies regarding the OOXML ISO vote, notably the Sweden situation.

It isn't enough to fail at being evil. Trying to do so loses you points.

I'm ambivalent towards MS today. I'd like to see good stuff from them, but I treat their stuff with caution.

<comment><USER24> Ambivalent is the keyword here. It has to be said, though, that Microsoft's evil methods have usually been administered in foreign, often developing, countries. [The telegraph's article]([http://www.telegraph.co.uk/finance/financial- crime/10260730/...](http://www.telegraph.co.uk/finance/financial- crime/10260730/Microsoft-faces-US-scrutiny-over-bribery-allegations.html))

I always thought that Windows kinda spoiled the digital culture of a generation And therefore I always supported Linux for professional usage and Apple for personal usage. But that's an opinion based on a range of products; sticking a sentiment like hate to a company that makes tools you still can decide to buy or not to buy, is always pretty stupid.

Unless they're Nestlé or Monsanto, of course.

</comment></comment><comment><USER25> Ah, the great question of modern times: Should I more hate Microsoft or Google? Personally I'll go with Microsoft, because contrary to what the blog says, I feel that Google is far more open, though that still won't make me buy and Android device. At least not without instantly "flashing" it with some custom ROM that's stripped of as much Google things as possible. Would any Windows version allow me to do this? Of course not, WP doesn't even allow me to access the file system. As for Microsoft being aware of anything, it's aware of sales and automated feedback. That's all. Considering Lumia 520 makes up a third of all Windows Phone sales, I assume there will be a lot of cheap phones in the future and little expensive innovation. Both companies are effectively forcing things on people, so talking about "being open" is, in general, out of the question. And with the "cloud and mobile foremost" direction of Microsoft, I don't think I'll have to look for "new" reason to hate Microsoft the same as or more than Google.

</comment><comment><USER26> > Is Microsoft circa 2014 worse than Google, Apple, or Facebook? We're not > nearly as organized as we'd need to be to be as evil as you might think we > are.

Microsoft is not any worse than the other companies. They are all at the same terrible level.

But Microsoft became a bit better over the last years, I would say.

<comment><USER27> I usually think of a business model whereby a company goes around and tells others "pay me for patent X or I'll sue you" as extortion. And shockingly enough, that's part of the modern, saintly Microsoft business model. Not to mention the suspicious fast-tracking of the word document standard.

Another thing is trust. Why would you trust an organization which still had at least a famous C-level executive which executed a number of business strategies you have a problem with? Why would you trust an organization run by Steve Ballmer? Now, maybe new management will turn Microsoft around, but it has done enough dodgy things over the years that yes, it will have to "bend over backwards" for a long time before I trust it again.

<comment><USER27> I'll add that on the other hand, I have the utmost respect for Microsoft Research, which keeps churning out amazing results. I just wish it was called something else. I think I'd like the idea of a chartered research establishment, like the BBC, with a secure amount of public EU money, focusing on the future of computing, and not scrounging for grants.

</comment></comment></comment><comment><USER28> I can't speak for anyone else, but as a Web developer, I hate Microsoft because of their current and recent handling of Internet Explorer - specifically that it doesn't auto-update.

I love my job, but in my job, Internet Explorer 8-9 is pain. It's why we can't have nice things. I checked out a Windows Phone in a store once, and thought it was pretty sweet until I saw the IE logo and physically recoiled. There was no way I was going to own something where I'd have to hit that logo every day to browse the Internet.

That's not ancient history, that's present-day reality.

<comment><USER29> > specifically that it doesn't auto-update

you might want to do a double check on that

<comment><USER8> Ya, IE8 sucks but my Windows 7 machine auto-updated from IE9 to IE10 and just updated to IE11 just last week.

</comment></comment></comment><comment><USER5> [http://www.microsoft.com/openspecifications/en/us/programs/c...](http://www.microsoft.com/openspecifications/en/us/programs/community- promise/covered-specifications/default.aspx)

In many ways, Microsoft's Open Specification Promise is quite a bit stronger of a promise than most people might expect.

</comment><comment><USER30> For many of us, the Microsoft hate has been displaced with complete indifference. I don't think there are more than two people in our 250+ mobile engineering company who even think about microsoft. Even the gamers are moving onto better platforms. For my ease of family IT matters, I've upgraded everybody to Ubuntu. Sorry Microsoft, the war is over. You are now irrelevant.

</comment><comment><USER31> Ms has not changed a lot, the OOXML standardisation process showed this. And putting the actions of 20 years ago in today s context is irrelevant as ms doesn t have the power anymore it enjoyed at that time.

A lot of devs are also still pissed because of the countless hours , ie lost evenings and nights, they had to spend to make their app compatible with IE.

This isnt a defense of apple or google btw, any market controlling company is harming progress imo.

</comment><comment><USER32> It's true, Microsoft is quite different, but not different enough.

For entirely pragmatic reasons, I'd rather use Chrome, Linux, Android, Gmail, Google search and Google Docs.

Typescript looks nice, I might use Babylon.js, and I still use Skype from time to time, but I'll still never use Windows, IE, Hotmail, etc...

<comment><USER5> Linux, yes. Unfortunately, Android seems to be stepping away from "Linux" proper and is becoming its own beast. (OpenBSD and FreeBSD are closer in form and function than Debian Linux and Android).

Chrome? Gmail? Maybe. Google however is pushing far more than Microsoft has as far as dropping my anonymity from Youtube, pushing me into their Google+ features and making me share sign-in information across Chrome sessions. I'd say its a Tie between Microsoft / Google here, both want me in their cloud services.

Although, Outlook.com works a hell of a lot better on Android than Gmail / Google Calendar works on Windows8. So from a usability point of view, Google is beginning to lose it in their anti-microsoft wars. I don't like getting caught up in the middle of their politics. So that's my tiebreaker: Microsoft's calendar platform is supported in more platforms than Google Calendar.

Google Docs vs Microsoft Office? That one is easy. One of them runs on my computer, and the other one is untrustworthy, in the cloud. Do I really trust Google's servers over my own computer? Will Google protect the privacy of my documents from prying eyes?

Nothing beats cold storage on my own computer, Microsoft Office gives me that. Open Office vs Microsoft Office is another story of course... but Open Office is pretty terrible IMO.

Open Office is pretty bad in my experience. Instead... its about Abiword and Gnumeric. Unfortunately, there is no adequate replacement for OneNote and Powerpoint, so I'll keep using those.

<comment><USER11> Am I alone in thinking that Android needs some real, community developed competition that isn't primarily sponsored by an adware company?

<comment><USER33> Yes, you are alone in that.

All android needs are sync adapters for your own mail/calendar/whatever service running on your own hardware. There is no need to discard entire platform just because you don't like Google cloud services.

Most people won't bother running their own servers though.

</comment></comment></comment></comment><comment><USER34> Microsoft killed (or at least delayed, so much that they are not yet here) Linux laptops. I _am_ using a Linux laptop (no M$ tax), but it was not easy to find. And it is not state of the art (HP 635).

Microsoft has forced me to continuously deal with my providers for sending me invoices in a non-standard format (.doc). Because they fought, and are fighting open standards for office documents (I am exclusively using open office / libre office, but that is not a 100% working solution)

Microsoft is one of the biggest extorters using the patent system to tax us all.

I would say that MS is still one of the biggest drags on the world economy: not because their products do not increase productivity (they do!), but because we could be in __much __better place if they wouldn 't have fought open standards.

The damage done is not reversible in a generation: I would say that the economic consequences are more lasting than the ones caused by both World Wars, since those proprietary products have a huge lifespan and have full world penetration, in all economic areas.

So no, I am not about to forget what they have done (and are doing).

</comment><comment><USER35> I don't hate Microsoft for 20 year old reasons. I hate them for 2.5 year old reasons

[http://games.greggman.com/game/webgl-security-and- microsoft-...](http://games.greggman.com/game/webgl-security-and-microsoft- bullshit/)

I'm sure others can list more recent FUD and lies put out by Microsoft.

If in another 5-10 years there's no more incidents of that kind of stuff maybe I'll like them again?

...

Actually I can't really say I hate them now. But I think it's important to point out they are still a pretty shitty company in many ways. I hope they stop that crap.

An x-coworker at my last job had previous worked at Microsoft. His parting message to everyone was how happy he was that at this job the company always tried to do the right thing whereas at his previous job at MS the company always tried to see how much they could get away with.

Of course that's just one anecdote but if true I hope MS can change that attitude to something positive and that we'll see the results for the next few years.

<comment><USER36> > I'm sure others can list more recent FUD and lies put out by Microsoft.

Really? I had a PC on which Firefox and certain WebGL content would hard crash my machine thanks to what I resume are video card driver bugs. (Upgrading video card drivers resolved that particular instance of that problem)

Given that, it is by no means unreasonable to assume that WebGL content might be able to hit security holes in video card drivers. What that entails, who knows. Presumably going right away and saying "sure, we'll just add a hole to let people stream code directly from the web right into your video card" sounded like a horrible idea.

And since IE is shipped with the OS, level component, it has to be supported to customers for-bloody-ever. (Or so it seems at least!) So there is a higher bar, and all of a sudden releasing patches isn't an "auto-update the world and hopefully don't break anyone" sort of thing like it is with Chrome or Firefox, but now it becomes a "well have to test this patch across an almost unimaginable number of test scenarios and machine configs because we don't want to break functionality that any one of our large customers rely on".

At that point, adding a new feature, which even sorta smells like it could open up a whole new can of worms, becomes, for good reason, somewhat less desirable!

(Disclaimer: I work for MS, but in a completely unrelated area, opinions are my own, those of an overly paranoid-for-the-customers software engineer.)

<comment><USER35> And yet MS is now shipping WebGL so it seems like your point is moot. MS doesn't believe the WebGL is insecure else they wouldn't have shipped it.

<comment><USER37> [https://news.ycombinator.com/item?id=7282162](https://news.ycombinator.com/item?id=7282162)

Cmd-F WebGL

<comment><USER35> You do realize MS continued to bash WebGL long after the CORS issue was resolved. The point is there's still reason to hate MS. They are still a bad company that does arguably bad things.

I'm all for them switching to sweetness and light but the OP is suggesting their evil ways were 20 years ago. They're not. Their evil ways are still recent.

<comment><USER37> (Edited to add: I am not aware of any statements on WebGL from MS beyond that blog post, but I don't follow those circles, so I'll accept your word that they continued bashing it after CORS was introduced. However, people I'd trust more than either Google or Microsoft employees, like Carmack and various security researchers on HN like Daeken, agreed that WebGl is a security risk, so I disagree that counts as bad behavior on MS's part.)

So why did Microsoft go ahead and include WebGL? Why, because they had to respond to Google who did exactly the same thing that Microsoft was lambasted for doing with IE: pushing proprietary, unsafe technology before it became standardized and forcing other browsers to catch up. But since you work for Google, I am sure you consider Google's actions to be perfectly not "evil"...

[http://www.extremetech.com/computing/87696-webgl-is- fundamen...](http://www.extremetech.com/computing/87696-webgl-is- fundamentally-flawed/2)

 _> But there's more! Not only is WebGL inherently flawed, but Google — one of WebGL's strongest proponents — even knew about the DoS and cross-domain image vulnerabilities months before they were thrust into the limelight by Context's report. Not deterred by these flaws in the WebGL spec or its implementation, Google pushed ahead and turned on WebGL by default in February 2011, in Chrome 9.

> As terrifying as that is, we now have to wonder why Google rushed the > deployment of a nascent, dangerous technology..._

Note that it was enabled before the v1 of the specification was even released. But worse, when I follow the embedded links in the top para, why I do believe they show that you ("you" as in not Google, "you" as in _you specifically_ ) were aware of these security flaws before anyone else reported it, and yet you (as in Google) went ahead and enabled WebGL in Chrome by default. And then you accuse Microsoft behaving badly! Really?!

 _> They are still a bad company that does arguably bad things_

I'd like examples of Microsoft "behaving badly", preferably:

1) stuff that isn't religious fanaticism;

2) stuff that isn't driven by vested interests that are not in everybody else's interests;

3) and stuff that I haven't already covered in my linked comment ([https://news.ycombinator.com/item?id=7282162](https://news.ycombinator.com/item?id=7282162)). I hope you do better than the other replies in that subthread.

<comment><USER35> Except for the CORS issue have you seen an exploit related to WebGL? As detailed in my post it's unlikely there are any. In fact it's far more likely there are bugs in JavaScript implementations or JPEG decoders or video decoders or font renderers than WebGL.

As for the CORS issue, MS shipped CSS first and CSS had the same issue. Namely that you could change the :visited property to something heavy and then through timing divine a user's web history. Once that was discovered it was fixed. I suspect it was similar to WebGL where someone was like

"hey, you know, it might be possible to use timing to figure out some stuff"

"yea, but that seems pretty unlikely"

a few months later someone shows a working timing attack.

"oh shit, let's fix that"

As for DOSing, as detailed in my post, we (or I) didn't see that as the same level of important because there's no incentive to do it. Sure we worked on fixing it (and that's why WebGL is now enabled by default on several Android devices who's drivers can deal with the issue). But even on devices that can't deal with the issue there's no incentive to DOS someone's machine because they aren't going to visit your website a 2nd or 3rd time if you do that and you weren't able to do accomplish anything else except to get them stop visiting your website. Awesome. I'm going to go make a site right now that people actively avoid visiting. Yea!

You also realize that Mozilla started the WebGL spec, not Google and that Mozilla also released WebGL long before v1. Opera was also involved and MS was welcome to join but never bothered. WebGL is not proprietary. Never has been. So claiming Google is copying Microsoft by pushing proprietary standards is pretty disingenuous.

Want some MS evil evidence? Just Bing it

[http://www.bing.com/search?q=microsoft+fud+2013](http://www.bing.com/search?q=microsoft+fud+2013)

<comment><USER37> _> Except for the CORS issue have you seen an exploit related to WebGL? _

And as far as I can tell, that was the issue MS needed fixed before going ahead with WebGL, but then again I haven't been following their actions in this area. On the other hand, another Microsoft employee seemed to agree with Mozilla and Google: [http://www.theregister.co.uk/2011/06/20/webgl_/](http://www.theregister.co.uk/2011/06/20/webgl_/)

"And, frankly, if Microsoft has taken a formal position against WebGL, no one I know got the memo."

So maybe it was only the MS Security team being paranoid, as they are supposed to be?

 _> As for the CORS issue, MS shipped CSS first and CSS had the same issue. _

Wouldn't that indicate that they have more reason to be wary of things like this?

 _> You also realize that Mozilla started the WebGL spec, not Google and that Mozilla also released WebGL long before v1. Opera was also involved and MS was welcome to join but never bothered. WebGL is not proprietary. Never has been. So claiming Google is copying Microsoft by pushing proprietary standards is pretty disingenuous._

Mozilla doesn't have clean hands in this either. It may not be proprietary, but releasing an implementation with known vulnerabilities? Enabling something widely used connected to the Internet without sufficient hardening is exactly what MS did with Win95/WinXP/ActiveX, and it created a decade of malware- infested Internet. They also got widely excoriated for that. I wouldn't blame them for being cautious going forward.

 _> Want some MS evil evidence? Just Bing it_

So negative advertising is "evil"? I knew F/OSS folks thought MS's publicity against their religion was "evil", because, well it offends their personal beliefs... but so is negative advertising against your employer? Sorry, but Google engages in a lot of that itself, it's just that people in this echo chamber uncritically accept it as fact because it confirms their biases.

<comment><USER35> A company that has objections to a spec discusses those objections with others. A company that is trying to spread FUD hires a 3rd party company to dig up dirt.

Microsoft did the latter.

I'm sorry you can't see it but Microsoft was clearly not showing concern for WebGL's security. As pointed out before, if they had they would have also have brought up Silverlight and Flash 11, which both provide the same features as WebGL.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER38> Dismissing Microsoft's anti-competetive practices and culture as "bundling a browser in the operating system" is more than somewhat disingenuous.

</comment><comment><USER39> Unlike perhaps a decade ago I don't really care about Microsoft today. They're irrelevant to my life, and I don't use any of their software. If anyone recommended using a proprietary Microsoft system I'd respect their choice but strongly advise against it.

You might say that stuff that happened a decade ago is done and gone, but the thing to really consider is whether the people running Microsoft has changed significantly and whether their overall approach/philosophy has changed. I think the answer to that is not much.

<comment><USER17> 90% of them have retired or been fired, just like at any tech company after 10 years.

</comment></comment><comment><USER40> In which someone doesn't understand the difference between doing a thing when you do have a monopoly, and doing it when you don't. I say this as a pretty heavy windows user, but chrome on chromeos and safari on iOS are simply not comparable to ie on windows in the early-mid 2000s.

<comment><USER5> Ahem. You mean Opera and Netscape Communicator were not comparable to IE5 and IE6.

Microsoft IE stagnated at that point, as Netscape morphed into Mozilla Communicator, and then was rewritten into Mozilla Firefox. But IE reigned supreme only after it defeated Netscape Communicator (which was supported by the internet monopoly AOL)

<comment><USER40> No, I meant what I said. What are you talking about?

</comment></comment></comment><comment><USER41> Nope! Being a hatchet-burier weakens my current hatchets.

I'm still boycotting GoDaddy, for example, even though I forgot why. Presumably I had a good reason. And when I've forgotten why I was mad at the companies who wrong me today, I'll still avoid them. This is an incentive for them to be nice _now_ instead of later.

</comment><comment><USER42> Yap, Fairsearch actions tells a lot about how Microsoft has changed, amicus brief in support of API copyrightability tells a lot about how Microsoft has changed

</comment><comment><USER43> > I said, find a new reason to hate Microsoft.

OK. I'm pissed that they dropped the deployment tools from Visual Studio. [1]

People keep saying that the desktop is dying, but PC makers still managed to sell over 300M units last year. But if the desktop market ever does truly die, I think Microsoft can be said to have had a part in that.

[1] I'm not actually pissed. I moved on to WiX, but since you asked I felt pressured to come up with something.

<comment><USER17> Which development tools?

<comment><USER43> They dropped the setup project ( _deployment_ ). If they had dropped the development tools from VS, I'm not not sure what would be left. [edited (twice) for clarity]

<comment><USER17> Sorry, misread. Which deployment tools are you missing?

<comment><USER20> Setup deployment projects went wayward in VS2012. The 3rd party incumbent company suggested by MS is charging for an underwhelming product as an alternative replacement.

</comment></comment></comment></comment></comment><comment><USER44> Google, Apple etc. make sweet products and contribute a lot of FOSS tech back to the community. I'm not a fan of MS products, and they contribute back very little.

</comment><comment><USER45> Microsoft on putting a backdoor on encryption in Hotmail/Outlook.com: "When we upgrade or update products we aren't absolved from the need to comply with existing or future lawful demands."

[http://www.theguardian.com/world/2013/jul/11/microsoft- nsa-c...](http://www.theguardian.com/world/2013/jul/11/microsoft-nsa- collaboration-user-data)

</comment><comment><USER46> I don't _hate_ Microsoft. But I don't exactly _like_ them either.

They've made some pretty piss poor decisions over the last 10 years that have had some huge impacts. IE6 was bad, but I can forgive their ignorance on that — no-one knew any better at the time.

What I can't forgive is IE8, and the years since then that they've CONTINUED to make major-versioned browsers. If IE6 was a one off problem, it'd be fine. But with IE7, IE8, IE9, IE10, IE11, and new ones being released all the time, it just seems like MS don't realise it's a problem. No-one should be making browsers that don't silently auto-update at least once a month. It's physically harmful to the web ecosystem.

I don't care how good IE11 is now, whether they've caught up or not, I care about them putting a system in place that ensures everyone always has the latest web technology. Don't tell me it's not possible. Google and Mozilla have had it sussed for years now. (Apple could do with sorting themselves out on this too. Could also see them go in this direction since Blink split off.)

I can't help but think the version numbers are political? Some group in Microsoft trying to prove its worth by making a big deal about version numbers every year? "Look how much we care about the web, look at our new shiny browser. It goes to 11..."

The web would be way further ahead if Microsoft had stopped making browsers years ago. Millions of hours are wasted every year testing websites in dead browsers. Microsoft created this situation, and they've still not adequately addressed it.

Put your latest browser on everything you've ever made, stop calling out the major version numbers, release every month or so. That's how you'll get people to like you.

</comment><comment><USER47> New rule: if you don't even understand what the Microsoft antitrust case was about, you're not allowed to tell us that it wasn't a big deal.

Doubly so if you work for Microsoft who are currently making similar arguments against Google in Europe.

Nevermind Microsoft, I'm barely three paragraphs in and I'm forming a strong dislike of the writer due to his breezy dismissive style.

</comment><comment><USER48> Microsoft's approach to Web development is not in favor of openness, despite of all of Scott's efforts. They are still pushing the closed, proprietary Silverlight over HTML5.

<comment><USER49> The Silverlight developer community has been up in arms for 2+ years claiming the exact opposite, i.e. that they got completely abandoned in favor of HTML5. Part of that is motivated exactly by the Windows OS group having been pushing HTML5+JS as the primary programming model for apps much harder than they have pushed XAML/WPF/Silverlight ever since Windows 8's new app model got first presented. In server/cloud it's all about HTML5/JS and open standards to the point that Azure Mobile Services only now (yesterday, actually) added .NET support after being exclusively Javascript/Node.js only for well over a year. Recent (<18 months) evidence of Microsoft pushing SL over HTML5 would be greatly appreciated.

</comment></comment><comment><USER50> Some of the animus is also related to regional/cultural tribalisms.

It's the free-wheeling multifaceted Bay Area – or more generally California – against a monolithic empire to the North, whose offerings are most popular among the crass bean-counters of the East.

Even those far away from these regions can be swept up in the same thematic framing.

</comment><comment><USER51> It's not about right or wrong. It's about trust. And MS burned that in the nineties. It would take a tremendous effort to rebuild it.

</comment><comment><USER37> expected, a post about irrational hatred generates even more irrational hatred. But that's what you get when open source is your religion of choice. Since HN does not let me comment too frequently, I'll just address these points in a single post:

1\. "Open source Bing/Windows": Yes, please, give away the things that took thousands of engineers and billions of dollars and decades to build. Look, I like open source and use entirely open source stuff at my day job and hobby projects, and even have open sourced my piddly crap that nobody uses on Github... but nobody is entitled to somebody else's work for free. And damning somebody else for not espousing _your_ beliefs is simply being a religious fanatic.

2\. "Antitrust/Monopoly": They were dinged by the US and the EU for essentially trying to turn their OS into a browser while having an OS desktop monopoly. They were trying to be ChromeOS before Google even existed. They were accused of leveraging their monopoly to enter another market but, as is obvious now, is that the desktop and browser market were one and the same. And then people insist that they "missed the web"! And after almost being dismantled by the US government for going that route, people are angry that they let IE stagnate!

3\. "Android patent trolling" \- They have an impressive patent portfolio (well, by the standards of most patents out there) and have every right to monetize it, which is how things typically happen in all industries. And as an early incumbent in mobile OSs, they did do a lot of work that modern smartphones still use, so it's not like Android isn't standing on the shoulders of WinMobile in addition to iOS.

4\. "API copyrightability": It's not so much that Microsoft and Oracle are right on this, it's Google that's wrong. Google's arguments as to why why APIs should not be copyrightable, taken to their logical conclusion, mean _no code ever_ can be copyrightable. My take is they would be found copyrightable, but Google may probably prevail on fair use.

5\. "Scroogled": It's based on surveys that shows people are not aware that gmail scans their email contents, and when told of this, most of them disapprove. And if the surveys don't convince you, the class action "wiretap" lawsuits recently filed against Google are a clear indication that there are those who don't like this. It's perfectly fine to make consumers aware of their product choices, especially if it's also in your business interests.

6\. "WebGL": There were _actual_ security holes (DOS was just one hole -- the screencap exploit was much worse), and what Microsoft had said then was "WebGL _in its current form_ is not safe". However, as the standard was redesigned to address such issues ([http://www.techradar.com/news/software/applications/why- micr...](http://www.techradar.com/news/software/applications/why-microsoft- decided-to-put-webgl-into-internet-explorer-1167110), search for "CORS"), MS has gone ahead and included it in IE 11.

<comment><USER42> Not sure if serious or just a copy paste from a Microsoft PR.

<comment><USER37> Allow me to rebut your arguments point-by-point:

<comment><USER42> Yap, more less those are all of your arguments, FUD and lies</comment></comment></comment></comment>


Vancouver Limits Airbnb, in an Effort to Combat Its Housing Crisis - <AUTHOR> https://www.nytimes.com/2017/11/15/world/canada/vancouver-housing-airbnb.html?ribbon-ad-idx=2&rref=technology&module=Ribbon&version=context&region=Header&action=click&contentCollection=Technology&pgtype=article <comment><USER2> These forecasters nailed it every time in the past and once again they are predicting the future for us with utmost precision, so that we can take informed decisions and make profitable investments. Housing crisis continues with increasing costs and dramatically low rental vacancy rates. I can hardly imagine how people will manage to pay rent, especially seniors. Some of my friends have already used to taking out extra cash at [https://northnloans.ca/](https://northnloans.ca/) to cover the costs. One thing for certain is interest rates are not headed higher in Canada. The rate will probably be close to zero. Housing prices could bounce back but long term housing in the large cities of Canada will be one of the worst possible investments someone could possibly make.

</comment><comment><USER3> Well the good news is housing will crash anyway, unlike anything seen since WWII.

First there is nothing that really regulates the housing industry per-se. I mean it's more similar to Bitcoin than the NYSE which has numerous safeguards built up over decades of hard earned experiences.

Second, no one is going to buy houses in the future demographically speaking. People in their 20's and 30's have nowhere near the spending power of their parents, the prices cannot be maintained. That combined with the declining birthrate...

If you want a kind of similar historical example, look to the land crashes of the 19th century in places like Kentucky.

Summary: it's a slow burn bubble that we'll have to address in 10 years or so. Don't be terrified but probably don't become obsessed with overinflated real estate.</comment>


Facebook: Smells Like Enron - <AUTHOR> http://www.forbes.com/sites/thestreet/2012/06/08/facebook-smells-like-enron/

<comment><USER2> Enron hid their massive debt to generate a positive cash flow. They were not sustainable towards the end.

Facebook, however, is actually generating value and income.

Comparing Facebook to Enron is essentially comparing apple to oranges

<comment><USER3> Did you read the article?

He talks about Wall Street screwing naive investors with a price that is not justified. Everybody was talking about Facebook is like Google and until short before the IPO they squeezed every bit of revenue out of It to mimic exponential growth. Short before the IPO the revenue was sinking because they overdid it.

Facebook is not as stupid to do something illegal, but they will generate a new phase of distrust like Enron did. This thing was planned for a long time, Facebook didn't use it's full advertising capabilities until short before the IPO. 16Billion was just to greedy and too much, even NASDAQ couldn't handle it. Look at the Google IPO, Google knew how good they were and they did everything in the beginning not to sell under price.

Edit: I got downvoted for predicting exactly that. Facebook didn't do something obviously illegal, but the lawsuits are coming. <http://news.ycombinator.com/item?id=3981888></comment></comment>


Building Web Apps in Go - <AUTHOR> https://astaxie.gitbooks.io/build-web-application-with-golang/content/en/preface.html <comment><USER2> The lack of example code in the security section should be a worry to all.

It isn't hard to prevent SQL injection if you use parameterized SQL statement rather than using string concat, and whilst examples of this are trivial they shouldn't be skipped.

In the XSS section it mentions filtering and checking inputs, but does not mention sanitization and does not give any examples. In the aversion to use any non-standard package it also does not mention [https://github.com/microcosm-cc/bluemonday](https://github.com/microcosm- cc/bluemonday) or anything similar (I am the author of bluemonday - a HTML sanitizer in the same vein as the OWASP Java HTML Sanitizer).

There is some sample code, in the Filtering section, but this only demonstrates the use of a fixed range of inputs in determining a filter, and then a regexp to check the input matches a format.

Beyond the security, where the theory is at least known even if a demonstration on how to implement it is lacking... the entire guide misses out on demonstrating templates to their fullest, and specifically using a map of functions to provide the equivalent of Django's TemplateTags.

In fact, the missing link for most Go developers who are building web apps, and for those coming from outside Go, are template tags. Most Go devs I know (who seem more systems focused) don't even realise that this stuff exists: [https://golang.org/src/text/template/examplefunc_test.go](https://golang.org/src/text/template/examplefunc_test.go)

<comment><USER3> Using string-based templating in general is a really bad practice, as it leaves the door wide open for XSS, SQL injection, etc. Sanitizing inputs, while often cited as the proper thing to do, isn't addressing the root problem: that we're using templating systems that don't use proper data types and thus can't automatically DTRT when rendering.

See [http://www.more-magic.net/posts/structurally-fixing- injectio...](http://www.more-magic.net/posts/structurally-fixing-injection- bugs.html) and [https://www.gnu.org/software/guile/manual/html_node/Types- an...](https://www.gnu.org/software/guile/manual/html_node/Types-and-the- Web.html) for further explanation.

<comment><USER4> Interestingly, html/template does actually handle some stuff like this. Pass html in a string as a field into html/template, and it'll escape all the html automatically. In order to get the html to actually render, you have to pass it in as a `template.HTML`. There are variants of the `HTML` type for different places, including html attributes and javascript code.

</comment></comment></comment><comment><USER5> This seems pretty good. Two huge red flags in my skimming:

1\. The password storage section where it gives MD5 as an option. MD5 should _never_ be an option, not even in a simple testing / prototype application.

2\. It actually calls base64 encoding encryption / decryption. This is really _dangerous_ and outright ___wrong_ __.

So if you ignore security related sections this guide overall seems good.

<comment><USER4> Also, it talks about salting, but it's NOT a salt, or at least it's a horrible salt. A true salt should not be reused at all, it should be unique to each password hash. Generally you see something like '<storedhash> = salt + hash(salt + password)' so you can recover the salt automatically.

<comment><USER6> A global salt for all your stores passwords at least prevents generic rainbow tables from being used against a stolen password database. Salts per password prevents the same password from having the same hash result in your database.

<comment><USER7> There's really no reason to ever use a global salt, it's not like it's hard to generate a random one for each user. If you're already putting in the effort to use salts, might as well go all the way instead of saying "well it's better than nothing ¯\\_(ツ)_/¯" (I'm not directing this at you in particular, just at anyone who intentionally takes half-measures when it comes to security)

<comment><USER8> Theres always will exist an option of having more security, than whatever is already providing by any system.

That brings up the question: when, choosing to not include more security, isn't considered a bug?

<comment><USER9> Not sure where the line is drawn, but it's definitely inclusive of the more secure option when it can be implemented in <10 LoCs of code simple enough 99% of the professional dev community can write it.

<comment><USER4> Even worse, using an actual password hashing lib, i.e. golang.org/x/crypto/bcrypt, is usually going to take care of it for you. 2 lines of code, 1 to make the hash when the password changes, 1 to check if the password matches the hash, and you are done!(as the library already generates and includes random salts in the hash for you)

</comment></comment></comment></comment></comment></comment></comment><comment><USER10> The security section, specifically on encryption, is dangerously misleading. It really needs an overhaul.

To start with - DES is broken, you cannot use it. It also totally blasts over important details like -not re-using the same IV- for AES. Really, it should be updated to use a better higher-level general purpose encrypt/decrypt library, which handles all the happy primitives in a way that you can't shoot yourself in the foot.

As for 'base64' being a good encryption algorithm? All the nopes & I can't evens.

The password stuff is pretty bad too. IDK, needs a re-write.

<comment><USER11> A fix is unlikely—I raised an issue on this over a year ago and my recommendations were rebutted: [https://github.com/astaxie/build-web- application-with-golang...](https://github.com/astaxie/build-web-application- with-golang/issues/354)

Web apps/services should use gorilla/sessions[1], securecookie[2], and Go's bcrypt/scrypt libs.

[1]: [http://www.gorillatoolkit.org/pkg/sessions](http://www.gorillatoolkit.org/pkg/sessions) [2]: [http://www.gorillatoolkit.org/pkg/securecookie](http://www.gorillatoolkit.org/pkg/securecookie)

<comment><USER5> > A fix is unlikely—I raised an issue on this over a year ago and my > recommendations were rebutted: [https://github.com/astaxie/build-web- > application-with-golang...](https://github.com/astaxie/build-web- > application-with-golang..).

That is incredibly unfortunate especially since much of the guide seems pretty decent.

<comment><USER11> I disagree—the guide is Beego centric, and Beego does some peculiar things[1]. I feel like I'm ragging on someone's hard work here, but I take web security seriously, and I want to make sure frameworks (which are attractive to newbies) are doing sane things.

[1]: [https://github.com/astaxie/beego/issues/620](https://github.com/astaxie/beego/issues/620)

<comment><USER12> meanwhile I started to write my own little book on webapps with Go: [https://github.com/thewhitetulip/web-dev-golang-anti- textboo...](https://github.com/thewhitetulip/web-dev-golang-anti-textbook)

<comment><USER13> Which also teaches horrible security practices. Pleas also use gorilla/csrf and not your own brown "solution".

<comment><USER12> okay, you could be less insulting though

</comment></comment></comment></comment></comment></comment></comment><comment><USER14> I'm so conflicted by Go. If I want to write a website quickly, I'd use Python. If I were concerned about performance, I have Java. I write my systems stuff in C++ (Rust now). Is there a compelling reason for me to even learn Go? Is it better than Java in some measurable way? Should I take the time to learn it? Honestly curious.

<comment><USER15> I wrote The Little Go book [free], my first Go blog post was in 2011, and a few of my Go libraries are used by people other than just me.

But Go's not my goto language. I'm a staunch believer in the productivity of dynamic languages. In my opinion, Go's less than stellar type system and weak reflection capabilities exasperate this gap, even moreso for most websites / apis (which deal with impedance mismatch at two boundaries).

But, to answer your question. Consider first that Go's very simple to pick up. So the investment is small. Second, where I differ from you is on your second point: Java. I dislike it. It's complicated and verbose and gets in my way. Rust and Go are both proof that we know how to build better languages now. So, when I need to share memory across multiple cores and performance is a concern, I switch to Go because it's fast and simple.

<comment><USER16> I actually think Go's simplicity is a weakness because it will only get you so far. Take web development for example, all the tutorials show json.Unmarshall, but this one stackoverflow post says I should use json.Decode. Oh shoot now I'm having all sorts of problems because I don't really understand json.Decode.

Furthermore I think most people reach for Golang in the beginning because they want performance. However I've found it incredibly easy to write unperformant Go.

I think Golang will ultimately be a very important stepping stone in language development in terms of concurrency, type systems, standard libraries, deployability, and many other categories. I think a lot of important programs will be written in it. And ultimately I look forward to how future languages draw from it.

<comment><USER17> "I actually think Go's simplicity is a weakness because it will only get you so far."

Some may argue that Go's simplicity is a strength. Adding moving parts doesn't always help.

</comment></comment></comment></comment><comment><USER18> Over the previous few weeks, I've seen multiple projects including one internal project drop Go. There was the widely publicized story [1] where Dropbox was switching from Go to Rust. More recently one of our backend engineers who built a prototype in Go told us that they pulled all of the GoLang code out in favor of C++/Python citing a huge overhead (I don't remember if it's CPU or Memory footprint). I know a lot of people are touting the concurrency model, but I've seen so many technical analysis of unfavorable technical analysis of Go that I'm starting to question whether I should learn Go or invest my time learning something else?

[1] - [http://www.wired.com/2016/03/epic-story-dropboxs-exodus- amaz...](http://www.wired.com/2016/03/epic-story-dropboxs-exodus-amazon-cloud- empire/)

<comment><USER19> While the concurrency model _is_ nice (especially waiting on multiple channels - I haven't found a way to do that nicely in C++), I think there are other bigger advantages to Go:

* The standard library is _really_ nice. It has almost everything you want and it's written in a clean non-enterprisey way

* It generates a single statically linked binary. Doing this is very difficult in most other languages.

* It's really really easy to cross-compile. Again, often very difficult in other languages (you might even have to compile your own compiler).

* It comes with a built in battle tested HTTP2 server, and a sane TLS library.

* It's a very simple language so it is easy for beginners to pick up, and also easy to read other people's code. Don't underestimate the importance of this - there's nothing worse than writing something awesome in a language that your coworkers find difficult, and then perpetually having to support it.

* The tooling is pretty good.

* Performance is good, and they've done really good work on minimising GC pause lengths.

Of course I wouldn't pretend there aren't downsides ( _cough_ generics), but they're mostly minor and certainly no worse than you'd have in any other system (C++/Python sounds like it would have more than its fair share of issues!).

Edit: Aside from generics, my biggest complaint is the impossibility of RAII. It's too easy to forget to `close()` things. Most languages suffer from this though, and at least Go makes some attempt to improve matters with `defer`.

<comment><USER20> > it generates a single statically linked binary. Doing this is very difficult > in most other languages.

For AOT platforms it's difficult mostly due to glibc. e.g. on FreeBSD and Linux musl it's trivial to build fully static binaries.

Otherwise all valid statements and Golang is an improvement over other mainstream languages. So here's some future items for improvement that would make it even better and well suited for wider use:

* a nicer error handling mechanism, though this may be hard

* dead code elimination. Golang's static binaries are huge compared to fully statically compiled executables for other languages. I suppose the new compiler passes and backend might provide a basis to solve this.

* restore compile speed, which of course was mostly due to previously missing optimizations and simple compiler passes, which were added now and made it slower. Still the Wirth'ian language design allows for much faster compile times than C or C++.

</comment></comment></comment><comment><USER21> Looks like a great contribution to the community. Major props for freely releasing it.

Most of the Go references that I tend to come across tend to focus on code, concurrency and API's without much attention to the full stack web app side. This definitely helps to fill that gap in the community.

Just flipping through the contents and skimming the chapters, the IDE section alone is really impressive.

</comment><comment><USER22> This book is open source: [https://github.com/astaxie/build-web-application- with-golang...](https://github.com/astaxie/build-web-application-with- golang/tree/master/en)

To those with suggestions related to e.g. security pratices, step up and contribute!

<comment><USER23> If the author is rejecting security concerns (as noted elsewhere in the comments) there's not much point in offering help there right?

</comment></comment><comment><USER24> Sad to see things haven't changed much on the sql front. Many web apps don't care about performance for the language, since the cost of querying the db will be orders of magnitudes higher anyway. What they want is a simple one liner to persist object graphs into a DB, because 90% of the code will be glue code around insert from json, and select to json types of features ( i'm talking list & forms types of web apps, not the fancy video chat over webrtc demo).

The fact that this books advertize "build your own orm" solution, with the one given not even able to select 1-many objects makes me really wonder how in the world one could recommend go for web apps.

Ps: to get a benchmark on what is the current level of productivity expected today for enterprise-like web apps, just have a look at a loopback.io demo. Yes, it's node.js which sucks, but you have to admit that we're pretty far away from manually mapping result columns to struct properties.

</comment><comment><USER25> Needs much of the proofreading. I'm arrays\slices part, and there are a couple of mistakes already

Like

// define a slice with 10 elements whose types are bytes var ar = [10]byte {'a', 'b', 'c', 'd', 'e', 'f', 'g', 'h', 'i', 'j'}

</comment><comment><USER26> I find Go to be a concise and productive language for computing infrastructure applications, but struggle to apply it to problems with complex domains in business and industry.

For those, other languages like Java and C# that better support encapsulation and data/information hiding for the modeling of real-world concepts remain suited.

I think the problem with a lot of language discussions is really about the need for many to find the "one true ring" that can be learned and applied everywhere.

Instead, a polyglot approach surely is the best one?

</comment><comment><USER27> Another project that was posted on HN se months back: [http://go- bootstrap.io/](http://go-bootstrap.io/)

I think it serves as a good example of how one can use go for webapp development.

With that said, after a year+ of writing go in my day to day job, I still gravitate towards dynamic languages for web application development and leave go for most systems programming tasks.

</comment><comment><USER28> Offtopic: Is there any decent Go boilerplate for building API?

<comment><USER29> net/http: [https://golang.org/pkg/net/http](https://golang.org/pkg/net/http)

I'm not trolling. It seriously is easy enough to crank out a basic web app in less than a hundred lines of code that runs very well with just the standard library.

<comment><USER30> While I completely agree that the standard library is all you need in quite a lot of cases, the parent seems to be asking from more of a _" how do I structure my application"_ perspective. A tool that generates the boilerplate necessary to use the standard library effectively in a complete application. Not just http handlers, but think of the persistence layer, for example. The standard library does not assist much with the engineering aspect of the job.

<comment><USER28> true. I have problem when it come to structuring the application so i want a boilerplate so that I can see what everybody has been doing.

</comment></comment></comment></comment><comment><USER31> Are people who are using Go (for web apps) using it with Apache or Nginx? Or is every go app just using a DIY server? I'm genuinely curious

<comment><USER32> That is a good question; I also wonder what a real world production environment looks like.

A Go program listening directly to port 80 running as root?

What about virtual hosting, https, load balancing and so on?

<comment><USER33> Actually, you choose.

I like to use [https://caddyserver.com/](https://caddyserver.com/) as reverse proxy for the easy setup and buildin Let's Encrypt support. You can also use Apache or Ngixn if you want.

But you can also bind directly to port 80 if it's a simple app.

</comment></comment></comment><comment><USER34> In multiple languages even. Very cool : )

</comment><comment><USER35> There's so much good content here, but it's also very surprising how much of it is truly a "roll-your-own and hope you get it right" approach.

If you have to write explicit code in each of your postbacks to check a CSRF token, it's going to happen that not all your posts will end up being protected. If you have to hand-build SQL queries, it's going to happen that you'll have injection vulnerabilities. If you are manually generating and signing cookies, and having to write explicit code to sign them and check signatures... These are all features that should be done in a core library which makes sure these things happen all the time, not just when you remember to, what, copy/paste the code into each of your functions to do it?

There's the overall structure of the code, which seems like it would quickly devolve into chaos. Looking at Section 4.4 there's a 'login' function which handles rendering the GET as well as processing the POST just by if/else on r.Method. You wouldn't want to actually structure a code-base like this, right? Later on, they do show a 'Beego' based router, which seems a bit more sane, but I'm really not a fan of 'showing the wrong way first' as a learning tool.

The particular techniques being used seem very home-grown and not particularly best practice. To prevent double-submit they add a hidden field with token=MD5(time.Now) and also save it to "a session cookie on the server side"? Not quite sure what that means, but I think it's trying to say save the token on the back-end linked to the session, and then verify a POST, from that page, on that session, has that token. And then presumably clean up the storage... The majority of which is not actually coded in the example, making it just a high level roadmap of what you could do, not a practical working starting point. But anyway, if your goal is to prevent multiple POSTs per GET, and you already have a transactional session state for the user, then you do it with a server-side counter, not a hidden field, and certainly not a "obfuscated" MD5(time.Now). Even if you have no session state, then the simple answer is to create session state, not to create another token which does exactly the same thing as session state, but in a completely insecure manor.

So overall I have a ton of respect for the work that was put into this document, it tries to cover a lot of material and is very easy to read. But I think the details also matter and 1) I can't believe this is idiomatic Go for how to actually route and manage requests, and 2) the entire proposed tool-set for actual secure processing of Sessions, SQL, CSRF, XSS, etc. seems to be totally home-grown and not at all production ready.

</comment><comment><USER36> I would expect something like Go On Rails (no pun intended). That's where history repeats.

</comment><comment><USER4> Note, in the IDE section: LiteIDE has gocode bundled, and in most cases, you can leave the GOROOT and such alone. I have yet to need to change it on either linux or windows.

</comment><comment><USER37> What's the current state of web frameworks for Go? Is there something similar to Django or Rails out or in development?

<comment><USER38> I can't speak to that, but I have seen a few Sinatra/Express like frameworks. I used Gin [1] for a production project and it held up well under load.

[1] [https://gin-gonic.github.io/gin/](https://gin-gonic.github.io/gin/)

</comment></comment><comment><USER39> The author is the maker of Beego

</comment><comment><USER40> development time and performance that is only slightly slower to write than Python

</comment><comment><USER41> The vim section is obsolote. There is no `misc/vim` anymore.

</comment><comment><USER42> Great book. Thanks

</comment><comment><USER43> This is amazing!!

</comment><comment><USER44> thanks for sharing

</comment><comment><USER45> I've got to be honest, when these language shootouts come up (and it feels like I've read a lot of them this week), it reminds me why I'm pretty happy working in C#. I've got great tooling, generally good libraries, a pretty decent core language, and generally, shit just works so I can _get shit done._

Is it super sexy, no. Does it win me Internet Geek Points™, no. It's pretty much still Windows-only, but fine, that's the world I live in. The foot-guns are relatively small-caliber, and I've learned enough to avoid pointing most of them. I can do OOP, I can do functional (maybe not super pure ivory-tower monad/ADT/pattern-matching sorcery, but whatever - still have F# on my todo- list...), I can write straight procedural code if I really wanted to. I've even got a REPL and can use it as a scripting language.

Plus, I have generics :-)

<comment><USER46> Honest question - what is the point of this comment?

While I understand that HN has quite a population of .NET platform devs these days, traditionally this sort of noisy comments would be quickly rendered transparent (this one even claims to justify itself relative to a "language shootout"....only it's just a page talking about Go best practices, so it is off the mark). And the "Internet Geek Points™" thing is just nonsensical, and has become another defensive .NET talking point (e.g. "We're not trend chasers...now let me tell you how we also incorporate all trends").

I would have ignored it, but the above "language partisan" comment, having utterly nothing of value to add to the comments, or this story, and being completely out of context, has been floating on the top, betraying a pretty profound twist in the saga of HN.

<comment><USER47> Combine a momentum oriented society with an up/down vote button on everything and this is what you get.

Voting based on insightfulness or relevance simply cannot work when only a small minority can ever be expected to stick to it. We are being conditioned on picking a side and then boosting that side no matter what.

Voting up a comment that is in disagreement with your own opinion makes it look like you are losing the debate if being upvoted is generally associated with being right. So most people won't do it.

I believe the only way to prevent this in a community is to force people to use only words to express opinions. In my view, voting has no place in debates. And yes it means that we're not going to get our debates filtered and ranked according to insightfulness. But at least we're not getting any false signals based on perverse incentives either.

<comment><USER48> > _I believe the only way to prevent this in a community is to force people to > use only words to express opinions. In my view, voting has no place in > debates. And yes it means that we 're not going to get our debates filtered > and ranked according to insightfulness. But at least we're not getting any > false signals based on perverse incentives either._

And yet, I just upvoted your comment because it seemed much easier than typing a reply to say that your comment was of interest to me and I enjoyed reading it. But now I've said that as well.

I like having the flexibility to do both, but I recognize the compelling arguments you've made about the problems with having voting available everywhere. On HN in particular, I feel the downvote capability should be further constrained than it is presently (I think it opens at 500 karma presently).

<comment><USER49> Perhaps the downvote button should be changed to a flag (essentially how I use it) which might discourage using it for disagreement. I only downvote a comment when it is abusive, belligerent, blatantly condescending, or clearly nonsensical and unwilling to actually converse.

Ideally upvote would only be used for well-stated well-reasoned arguments with a plausible basis, regardless of the actual position, but I sometimes find myself upvoting a comment because I agree with it's conclusion. I think the agree-upvote is lamentable, but unavoidable in general.

Some UI changes might be able to fix the disagree-downvote (i.e. change to 'flag'), but I feel that the agree-upvote is too much a part of human nature to have an easy fix.</comment></comment></comment></comment></comment>


The Next Wave of 'Unicorn' Startups - <AUTHOR> https://www.nytimes.com/2019/02/10/technology/new-wave-unicorn-start-ups.html <comment><USER2> I didn't knew the meaning of "unicorn" when applied to companies. Maybe I'm the only person who still hadn't, but if there are others - to save them a search query:

"A unicorn is a privately held startup company valued at over $1 billion." \- [https://en.wikipedia.org/wiki/Unicorn_(finance)](https://en.wikipedia.org/wiki/Unicorn_\(finance\))

<comment><USER3> Yeah I'd say the majority of people here know what a unicorn is.

<comment><USER4> The parent is one of "today's lucky 10,000"

[https://xkcd.com/1053/](https://xkcd.com/1053/)

</comment></comment></comment><comment><USER5> "Wow, 11 of these 50 were funded by Y Combinator:" \- Paul Graham via Twitter - worth a read of that thread in which PG also notes that he has had nothing to do w/class selection since 2014:

[https://twitter.com/paulg/status/1095075300852019201](https://twitter.com/paulg/status/1095075300852019201)

<comment><USER6> That makes it sound like a PR piece.

<comment><USER7> *submarine

<comment><USER8> Made me wonder how likely it was that "Funded by YC" was one of the criteria used by the analyst to come up with the list.

<comment><USER9> It has to be. _Many_ people know how to write software, only few get ongoing advice from the industry's top advisors and have a line out the door to fund them. King-making is a thing, even if only a partial thing.

</comment></comment></comment></comment></comment><comment><USER10> The online pharmacy (Alto Pharmacy) and online doctor (KRY) are the ones that sound like they could be unicorns, but they are going against entrenched interests.

Uber took on cab drivers and won. Doctors and pharmacists have much stronger quasi-unions (the AMA and AphA).

<comment><USER11> Kry has already won in Sweden. The resistance is dead.

</comment></comment><comment><USER12> Earnin is a scam that disproportionately targets young poor black/latino people. It's JG Wentworth in an app. Doesn't count as a unicorn because it's not innovative at all.

<comment> gingerbread-man The payday lending industry operates within an intrinsically challenging ethical landscape. Their customers are generally poor, often desperate, and proportionately vulnerable. But payday lenders also don't operate within a vacuum: often the costs of high-interest-rate loans are dwarfed by comparison to the late-payment fees charged by credit cards, landlords, insurance companies, doctors offices, auto lenders, bank overdrafts, etc... As the saying goes, it's expensive to be poor. In one survey of payday loan customers performed by GWU Business School, 89% of borrowers said they were "very satisfied" or "somewhat satisfied" with their most recent payday loan. [1] No one wants to be in that situation, but for some, payday loans are the best or only option.

It's one thing to call out the kind of deliberately predatory behavior that has thrived in the payday lending industry, but it seems like Earnin is earnestly trying to provide a service that many Americans outside (and inside) the Bay Area fall back on, in the fairest and least-predatory way possible. As far as I'm concerned, that's something to be applauded, not scorned.

[1] [https://reason.org/wp- content/uploads/files/payday_lending_r...](https://reason.org/wp- content/uploads/files/payday_lending_regulation.pdf)

<comment><USER13> Payday lenders don't operate within a vacuum but people would still be better off if they didn't operate at all:

[https://www.responsiblelending.org/sites/default/files/nodes...](https://www.responsiblelending.org/sites/default/files/nodes/files/research- publication/crl_shark_free_waters_aug2016.pdf)

<comment><USER14> Speak for yourself. A payday loan was the only thing that bailed me out from missing rent and getting evicted.

Payday loans are a lot less predatory than every major bank credit card. They at least ensure you have money to pay them back.

<comment><USER13> The study showed that people showed a strong tendency to tap other options where payday operators weren't available and ended up financially better off overall.

</comment></comment></comment></comment></comment><comment><USER15> Demographics:

21 in California (16 in San Fran)

11 in APAC

9 on the East Coast (including MapBox)

3 in Europe

3 in S. America

3 in "other US"

<comment><USER16> Mapbox is also in sf, with most of the company leadership based there (I used to work there)

<comment><USER17> Why did you leave?

</comment></comment></comment><comment><USER18> Seems like the linked article is more an analysis / summary and doesn't actually have the list, which is in _this_ linked article:

[https://www.nytimes.com/2019/02/10/technology/these-50-start...](https://www.nytimes.com/2019/02/10/technology/these-50-start- ups-may-be-the-next-unicorns.html)

Did they rejigger things since the submission?

</comment><comment><USER19> They site a lot of stuff from cbinsights. I don't know about others but I find cbinsights analysis a bit sloppy sometimes. They kept crowing about the potentials blockchain and how it was the future all through the crash as though it wasn't even taking place. They also had this piece about we work which painted them in glowing colors right in the aftermath of the additional funding from softbank not coming through, giving fluffy reasons why they think their still going to continue to upend the industry. Plus all their emails end with "I love you" which is getting old and annoying. Not intentionally smashing them but just making the point that aside from the numeric data they collect on startups which is pretty cool, I'm skeptical about using their analysis pieces as a proper source

</comment><comment><USER20> It looks like the list and the commentary are on separate pages:

List: [https://www.nytimes.com/2019/02/10/technology/these-50-start...](https://www.nytimes.com/2019/02/10/technology/these-50-start- ups-may-be-the-next-unicorns.html)

Commentary: [https://www.nytimes.com/2019/02/10/technology/new-wave- unico...](https://www.nytimes.com/2019/02/10/technology/new-wave-unicorn- start-ups.html)

</comment><comment><USER21> They should describe how they came up with this list. For example, Alto pharmacy, which appears to primarily operate in California, is on the list. They raised $50 million last December. Capsule pharmacy, which essentially does the same thing, primarily operates out of NYC. They also raised $50 million a few months earlier, in August 2018, but are not on this list. Wonder why?

<comment><USER22> Amount of funding != value of company

A funding round is for X% of a company at $Y dollars, which values the company at $ ((100 / X) * Y).

Looking at two recent announcements that I follow, Aurora raised $530mm at $2.5b valuation and Nuro raised $940mm valued at $2.7b. Aurora sold ~21% ownership, and Nuro sold ~34% ownership, but both ended up around the same valuation.

<comment><USER21> I realize that, and I don't have the valuation numbers for either company, presumably CB Insights does. But using the example you gave, if there were a list of companies entering the 3 billion valuation, business fundamentals aside, I'd be hard pressed to pick between Aurora and Nuro.

</comment></comment></comment><comment><USER23> Honestly haven't heard of any of those potential unicorns (except Zola), but I guess that is sort of the point!

</comment><comment><USER24> This list looks positively anemic. How is this anything but a business insider esque PR puff piece?

</comment><comment><USER25> I'm not sure how up to date the wiki unicorn list is, but for those interested:

China (131) U.S. (85) India (20)

\----

Some of those listed will likely fall-off in the near future (e.g. Ofo).

</comment><comment><USER26> Mapbox, Check, Marqeta, and Segment are basically already unicorns. Wouldn't be surprised to see them IPO in the next 3 years.

</comment><comment><USER27> No Paywall: [https://outline.com/qp6P8w](https://outline.com/qp6P8w)

</comment><comment><USER28> Despite predictions to the contrary, San Francisco (and Bay Area) continues to kill it when it comes to unicorn production

<comment><USER29> Who predicted the contrary?

<comment><USER30> how about the economist? I wouldn't say 'predict', but definitely painting a negative portrait

[https://www.economist.com/leaders/2018/08/30/why-startups- ar...](https://www.economist.com/leaders/2018/08/30/why-startups-are-leaving- silicon-valley)</comment></comment></comment>


Protect Yourself From The NSA With WireOver's (YC W12) Encrypted File Sharing - <AUTHOR> http://techcrunch.com/2014/01/17/wireover/

<comment><USER2> Closed source, no thanks. I'm going to follow their approach of "trust no one" and not trust them and warmly recommend everyone to do the same. If you actually mind about security, use GPG.

<comment><USER3> After the NSA leaks, the security community is scrambling to verify that _widely-used, open-source_ software is free from backdoors. With dual_ec_drbg, we know at least one case where a cryptographic primitive itself was compromised. Furthermore, we know now that governments can and do force companies to compromise their own users, in secret, under gag orders.

Why anyone would use closed-source "security" software today is beyond me.

</comment></comment><comment><USER4> _Really_ good copy on the WireOver homepage. Kudos!

I counted a mere 99 words (not including navigation) and every one of them tells. Concise and casual is a powerful combination.

I especially like the slogan/pitch:

 _Send Big Files Really Securely_ tells me exactly what the product does and makes me think it'll be easy and fun to use.

<comment><USER5> unlike the techcruch article which has some glaring errors (don't they have proof readers anymore?) as

"You can just upload a file, email someone a link, and shut off your computer."

* should be "can not"

<comment><AUTHOR> They fixed it.

</comment></comment></comment><comment><USER6> Important to note that only paid accounts get end-to-end encryption. Transfers on free accounts are unencrypted.

[http://www.wireover.com/pricing/](http://www.wireover.com/pricing/)

<comment><USER7> That... kind of stinks, actually. If your free version doesn't offer the value proposition that makes people excited about your service in the first place, you should perhaps rethink having a free version. It's like giving away popsicles without the stick.

<comment><USER8> or, depending on your point of view, sticks without the popsicle :)

</comment></comment></comment><comment><USER9> I tried it few months ago and was not impressed. The installer hung on the first run. The app itself crashed. When I tried again in a week they seemed to have a new version and that one actually launched. However it looked completely foreign in Windows as if it were written in Tcl/Tk or some other cross-platform oddity. I clicked through the UI, tried to initiate the file transfer and then gave up. The reason was not that it didn't work, but that it looked as a half-baked product that shouldn't really be let out, even into the beta. You'd expect to find something like this on SourceForge, but not in a form of a commercial _security_ product. It just wasn't trust inspiring :-|

That said I realize that they could've redone the app from scratch in past few months, so take the above for what it is - an impression from a beta.

<comment><AUTHOR> I suspect that you tried it when we were in private beta. The UI and reliability are significantly improved. Give it another try.

</comment></comment><comment><USER10> I use [https://www.sharefest.me/](https://www.sharefest.me/) for quick file transfers and it just works with only a web browser. Only downside is Chrome and Firefox don't inter-operate.

Not that sure about level of security, but I have a harder time trusting proprietary software over OSS stuff.

With sharefest I could even run my own service if I wanted to, all the code is on Github.

</comment><comment><USER11> Source visible? How are keys exchanged? How do you make sure the person you are sending the file to is in fact that person and not someone else?

<comment><USER12> They say key exchange is by Diffie-Hellman, and authentication is by validating fingerprints.

[http://www.wireover.com/security/](http://www.wireover.com/security/)

<comment><USER13> "WireOver uses what we believe are the most appropriate, safe, up-to-date, peer-reviewed crypto primitives, implementations, and parameters [...] Fingerprint Algorithm: MD5"

I fear this page was written with a straight face :(

<comment><AUTHOR> There's a tradeoff between collision resistance and fingerprint string length. We chose MD5 because people are comfortable with it in ssh, it's a shorter string to verify than something like SHA-256, and because we planned to make your peer's entire public key base64 available if you really wanted to go that extra mile (currently not available).

What would you prefer personally: (1) MD5 fingerprint for convenience AND entire peer public key base64 available if you really want; vs (2) just a longer SHA-256 fingerprint.

<comment><USER14> If you just want a shorter string, I'd prefer truncated SHA-256.

<comment><USER15> Yes, this is the correct way to get a shorter hash. Using MD5 is a terrible idea.

<comment><AUTHOR> We're changing it.

<comment><USER15> Good call.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER16> Why did it take so long to launch? It looked like it was ready to go ~2 years ago.

<comment><USER17> who cares? Comments like this are why innovators have to work in deathly secrecy.

</comment></comment><comment><USER18> for a free similar service check out:

[https://github.com/abemassry/wsend-gpg](https://github.com/abemassry/wsend- gpg)

its a little different premise, but worth checking out

<comment><USER19> Send encrypted PGP messages by one click:

[https://github.com/encrypt-to/encrypt.to](https://github.com/encrypt- to/encrypt.to)

Another free service with PGP support.

</comment></comment><comment><USER20> So if sending files in the clear is free, whats stopping me from encrypting the files myself and then sending them? Is their value in key exchange, convenience?

<comment><USER12> Try explaining encryption to a doctor/lawyer and you'll have the answer to your questions.

<comment><USER21> In my experience they are fine with encrypting PDFs. Adding a password to a ZIP seems to be more of a stretch.

</comment></comment></comment><comment><USER22> Congrats on launching! I met Trent briefly a few months ago, but it's clear he has an awesome focus on building a solid, secure product. It seems like it took a while to get this out the door but when your core value prop is security, you can't really cut corners.

Haven't sent a file yet but the download/signup flow was super easy - I was ready to send in about 20 seconds.

</comment><comment><USER23> Didn't Sendoid do this from YC W11?

<comment><AUTHOR> Indeed, but they are no more. There's still a relatively unmet need for sending huge files fast (and free) and for sending with incredibly strong security.

<comment><USER23> Have you chatted with them and asked them what their experience was like?

<comment><AUTHOR> Yes.

</comment></comment></comment></comment><comment><USER24> I like their warrant canary for the simple reason that it says "we have received 0 requests from any government agencies to provide any information about any of the following: our users, transfers, code, security architecture, or security credentials."

Although, making a list explicit like that is a creative lawyer challenge to look forward to - I'm not going to ask for something on that list, but I'll ask about something else...

<comment><USER25> I'm not sure how useful that canary is going to be, though. Secure transfer of large files is a powerful tool for many people, including unsavory types like child porn distributors. I expect and encourage the government to investigate things like that, and those lawful, ethical investigations are going to bump the counter, making a lot of people think "The NSA is all up in our filez!".

<comment><USER24> I think that's why it's important to pay attention to the President's reforms - as in, see which ones can make actual improvements even if they all can't. Changing the gag order process has the ability to do this b/c you can have, for example, a counter for child porn, a counter for domestic terrorism, a counter for foreign terrorism. Not by providing the service with any confidential files that are part of the case but by making sure some public advocate who does know the type of case can see to it that it's been coded into the gag order appropriately. I'm just spitballing off the top of my head but what argument would they have to not allow a service provider to show that child pornographers should not expect to be safe here - it's win win.

</comment></comment></comment><comment><USER26> Just started using btsync and pretty impressed with the ease of use so far.. Couldn't get dropbox going on Linux..

</comment><comment><AUTHOR> Thank you, commenters. Your feedback carries weight.

We have a "Friends of WireOver" group that we'll occasionally ask for feedback, advice, and new release testing. Email friends_at_wireover_dot_com to join.

</comment><comment><USER27> How do you uninstall this?

Edit: Click gear icon, go to About tab and there is an uninstall button. Support was very quick to respond to me.

</comment><comment><USER28> I just create a torrent for the big file and email that torrent to the recipient...

<comment><USER7> Torrents don't necessarily work behind NAT, especially corporate NAT. (And they never will, because there's really no cost-effective way to provide an M:N equivalent of TURN[1], unless you throw the advantages of peer-to-peer transfer away entirely by creating a hub-and-spoke model.)

[1] [http://en.wikipedia.org/wiki/Traversal_Using_Relays_around_N...](http://en.wikipedia.org/wiki/Traversal_Using_Relays_around_NAT)

</comment></comment><comment><USER29> Congrats on the launch!

</comment><comment><USER30> If not in-browser, not interested; sorry.</comment>


Show HN: Take PayPal payments with a Google form - <AUTHOR> https://paybyform.com <comment><AUTHOR> I built this as a side project over a few weeks. Apps Script is surprisingly limited in terms of customizing forms, but I'm happy with the result. There are of course plenty of alternative form builders our there, but this is the only thing to help people take payments if they're sticking with Google Forms for one reason or another.</comment>


VCs Look to Royalty-Based Financing to Fund Startups - <AUTHOR> http://blogs.sun.com/sun4startups/entry/vcs_look_to_royalty_based

<comment><USER2> Payments start with revenue. No revenue, no payments. People say revenue starts "immediately" assuming that the royalty-based VC funds a business that already has some revenue. To your other point, it's not that there is less pressure for revenue, but less pressure for "growth" (ex. hiring, expansion, etc.) at the expense of profitability. VCs often push for premature growth at the expense of profits (so they can inflate the company and sell it as fast as possible), whereas RBF is more in line with rapid profits at the expense of growth - i.e. more organic growth through profits. As for Vinny - in RBF if the venture doesn't earn revenue, no payments go back to the VC. Also, if the venture fails and closes, the VC never gets his/her money back. In contrast if you don't pay Vinny, he breaks your legs. :) Banks too.

</comment><comment><USER3> Don't understand. No cash flow for months; how can payments start immediately? How can the pressure be LESS to build/ship product for revenue? How is this different from Vinny the loanshark?</comment>


International Fellowship applications for Part 1 now open - <AUTHOR> http://www.fast.ai/2017/09/08/international-fellowship/ <comment><USER2> New version of part 1 of deep learning course will use pytorch ?, What is the benefit of being an international fellow learner than learning when the course is posted online</comment>


What web-based Whois tool do you use? - <AUTHOR>

I've just discovered http://IPmango.com, it's fast but it doesn't have a bookmarklet or querystring lookups. Betterwhois doesn't always give full results, I have reservations about doing lookups at registrars, and domaintools occasionally asks for a login. Others have captcha or have minimum times between lookups.<p>What have you had success with? <comment><USER2> I like EasyDNS, which provides:

<http://www.easywhois.com>

</comment><comment><USER3> i used to use pcnames.com but its been having problems lately.</comment>