Android is splintering, just not how you think it is... - <AUTHOR> http://www.russellbeattie.com/blog/android-is-splintering-just-not-how-you-think-it-is

<comment><USER2> In what other ways is Android splintering?? This post talks about the sort of splintering I thought everyone was talking about when they talked about splintering: multiple devices, different hardware capabilities, different versions, carrier and manufacturer-applied customisations.

<comment><USER3> There is also splintering in the Linux sense, where the actual software is branched into a number of moderately-compatible versions that include different features, different ways to manage the software, and different interfaces.

Despite its open-source nature, we haven't actually seen any real forks of Android yet. I'm assuming that's the sort of splintering the article refers to.

</comment></comment><comment><USER4> The outlook gets quite a bit brighter when you limit the field to actual phones -- which is where the development is focused.

I understand that the promise of Android is compatibility across many different kinds of devices, but at this stage it's a bit of a strawman to pull out the Archos which is a: not a phone, b: a very early device and c: not Google sanctioned.

In other words, I'm with Tim Bray on this one.

</comment><comment><USER5> A lot of people talk of splintering as if it doesn't exist on the iPhone.

1\. different devices have different hardware capabilities: my 1G doesn't have bluetooth, early iPods don't have a camera, etc. Apps have to deal with that on every platform and it'll only get worse as Apple ads more hardware features.

2\. different screen resolutions: Android is simply ahead of the game on this one, the iPhone isn't going to stay at 480x320 forever (I'm willing to bet a lot of money next year's iteration will not have that resolution)

<comment><USER6> The challenge that Android faces is that multiple versions of software/hardware are available to purchase at the same time. While Apple only has one version of the iPhone in stores.

I hope Android succeeds to keep Apple innovating and honest.

<comment><USER7> Android's challenge vis-a-vis the iPhone will be that Google doesn't know a lot about consumer electronic devices, and the wireless carriers don't know a lot about consumer software. Apple is among the best at both.

</comment></comment></comment><comment><USER8> _I recently bought an Archos 5, which I'm very happy with as a gadget. However, it's stuck on v1.5 of the Android OS right now, with a custom GUI extension added to make up for its lack of keys and home/menu/back. Additionally, it's not a Google-sanctioned distribution, so there's no Android Marketplace, nor able to run any of the important Google apps: Mail, IM, Maps, etc._

OK, so everybody can take Android and run it on their device.

 _Google needs to get control quickly. I had originally suggested using the Android logo and trademark (which they may or may not own) as a way of ensuring compatibility, but it seems the logo is creative commons. So maybe they need to come up with an "Android Approved" logo or something._

Doesn't that give even more confusion to the customers? Companies can change Android in whichever way they want and still call and market it as Android. Adding another method of distinguishing Android devices won't help solidify the brand.

(Also, people will still try to run your app and complain when it doesn't work. It's like your application breaking because of injected code on a jailbroken device -- you shouldn't have to worry about it, but those users will still leave negative feedback, so you'd better fix it quickly).

</comment><comment><USER9> I don't know if this is the case, but Android should have a set of guidelines specifying the current known hardware variations to test against in terms of screen size, memory and processing power. That devices take into account physical and on-screen keyboard should be a give, however.

The most likely thing is that different manufacturers will have some sort of certification process a la Appstore, but less restrictive in terms of allowed functonality. I know for a fact that Sony and Motorola are pointing that way.

I'm still pretty sure that within a year this situation will be normalized as more specific guidelines come up. Indeed, some devices will be left out. However as long as most devices have access to the important applications I don't think anyone will be too worried.

<comment><USER10> I had this exact conversation a few days ago with a friend who is just starting to play around with Android. They really should define "capability classes" of some kind - ie, a 'Class A' device has minimum screen resolution of u x v, physical keyboard, GPS, etc. This would allow us to have specific targets to build against, but still allow manus to create a variety of devices. This would allow for building elegant degradation into apps so that people without the latest and greatest phones aren't completely left out (as is currently the case).

<comment><USER11> Carriers and HW companies may not like making side-by-side comparisons so easy. Alternately there should be names other than A,B,C which are not inherently ranked.

</comment></comment></comment><comment><USER12> Trying out a bit of Android development is one of those things I want to try over my holiday (just need to get a device...) - how big a deal is testing an app on different devices at this point? At least amongst Google sanctioned ones?

<comment><USER13> Not a big deal.

Just plug in a device, and press play in Eclipse.

<comment><USER14> Except you need the actual device. For J2ME development this has become impossible for "small guys".

<comment><USER11> Someone (nokia?) has/had farms of different devices which you could test on remotely. However this is unlikely to be available to run-of-the-mill developers.</comment></comment></comment></comment>


Show HN: Trigger iOS Shortcuts from Anywhere - <AUTHOR> https://www.pushcut.io/ <comment><AUTHOR> Hi everyone,

for years now I have been playing around with automation and DIY smart home technology, sliding deeper and deeper into this amazing world of fun projects and possibilities.

I found that one piece was missing: "semi-automation"

For certain things, fully automatic was not a good option for me (like turning off lights at night, or opening doors, etc.) - any automatic rule you would write would be very complicated and possibly still work against you sometimes.

What was/is really big of course is voice controlled stuff - and while it works ok most of the time, I just never got all to comfortable negotiating with these "smart" assistances.

I wanted quick, silent access to automation actions when they are relevant. Combining webhooks with iOS shortcuts was the best solution for me: Smart notifications to give me the right options at the right time.

With added location/time-based triggers and integrations for services like Zapier and Integromat, Pushcut is a great puzzle-piece for any automation project you want to have a say in.

Let me know what you think, internet!</comment>


YC Summer Batch, Corona and Investments - <AUTHOR> Because of the Corona virus, we are likely headed towards a recession/depression, with a predicted slump in new Q2/Q3.<p>A few questions I have are: 1. How will that affect the likelyhood of startups raising? 2. Is now the right time to enter programs like YC? Or would it be better to wait? 3. Should startups focus more on sustainability at this stage over growth? <comment><USER2> Lots of big companies were started during recessions [1]. This current crisis is unique in that certain markets are actually thriving, such as delivery services like Postmates, Doordash, Instacart, grocery, shopping like Walmart, Target, and Amazon [2], and remote working and entertainment services like Zoom and Netflix. You could see what services we need for future crises like these (pandemics, fires, earthquakes, floods, war) and build up a startup around that.

1\. [https://medium.com/swlh/13-massive-companies-that-started- du...](https://medium.com/swlh/13-massive-companies-that-started-during-a- recession-ba769e38d0ad)

2\. [https://www.forbes.com/sites/johnkoetsier/2020/03/24/covid-1...](https://www.forbes.com/sites/johnkoetsier/2020/03/24/covid-19-app- economy-instacart-walmart-costco-way-up-uber-and-lyft-drop-like-rocks/)</comment>


YC runs orphanage vs. YC as foster parent - <AUTHOR>

<comment><AUTHOR> see <http://juwo-works.blogspot.com/2007/03/better-business-model-for- incubators.html>

"incubators like YCombinator are running an orphanage; get a batch of orphans, grow them and then release them into the world. The other (new) way calls for them to become foster parents. Look after them for short periods, and then release them back to their parents"

what do you think?

<comment><USER2> I doubt anyone in PG's position would be interested in taking orders from some big corp. I don't see it working out within Y-Combinator.

I am sure if someone really wanted to do it they could. Just don't think what you are suggesting is opposite of or can be compared to what Y-Combinator currently is.

-Zaid

<comment><AUTHOR> Taking orders? of course not. It means companies applying just like we do, and just for implementing new product ideas.

<comment><USER2> A big part of YComb is subtly teaching people to live an entrepreneurial life way beyond the three months you spend at YComb. That is why YComb doesn't seem to care THAT much about one particular idea. Instead they bank on the people they fund to continue making new stuff and really, if you make enough new things, you WILL get a hit. That seems to be the idea behind YComb - to keep supporting their group of entrepreneurs idea after another with the assumption that eventually they will get a hit somewhere.

The company model you describe is therefore incompatible with YComb because the company will be sending folks to make ONE idea which isn't much of an attraction to the flexible nature of YComb. YComb funds people more than ideass, remember?

<comment><AUTHOR> The company will have to give up 6% of the new startup regardless of which idea it implements eventually; so how is it different?

<comment><USER2> A HUGE chunk of motivation for a startup comes from working on YOUR thing knowing YOU own bulk of it. As soon as it is a corporation-powered thing you are an employee before anything and for me that is a huge turn-off.

What's wrong with the current model? If a company _really_ likes smething after 3 months of YComb deveopment, it can grab that company for few mil and build on it however it wants.</comment></comment></comment></comment></comment></comment>


5 signs according to Neo4J you should give up your relational database - <AUTHOR> https://neo4j.com/blog/five-signs-to-give-up-relational-database/ <comment><USER2> July 27, 2015

<comment><AUTHOR> Eep, I thought it would tell me! Is there a quick way to navigate to that date?</comment></comment>


How Stack Overflow plans to survive the next DNS attack - <AUTHOR> http://blog.serverfault.com/2017/01/09/surviving-the-next-dns-attack/ <comment><USER2> I think I measured Cloudflare's performance and chose it over Google because it was consistently faster. If the stack-stackers are reading, I'd love to hear why they didn't make the list.

Also, it'd be a great public service to publish the results. Even if it's just enabled for a day per year or so the results would probably appreciated by many. And you could always sell your altruism as the need to continually monitor the situation :)

<comment><AUTHOR> +1 - I am also very interested why they chose to switch out from CloudFlare for both their DNS and their CDN and over to Fastly. Nick Craver did a write up where they specifically mentioned [1] Cloudflare for both their DNS and CDN.

Do you think after the Dyn outage everyones sysadmins are running round adding redundancy, too worried to trust the uptime of their site in the hands of just CloudFlare?

[1] [http://nickcraver.com/blog/2016/02/17/stack-overflow-the- arc...](http://nickcraver.com/blog/2016/02/17/stack-overflow-the- architecture-2016-edition/)

<comment><USER3> The fact that they abandoned Cloudflare only 6 months after this post means that they must've been pretty disappointed. I wonder if this is the same reason as for some of the other pages that went to Fastly from Cloudflare (e.g. Imgur).

<comment><USER4> It could also be due to some mundane detail like the service's cost.

<comment><USER3> He mentioned 503 errors and "missed deadlines". I don't think it's costs, they were known beforehand, you wouldn't switch after 6 months because of costs. And I think if you're at that scale, you'd get a counteroffer from Cloudflare if you threaten to leave.

As you can whitelist Tor traffic in Cloudflare, it seems to be down to these 503 errors (edge to origin). But haven't heard that before, so not sure if it's a problem that occurs more often.

For Imgur, I could imagine that purging by cache tag is just too restrictive at Cloudflare (the limit is very low, even for Enterprise clients). Fastly doesn't have a limit there, they encourage you to cache everything and purge where needed. Makes it much easier to cache APIs and HTML pages.

</comment></comment></comment></comment></comment><comment><USER5> Umm, brilliant thank you for this.

I ended up with a Dyn / Route53 configuration. We used libcloud to sync everything together. We also added the exported zone to Cloudflare but did not enable it.

We had actually planned for this, but in no way did we ever come close to your in depth testing. The @ Azure issue - thank you for uncovering this for the rest of us.

<comment><USER6> Can you maybe share how you did the sync between them? Also there are already some tools pulling zone data from Dyn and adding it to Route53? Can you share why did you choose an own sync. (I'm planning to do the same and I'm interested in other's opinions)

<comment><USER7> We actually wrote a tool to manage this. We define our desired records in a common dsl format, and the tool can interact with various providers to ensure things match the expected state.

We should be open sourcing this rather shortly, so stay tuned.

Sorry, I'm not who you asked, but that is how we are doing it at stack overflow now.

</comment></comment></comment><comment><USER2> The calculation regarding the ideal number of name servers to list needs some empirical data regarding the likelihood of provider and server outages and the client reactions to it, right? Because otherwise 2 would must be the best number, if I'm not mistaken (Chance of hitting the provider that's offline is always 0.5 on the first try, but the second try would be guaranteed to hit the other).

Here's the math for expected number of tries if half of the servers are offline. (It's a hypergeometric distribution but I couldn't find a closed formula)

E(2 server) = 1 * 1/2 + 2 * 1/2 = 1.5

E(4 server) = 1 * 2/4 + 2 * 2/4 * 2/3 + 3 * 2/4 * 1/3 = 1.67

E(8 server) = 1 * 4/8 + 2 * 4/8 * 4/7 + 3 * 4/8 * 3/7 * 4/6 + 4 * 4/8 * 3/7 * 2/6 *4/5 = 1.73

<comment><USER8> Author here. One thing I didn't cover in the post was about how to have Google and AWS honour their SLA's is that you have to use _all 4_ of the nameservers they provide. Because we're not doing that (only using half), we have to balance the chance of an outage versus the impact of an outage.

You are correct in saying that more empirical data could be used here. We might even end up changing our minds. I'm not much of a numbers person but I might pass this onto some of the people in our company who love solving problems like this.

</comment></comment><comment><USER9> It'd be great if more DNS providers supported "slaving" a zone from an existing server. It would make it much easier to keep DNS synchronized across multiple providers.

Hurricane Electric supports this but most of the providers mentioned in this article do not.

<comment><USER8> Author here. I agree. There are built-in mechanisms for doing this - AXFR and IXFR. However, these mechanisms were not really designed with this sort of scale in mind. You have to keep an up to date whitelist of all the servers that can talk to each other, and they would need to talk to each other on a non-anycasted address (otherwise the notify packet would go to just a single anycasted node).

Managing whitelists between multiple 3rd party DNS providers is likely to break frequently as servers move around, are added, removed, etc.

Interestingly, Hurricane Electric would have been one of our top choices if they had a first class API and a commercial SLA. Their ability to support zone transfers is admirable and did not go un-noticed. DNS Made Easy also supports zone transfers.

<comment><USER9> Just as an additional data point for anyone else reading this...

Hurricane Electric supports zone transfers and requires you to only allow AXFR's from a single host -- slave.dns.he.net (IPv4: 18.104.22.168, IPv6: [2001:470:600::2]). NOTIFYs should not be sent to slave.dns.he.net but instead to ns1.he.net.

n.b.: ns1.he.net is not anycasted, but ns[2-5] are. In addition, ns1 does not have an AAAA RR.

We (ISP) currently run our own authoritative name servers in our own facilities but I've been seriously debating adding another provider into the mix so "secondary" service is an important feature to me.

</comment></comment></comment><comment><USER10> From my experience EdgeCast and DNSMadeEasy were consistently the fastest DNS. I guess both were dropped because of price when Google DNS and Route53 did the a similar job.

And as other have said, while Cloudflare may not be for everyone, their DNS is possibly the fastest. Not sure why SO decide to drop them.

*Some old Data [http://www.dnsperf.com/](http://www.dnsperf.com/)

I also wonder on the performance of DNSimple. But they dont see to emphasis much on performance.

<comment><USER8> So DNSMadeEasy made it all the way through the barrage of tests. I even wrote a library for their API so that we could integrate it into our DNS software ([https://github.com/mhenderson- so/godnsmadeeasy](https://github.com/mhenderson-so/godnsmadeeasy)), but at the end of the day their performance in certain regions was not good enough. In some countries they were measurably faster than R53, but in others they were measurably much slower.

EdgeCast were dropped due to pricing, and that there's talk of Verizon selling the EdgeCast services again.

DNSimple didn't make it to performance testing because they only had 5 POPs, as opposed to 20+ of other providers.

CloudFlare's DNS was consistently one of the fastest, you are correct about that. If you read my responses to other comments here, you'll find that we decided not use their DNS service because of some fairly pervasive API issues we had with it.

</comment></comment><comment><USER11> Netflix have a tool for this as well [https://github.com/Netflix/denominator](https://github.com/Netflix/denominator)

<comment><USER12> Denominator is not actively developed: [https://github.com/Netflix/denominator/issues/374](https://github.com/Netflix/denominator/issues/374)

Last commit of substance was in Sept 2015.

<comment><USER13> I have not looked at this particular commit history, but I want to argue against the notion that no fresh commits must mean that a project is abandoned. Some stuff is just mostly _finished_ after some point.

<comment><USER12> In the GitHub issue I linked to, the project maintainer indicates both that he will no longer work on the project and that Netflix has retired the software.

So... I wouldn't invest time in it unless you want to take over stewardship (no one else has offered in the last 7 months).

</comment></comment></comment></comment><comment><USER14> I'm currently working on a tool [1] that can help with checking if all your different providers are 'in sync' and responding with the same answers. Setups like these are only to grow more common as people realise a single DNS provider is a SPOF of its own.

Very good analysis of SO and a smart move to roll this out _before_ a new DNS outage!

[https://dnsspy.io](https://dnsspy.io)

<comment><USER15> I've thought about doing something like this, the biggest issue I found is feature parity between DNS providers.

If you could have a unified API that would create the records on multiple providers that would be money, it's just that you'd lose out on some things like Route 53 health checking, etc.

</comment></comment><comment><USER16> Is there a good writeup somewhere about setting up redundant NS records at the zone apex? Or, more generally, "DNS primer for busy developer" article?

<comment><USER12> Once you have configured your zone with multiple providers, it's simply a matter of adding NS entries for each provider's authoritative servers to your registrar. The harder part is ensuring that the zones are kept in sync and that you don't rely on features (such as GSLB stuff or ALIAS records) that aren't available with all providers.

It's up to the client resolver to handle failover, so it's not perfect in terms of availability, but better than nothing.

For example:

      $ dig ns amazon.com
      amazon.com.		3599	IN	NS	ns4.p31.dynect.net.
      amazon.com.		3599	IN	NS	ns1.p31.dynect.net.
      amazon.com.		3599	IN	NS	ns3.p31.dynect.net.
      amazon.com.		3599	IN	NS	ns2.p31.dynect.net.
      amazon.com.		3599	IN	NS	pdns1.ultradns.net.
      amazon.com.		3599	IN	NS	pdns6.ultradns.co.uk.

(note that this is also TLD redundant, since there's a .co.uk included)

<comment><USER7> The tricky part is making sure the apex NS records are consistent across all authoritative nameservers. A surprising number of dns providers do not let you edit those.

<comment><USER12> Yeah, it does need to be the same in the zone as well as with your registrar. As mentioned in StackOverflow's blog post, Azure doesn't support changing NS records.

Similarly, there are a fair number of DNS providers that don't allow you to use all DNS record types. For something so simple, providers can really go out of their way to screw it up.

</comment></comment></comment></comment><comment><USER17> I wonder why there's no consideration of anycast servers.

<comment><USER8> Author here. Google and AWS are anycasted services. We were not interested in running our own anycasted DNS due to the management overhead of doing so, and because the cost of anycasting our own services would be orders of magnitude more expensive than outsourcing that to an established DNS provider.</comment></comment>


Stalin's Human-Ape Hybrids - <AUTHOR> http://skeptoid.com/episodes/4219

<comment><AUTHOR> I was driving to the beach with my wife and the question of whether it was possible to create a half-human, half ape hybrid (much like a liger or mule) popped into my head.

I thought that someone must have tried it out* so a quick google came up with this fascinating piece of history.

*my theory is that just about anything you think of, someone has probably given it a go.

</comment><comment><USER2> I have rarely seen such a well written and well researched report. As readable as a tabloid article and as well researched and solidly referenced as a good academic paper.

This is how all articles that deal with facts should be written.

(The comments kind of ruin this good experience, but that is not the author's fault.)

<comment> jarek-foksa Yup, this also reminds me articles that used to be showing up on Damn Interesting (<http://www.damninteresting.com/category/greatest-hits/>) few years ago. Too bad they haven't touched this subject.

</comment></comment><comment><AUTHOR> _By 1929, the plan was to have five women be artificially inseminated, and then live at Ivanov's institute with a gynecologist for one full year. But just as the first woman volunteer was secured, known only to history as "G", Tarzan died._

What a lucky lady!

</comment><comment><USER3> I believe if brainless working force as considerable factor in economy was possible by cross breading apes and humans then this would already be done. But it is not done because it is useless. AFAIK mankind successfully cross bread species more distinct than humans and apes.

<comment><USER4> This will never happen while we have cheap human workforce (like those working for Foxconn). And even then, I'll prefer robots to Humanzees.

<comment><USER5> Presumably, the benefit of a hybrid would be that it is as resourceful as a human, but can be treated as bad as an ape.

I don't have a source at hand, but I'm fairly sure that there is good evidence to support that slavery is a less effective workforce than cheap labour is, by far.

</comment></comment></comment><comment><AUTHOR> This raises an interesting question: what sort of rights a Human-Ape hybrid would have. Is it an animal, or a human?

<comment><USER6> There's a nice 1952 novel on this subject: <http://en.wikipedia.org/wiki/Les_Animaux_d%C3%A9natur%C3%A9s></comment></comment>


Ask HN: Any Weird Anecdote from Japan? - <AUTHOR>

Just out of curiosity:<p>Do you have a (poignant, surprising, or Dilbert-esque) experience as a visitor to Japan or any J-Town? <comment><USER2> I went to Japan. I saw a vending machine with school-girl panties. mmmmm...

<comment><AUTHOR> Thank you for _not_ sharing pictures of that.</comment></comment>


Susan B. Anthony: The Crime of Voting "While She Was a Woman" - <AUTHOR> http://www.groklaw.net/article.php?story=20100522202326865 <comment><USER2> I propose the _Groklaw corrollary of Godwin's law_ : In any sufficiently lengthy dispute in US law, one side will inevitably end up comparing themselves to a famous martyr whose constitutional rights were violated.</comment>


Show HN: Slack Deletron – A tool to delete files from your Slack team - <AUTHOR> http://www.slackdeletron.com/ <comment><USER2> Does slack really not include basic delete functionality for files?

<comment><AUTHOR> Not easily. You have to go file by file</comment></comment>


Memprof: A Ruby level memory profiler - <AUTHOR> http://timetobleed.com/memprof-a-ruby-level-memory-profiler/

<comment><USER2> This guy has reinstated my love of hacking binaries, we used to do this alot when we were rewriting memory of MMORPGs like Asheron's Call. Never thought about doing it for legitimate reasons.

<comment><USER3> indeed. Decal was such an amazing technical achievement in those days. Really years ahead of it's time.

</comment></comment><comment><USER4> Wonderful example on how to turn an hack (poking inside the memory to insert a trampoline) into a working useful product.

 _EDIT:_ btw it should be possible to do the trick even in 90% of stripped binaries. Just calculate the right offsets offline and if the bin is stripped try this binary against a table (consisting of offsets -> first N bytes of "famous" binaries). So at least it's possible to add support for "notable" stripped binaries like mac os x default ruby install, debian, ubuntu, and so forth.</comment>


Curiosity makes first-ever check-in on Foursquare from Mars - <AUTHOR> http://dvice.com/archives/2012/10/curiosity-makes.php <comment><AUTHOR> Link to Foursquare profile <https://foursquare.com/marscuriosity></comment>


Install GPU TensorFlow from Sources with Ubuntu 16.04 and Cuda 8.0 RC - <AUTHOR> https://alliseesolutions.wordpress.com/2016/09/08/install-gpu-tensorflow-from-sources-w-ubuntu-16-04-and-cuda-8-0-rc/ <comment><USER2> If using Docker is an option, the official Dockerfile works well, you just need to modify the FROM line to "nvidia/cuda:8.0-cudnn5-devel-ubuntu16.04". Or "nvidia/cuda:8.0-cudnn5-devel-ubuntu14.04", depending on which version of Ubuntu you want.

[https://github.com/tensorflow/tensorflow/blob/master/tensorf...](https://github.com/tensorflow/tensorflow/blob/master/tensorflow/tools/docker/Dockerfile.devel- gpu)

<comment><USER3> What sort of performance impact would Docker have in this situation? Any at all?

Edit: spelling

<comment><USER2> No performance impact as long as your I/O is done in volumes, to avoid going through AUFS.

</comment></comment></comment><comment><USER4> This seems to be a frankenstein of cuda 7.5 instructions and cuda 8.0. Similarly ubuntu 14.04 and 16.04. As far as i know, these instructions will fail from gcc 5.4 errors, amongst other issues.

<comment><AUTHOR> Wont GCC fail, includes a patch for GCC, I tested on my system before posting. Running great!

<comment><USER2> One of your section is named "Install Nvidia Toolkit 7.5", this is probably what confused parent @hughperkins.

<comment><AUTHOR> Just found that one and fixed it, also someone confirmed working with a GTX 1080. I am so happy to finally ditch 14.04

</comment></comment></comment></comment><comment><USER5> Why does it just take following directions to make it to the front page of HN these days?

<comment><USER6> Because GPU-accelerated learning is exciting, and most of the directions you find for setting it up don't work. (Judging from other replies, this post may be no different.)

This probably has something to do with the fact that GPUs are flaky and idiosyncratic, and all the software that uses them depends on black-box libraries handed down by Nvidia, who is completely shit at maintaining software.

<comment><AUTHOR> [https://www.dropbox.com/s/tlcb7o7k10xaz8a/Screenshot%20from%...](https://www.dropbox.com/s/tlcb7o7k10xaz8a/Screenshot%20from%202016-09-08%2018-27-33.png?dl=0)

Screenshot for the skeptics.

</comment></comment></comment><comment><USER7> Thank you so much. I tried 3 times in the last week to get it working with Cuda 8.0

<comment><USER8> Have you actually succeeded yet in building a pip package linked with CUDA 8? I am doing basically the same process, and it only keeps failing.

[https://github.com/tensorflow/tensorflow/issues/2559#issueco...](https://github.com/tensorflow/tensorflow/issues/2559#issuecomment-245148956)

<comment><USER7> The pip package doesn't build for me either. And I even reinstalled Ubuntu to get a fresh Python installation

<comment><AUTHOR> So strange I wonder why its working for me? Ubuntu 16.04.1? Fresh install? following exactly? Python 3?

<comment><USER8> Which branch are you building?

For the first time I was able to complete a build last night, Ubuntu 16.04, CUDA 8.0 RC + compiler patch, cuDNN 5.1, nvidia-driver-370, python-2.7, and compute capability 6.1 (for Pascal GPU) - but only when I switched to the r0.10 branch.

With r0.10 I see none of the multiple failure modes that I always see with master. It just went straight ahead and compiled the whole thing.

<comment><AUTHOR> I used master but seems like r.0.10 seems to be solving the problem for most.

</comment></comment></comment></comment></comment></comment><comment><USER8> I'm not sure what Tensorflow source you're compiling, but I've been trying many times recently and it fails in many, many different ways. It's a neverending maze of fail, basically. I've __never __seen the end of it yet. It failed today, too, so the code base is not getting better.

I'm using Ubuntu 16.04, CUDA 8.0RC + the gcc patch, cuDNN 5.1, nvidia- driver-[367|370], tensorflow-master, python-2.7. My process is basically identical to yours.

A few issues are listed here:

[https://github.com/tensorflow/tensorflow/issues/2559#issueco...](https://github.com/tensorflow/tensorflow/issues/2559#issuecomment-245148956)

In some cases, Bazel seems to be the culprit. In other cases, it's Tensorflow itself. I've also seen a "gcc: internal compiler error" [https://github.com/tensorflow/tensorflow/issues/4214](https://github.com/tensorflow/tensorflow/issues/4214)

Some issues with your howto:

There's a chapter title "Install Nvidia Toolkit 7.5 & CudNN" but the instructions below use 8.0RC

```

Configure TensorFlow Installation

$ cd ~/tensorflow $ ./configure Use defaults by pressing enter for all except:

Please specify the location of python. [Default is /usr/bin/python]:

```

No. If you do that it won't compile with GPU support. You have to hit Enter on every question except these ones:

\- Do you wish to build TensorFlow with GPU support? (answer: y)

\- Please specify a list of comma-separated Cuda compute capabilities you want to build with. (answer: 6.1, or less for older GPUs)

\- Please specify the Cuda SDK version you want to use, e.g. 7.0. [Leave empty to use system default]: (answer 8.0)

You don't have to specify the cuDNN version, apparently it can detect the version automatically. It's only the CUDA version detection that fails. [https://github.com/tensorflow/tensorflow/issues/3985](https://github.com/tensorflow/tensorflow/issues/3985)

"You must also have the 361.42 NVidia drivers installed"

No, that would not work with Pascal GPUs.

The only way I've seen it work is if you install CUDA 7.5 and cuDNN 4, and install Tensorflow from the binary package. But then you get weird errors if you run complex models on Pascal GPUs, because CUDA 7.5 doesn't work well with Pascal.

Seriously, if you made it work on Ubuntu 16.04 with CUDA 8 and it's GPU enabled, please upload the pip package somewhere. I'd love to give it a try.

<comment><AUTHOR> Just follow the instructions friend.

<comment><USER8> I may go ahead and do a literal clone of your instructions. However, looking at your process, it's what I do, step by step, AFAICT without actually going ahead and doing it.

It's also the fact that it fails in so many different ways. Bazel bombs out after ./configure; the master branch today does not even begin to build at all, the old Bazel workaround is not working anymore. Then there's the gcc issues.

You may have gotten lucky once, who knows why.

Again, do you still have the pip package you claim you've built using this procedure? If so, can you upload it somewhere? I would very much like to test it. Thank you.

<comment><AUTHOR> [https://www.dropbox.com/s/0cdoy7e8xh54wrx/tensorflow-0.10.0r...](https://www.dropbox.com/s/0cdoy7e8xh54wrx/tensorflow-0.10.0rc0-py3-none- any.whl?dl=0)

Here is the pip3 wheel but I am skeptical given it was built for my system.

</comment></comment></comment></comment><comment><USER9> fwiw, deeplearning4j is a much easier install: [http://deeplearning4j.org/quickstart](http://deeplearning4j.org/quickstart)</comment>


Telegram founder: US intelligence tried to bribe us to weaken encryption - <AUTHOR> https://news.fastcompany.com/telegram-founder-us-intelligence-agencies-tried-to-bribe-us-to-weaken-encryption-4040876 <comment><USER3> >"It would be naive to think you can run an independent/secure cryptoapp based in the US."

This seems to be a shot at WhatsApp and Signal, implying that they have loopholes that allow the FBI to snoop in. I'm not sure how true that is. This might be an attempt to deflect from the fact that Telegram uses a home-baked encryption protocol which might be insecure, while WhatsApp uses the OWS protocol.

<comment><USER4> Pavel Durov wants everyone to think security is about trust in people. Most companies in that business do the same, because it's easier than building something that doesn't require trust in people. The way Pavel Durov and others like him present "trust" is (ironically) shady corporate structures[1], shell companies, or use of the word "Switzerland."

They want people to think like that because they've built businesses that require it. Telegram stores the messages you send/receive unencrypted on their servers. That's not good, unless you've been trained to think that "privacy" is just about choosing the company, government, or legal jurisdiction that gets total access to your data.

Security professionals know that's not how we should think about security (never trust _people_!), because Durov is leaving a lot out: there aren't safe jurisdictions, servers get hacked, and centralized databases will get compromised. Logic, though, is probably no match for conspiracy theories.

1: [https://www.washingtonpost.com/news/the- intersect/wp/2015/11...](https://www.washingtonpost.com/news/the- intersect/wp/2015/11/23/the-secret-american-origins-of-telegram-the-encrypted- messaging-app-favored-by-the-islamic-state/)

<comment><USER5> I read the WP article you cited, titled, "The secret American origins of Telegram, the encrypted messaging app favored by the Islamic State".

If Telegram isn't that secure, then why are extremists like IS using it over Signal or WhatsApp? I know Telegram has better features for big groups and much better multi-platform support, so is that the reason? I'm legitimately asking without any snark.

<comment><USER6> You highly overestimate the people who are in position of power.

I am talking about politicians, head of terrorist groups, etc.

While saying that top politicians are complete idiots is probably wrong - <USER2> again maybe not, I am not sure anymore - the fact that H. Clinton, run the most expensive campaign in history, with backing from all major tech corps AND her staff didn't bother to use encryption at any scale, let alone running a mail server (God knows what kind of software the server was running if it was OpenBSD or Windows Server 08), to me says a lot about how flawed the understanding of these people and their consultant's is about today's world.

Watching "House of Cards" everybody seems incredibly smart, driven, etc. but the politicians I see in real life on average and on the not-very-smart side and the few I've met in person are clueless beyond salvation.

Ps. Sorry for possible mistakes, I'm reading from mobile.

<comment><USER7> Over 99% of people have no clue how computers work in the most basic sense of the word understanding and most are proud of their ignorance.

</comment></comment></comment></comment></comment><comment><USER8> I am not sure about the claim here but the FBI has always been all over cryptography companies and products and this was well before Snowden, Phil Zimmermann (PGP) knows about this.

In 2003-2006, we built a service that was a financial system to exchange financial data through various means including AS/2 EDI over HTTP with big companies and the government suppliers such as AAFES (Army and Air Force Exchange). Initially we had RSA, PGP and a custom encryption in there, the latter two for other features besides EDI. We got a letter from the FBI asking us to switch only to RSA, they wanted to know about our use of PGP and wanted to see our custom encryption if we continued to use it. Being a small/medium company we switched to just RSA to avoid any issues. It was an odd day, when I came into the office they told me I had an FBI letter on my desk and you can imagine what happens around an office when something like that happens. Very strange day indeed.

Moral of the story, if you create your own crypto or aren't using the ones you are supposed to use, in any capacity, expect some knocking.

<comment><USER9> Interesting. That strongly implies that RSA has a flaw, which is news to me.

<comment><USER10> If the USG was aware of a secret flaw in RSA, they wouldn't be tipping their hands about it to random small companies. Come on.

But: avoid RSA anyways. It's inferior to modern curve crypto.

<comment><USER8> I think the only reason they contacted us was because we were one of 25ish companies certified to communicate with government endpoints early on in HTTP based EDI. It was right at the moment that EDI went from faxing to FTP to HTTP/email in AS2/3/4\. Others were Oracle, Microsoft, IBM, EDS, Axway, /n software etc.

It wasn't until we had to connect to AAFES that it was a problem. We were small but we were sending a good amount of orders and financial data from Wal- mart, AAFES, and other gov't sources that had early EDI over HTTP/S going. They were also recommending us to vendors on their approved EDI software list and probably wanted to recommend ones that played nicely.

<comment><USER10> This is entirely plausible. If you're doing crypto on behalf of USG data, they have all sorts of dumb CYA rules.

</comment></comment></comment></comment></comment><comment><USER11> Read the replies from all the serious crypto security people on twitter and you will see the overwhelming consensus is that the FSB/Spetssviaz and FBI/NSA probably _love_ Telegram for its roll-your-own-crypto and server mediated group chats.

One also has to wonder if the FBI consider the Telegram team to be essentially undeclared Russian agents, and hence fair game.

<comment><USER12> Indeed despite what they say, we only have their word for it but no source code to check whether they accepted these requests from the snoopers in usa.

<comment><USER13> I thought they open sourced the code?

<comment><USER14> Yeah, it's open and the encryption is done in the client, so it should be available on Github.

[1] - [https://telegram.org/apps](https://telegram.org/apps)

</comment></comment></comment></comment><comment><USER15> Cryptography experts like Matthew Green were having fun with some of his claims on Twitter a couple of days ago. I would read whatever Durov claims with a large amount of skepticism.

ex: [https://twitter.com/matthew_d_green/status/87369621172278476...](https://twitter.com/matthew_d_green/status/873696211722784768)

<comment><USER10> If there are any professional cryptographic engineers that take this seriously, I'd be interested in hearing from them. From what I can tell, the response to this has been pretty much unanimous.

</comment></comment><comment><USER16> Governments never believed in privacy. Before they were opening envelopes and tapping phones. Now they are trying to keep up with technology and given the sheer scale of resources, manpower and power at hand operating 24/7 they will prevail.

A journalist like Poitras is on all sorts of lists and incessantly harassed. There are secret courts, secret laws and secret processes at play. And beyond this the power of harassment, intimidation, blackmail and bribery. Individuals and even organizations cannot prevail against the array of capabilities.

Its nice to think of democratic theory and the rights but these only exist when not exercised as talking points. The moment you start exercising them you end up on all sorts of lists, marked for harassment and basically have a target on your back. Dissent is squashed even before it can formulate.

</comment><comment> tuna-piano Assuming this isn't just PR, in some ways this is scary and disheartening.

But my first reaction was "Cool, our government really cares, is creative and has the necessary power to get things done."

For those of you who've worked with government, you've seen how insanely difficult the procurement process is. Being as specific as needing to get competitive bids for toilet paper purchases, etc. So the fact that they could get potentially large amounts of bribe money means (a)This goes to high levels in the organization (b)They've probably done this before.

I wonder how much they offered?

And I wonder how many other pieces of software have backdoors. I would think the first things they would try and get access to is (a)Certificate issuers and (b) VPN software.

Do we know that Godaddy,LetsEncrypt, OpenVPN, Cisco VPN, Juniper, etc don't have backdoors?

<comment><USER17> > Cool, our government really cares

I wonder what they really care about? Liberty, individual rights, security, or more power? They're people too, so I'm sure they believe in the first three, but the last one is a more seductive and drives a lot more of the bad we see governments do; worse is that the drive for more power is frequently justified as "we _need_ this power to protect our nation".

> has the necessary power to get things done

This actually frightens me a bit. The US government has the ability (and has displayed the willingness) to absolutely destroy people's lives in their pursuit of "national security". What checks and balances are in place to keep this kind of power in check?

<comment><USER18> One... to see if you are for sale. If you can be bought, other state actors will try and may succeed, whether US actually bribes you or not. US needs to know if a successful App is up for taking bribe, including top developers individually, or not, because millions of Americans including persons in position of power might be using that app.

Two... essentially, this is power of people applied. Lot of interest in keeping status quo of power, of narrative, of money. They want to have dirt on everyone and then choose to use it when needed. Putting pressure or not can be decided later, dirt will be collected by default. No point in digging the well when you are thirsty, you need to do it well upfront the need arising.

>What checks and balances are in place to keep this kind of power in check?

Either play the game, or be too big to fail and lobby the government for your needs. I think the best one can do is choose your masters either USA, China, Russia or to some extent India or EU main players.

<comment><USER17> I think that the first point is a legitimate one - if your own government can buy you, so can someone else. Of course, when it comes down to it, everyone has a pressure point. In my thoroughly uninformed opinion, it would be better to identify and protect against such tactics than do them yourself and watch it backfire like this.

The rest, I can't argue with, though it doesn't really make me feel any better.

</comment></comment></comment></comment><comment><USER19> The ridiculousness of it all is it's unreasonable at its base to try to prevent encryption as a form of safety and security from violence.

Sure, you can lock up all communication for privacy reasons, and the government can spend all kinds of resources on trying to control to prevent or circumvent encryption - however it's a waste of resources as it's simply a bandaid.

If I wanted to do something violent or evil I/you can simply have regular meetings and use paper communication - the old spy-style stuff. Of course those networks can be infiltrated by governments with the resources, and they can maintain that presence by allowing certain acts within networks to occur vs. deciding which ones they should stop; it's how the war against Hitler was won once their encryption was broken - watch the very well-done The Imitation Game - [http://www.imdb.com/title/tt2084970/](http://www.imdb.com/title/tt2084970/) \- for a reference.

The only real solution is dealing with the root causes. I heard an analyst on TV (a rare occasion for me) mention after Trump's Saudi visit and speech, that he didn't mention that the Saudis should look into the root causes of why there is terrorist activity growing in their countries; of course a lot of it is historical karma and rage from violent acts against their families, however a lot is because people's basic needs aren't being met which prevents the higher levels of Maslow's Hierarchy of Needs from being reached and maintained.

There's a solution and it requires building real community, locally, where you are now - and striving for people to become healthy so they don't develop bias and other coping mechanisms which prevent empathy and understanding and therefore compassion; preventing responsible ownership of weapons isn't useful either, not developing and supplying weapons on mass would be beneficial, however most attacks recently have been with vehicles or knives.

Universal Basic Income will also allow closer to a truly free work market and it can evolve from there, giving people the time to do what they feel is the most important in that moment for themselves, while not having to be forced to working in a shitty environment with shitty managers or co-workers; the health improvement and increased productivity here alone is worth it.

<comment><USER20> > however a lot is because people's basic needs aren't being met which > prevents the higher levels of Maslow's Hierarchy of Needs from being reached > and maintained.

This is contradicted by a lot of evidence. Terrorists are most commonly _middle_ class members of their society and often well educated. If anything, terrorism is a powerful means of satisfying the _higher_ levels of 'needs', e.g. meaning, purpose, community.

<comment><USER19> Interesting and perhaps a fair point. We'd have to understand what quality of life being 'middle class' in each society means, what well-educated means, and there will be more factors of course. If you hurt someone enough either directly or indirectly by killing family and friends' family members, that'll definitely start to outweigh the feelings of being in a safe environment - which doesn't simply come from being 'middle class' or well-educated. Safety is the basic need and if you have a world power killing 100,000s of your citizens, your future isn't going to feel safe; I could mention PTSD and the such, though I think that minimizes and simplifies it too much.

</comment></comment></comment><comment><USER21> "a few months later i was offered an interview for a position at the fbi office for cyber-warfare in nyc who as well offered to fix my immigration status"

and, "before going to monterey and while exploring the beauty of san francisco i was contacted once by a us navy intelligence officer who seemingly unintentionally appeared next to me at the bar"

[http://mickey.lucifier.net/b4ckd00r.html](http://mickey.lucifier.net/b4ckd00r.html)

<comment><USER22> Would you mind clarifying what your quotes and the linked wall of text have to do with the story?

<comment><USER23> Seems to be a similar story by a security guy who wrote crypto code for OpenBSD. The larger quote:

> about the same time at the bazaar show in nyc i was contacted by a > representative of us-ins and a ukrainian millitary attache at un. both > investigating my involvement with openbsd. a few months later i was offered > an interview for a position at the fbi office for cyber-warfare in nyc who > as well offered to fix my immigration status (or none thereof at the time ;) > with a greencard. nonetheless for the lack of credibility from the future > employer i refused to talk to them as for me deportation did not sound like > an acceptable worst-case scenario.

> before going to monterey and while exploring the beauty of san francisco i > was contacted once by a us navy intelligence officer who seemingly > unintentionally appeared next to me at the bar. later on my way back during > a short stay in chicago also randomly appearing fbi agent. fellow was > ordering food and beer for me and just like his navy pal gave me a warning > to keep my mouth shut!

He was a foreign national visiting the US who probably got targeted by various agencies after attending some security conferences.

<comment><USER22> Ah, thank you.

</comment></comment></comment></comment><comment><USER24> But wouldn't it be in the interests of mass surveillance to herd people toward a chat option that isn't secure, or that the surveillants have a backdoor to? You get two benefits: 1) chat people think is secret you can read, 2) people self-identify as selectors / targets by choosing to try to hide their communications, which you can actually read

And if such PR herding worked, wouldn't the surveillants be prepared to pay for such efforts to make their job easier?

So, what seems readily apparent is: Telegram takes state money, to offer an insecure option, while dissimulating to the world that it's: a) secure and b) turning down state money all the time.

I know why this perspective isn't discussed in MSM. But I don't get why it's not discussed more here. It seems obvious to me. And personally IMHO, I think that's a good thing. Catch more criminals / terrorists.

</comment><comment><USER25> Can someone correct me if I am wrong, but it seems relatively easy to make an encrypted peer-to-peer messaging system.

I mean, simply use a public/private encryption algorithm that has proven to be highly secure:

\- Share your public key openly

\- Anyone can send a message to you using your public key to encrypt the message

\- You decrypt with your private key on device

Do all the encryption/decryption on device and viola, secure messaging. (This is basically how https works.)

Of course this only allows a single device the ability to decrypt the message.

However, if you want to allow multiple devices to share a private key, they can simple send each other their own private keys using the same encrypted protocol.

In addition, for super paranoid use, a master password could be used to salt the private key so that would be required with the private key to enable decryption. (Which is similar to how password keepers basically work.)

What am I missing?

<comment><USER10> Which public key algorithm? In what mode of operation?

What are you going to use to _actually_ encrypt messages? You don't want to directly use the public key primitives to do this.

In what mode of operation are you going to use that second, bulk encryption algorithm?

How are you going to authenticate messages?

What will you do to validate the public keys of your peers? When you close the application, will it forget everyone's keys? How do you prevent MITM on first contact?

What happens when your peers change devices, and thus public keys? How do you authenticate those changes? If you get any of this wrong, remote attackers can MITM messages.

How will you handle file transfers (and images and videos and voice, which will probably need yet another cryptosystem)? How will you cryptographically bind those transactions to the (presumably, somehow) authenticated chat session you set up?

What happens when someone's device is compromised? Is every chat they've ever sent also compromised?

What happens if someone is briefly compromised? Is every message they send in the future also necessarily compromised?

How will you handle updating your software when, inevitably, someone finds a vulnerability in it? What happens if you have to upgrade the whole protocol?

None of this is easy. Most of these problems by themselves are hard in their own right, but there's a combinatorics to them as well.

<comment><USER25> Thanks!

This is an excellent list of potential issues.

"What are you going to use to actually encrypt messages? You don't want to directly use the public key primitives to do this."

I'm not sure what you mean by this.

Could you explain why there is a need for another encryption protocol beyond a public/private key encryption?

If the protocol is secure against brute force attack, both the public key and the encrypted messages could be open and would not create a vulnerability to the private key.

What am I missing?

<comment><USER10> * Assymetric transforms are much, much slower than the AES transform or any other block or stream cipher.

* In most cases, an asymmetric transform gives you a deceptively small amount of headroom within which to fit your data before losing security.

* asymmetric transforms are less safe to implement than simple authenticated symmetric ciphers.

* for that matter, cost-effectively authenticating messages will require "symmetric" primitives anyways.

* modern asymmetric algorithms (like Curve25519) don't "directly" support encryption.

That's just off the top of my head. It is hard to think of a single competent public key cryptosystem that encrypts directly with the asym transform.

</comment></comment></comment></comment><comment><USER26> There aren't a lot of places that are embracing truly end-to-end encryption for the masses. I think it would be tough in the U.S. but it's not clear to me where the better place.

<comment><USER27> Something like Iceland or Sweden?

</comment></comment><comment><USER28> Option 1: Could be Russian/Telegram propaganda.

Option 2: Could be true because seriously, who trusts the FBI/NSA not to violate our privacy anymore?

Really not sure what to believe about this one.

<comment><USER29> A person born in Russia says something and you think it's "russian propaganda".

Mccarthy would be proud.

<comment><USER28> Both the US and Russia are well known in interfering with foreign governments. Hell even America has their own foreign propaganda service "Voice of America" radio.

Also I have no problem with communism, I have problems with corruption and government over-reach/attempts to influence populations.

I'm not new to this. I've worked with people who flood social networks with bullshit to sway public opinion.

Always be skeptical, of both sides. And at this point I don't trust either the NSA or the Russian equivalents.

</comment></comment></comment><comment><USER30> Surely it's not just an issue of location but scale? Unless there is a huge team reviewing code, an individual or small team could be paid-off by an agency to provide a backdoor? For the right combination of large scale app by small team, there'd have to be a price at which many individuals capitulate? If the backdoor is somehow revealed, "doesn't matter, got my money".

I used to wonder whether some success of social media companies couldn't be explained by secret payments for backdoor access. You could be operating out of Europe or Africa and still get offered money, and other pressure carefully applied.

You might think you'd hold true to your plan of privacy-for-all, but if they offer $x00m or more?

</comment><comment><USER31> Sounds like a reasonable exit if noone wants to buy your popular e2e encrypted chat app. Take the bribe, shutdown and move on to the next iteration.

<comment><USER32> 1) Open source codebase pre-backdoor 2) Take bribe 3) Insert backdoor 4) Close company

<comment><USER33> truecrypt?

<comment><USER29> FUD?

[http://istruecryptauditedyet.com](http://istruecryptauditedyet.com)

</comment></comment></comment></comment><comment><USER34> Pavel Durov is the guy who started vk.com which stores passwords in plain text: [https://thehackernews.com/2016/06/vk-com-data- breach.html](https://thehackernews.com/2016/06/vk-com-data-breach.html) He has no clue about security. Whatever he claims, I would never use Telegram.

</comment><comment><USER35> "Never do anything against conscience even if the state demands it." \--Einstein

</comment><comment><USER36> There isn't even any need to weaken the homebrew encryption, good luck using it. I don't even have the option on the Linux desktop client at least. The "secret chat" feature isn't available.

</comment><comment><USER37> This is pretty alarming stuff.

Especially considering how that competitors like Signal are US based. Signal is owned by twitter which by no means is a small player, so it isn't likely to fly under anyones radar.

<comment> Ar-Curunir Signal is not owned by Twitter. Moxie works there, but that doesn't mean his code is owned by Twitter.

<comment><USER38> I hate to pedantically bore people but Moxie does not work at Twitter. He did for a short period of time after Twitter acquired his 2 person startup.

</comment></comment></comment><comment><USER39> There is no need for the US intelligence do to that, looking at the choices Telegram made on its own.

</comment><comment><USER40> The government has progressed from banning encryption to trying to subvert it :/

<comment><USER41> That's actually a central tenant of the NSA's mission. But that mission predates the internet and public key crypto. Now it's like the gas company is running around drilling holes in gas pipes.

</comment></comment><comment><USER35> How Telegram is making money?

</comment><comment><USER42> Good PR.

</comment><comment><USER43> The problem I have as an end user is that I want the infrastructure protecting me to be invisible. Let's return to this after the following paragraphs. I will make some pretty far-reaching conclusions.

I think we can all agree that if some totally below-the-radar crypto anarchist who happens to have a few million dollars from bitcoins figured out that they actually have enough access via the dark web to bribe a few Russian generals and long story short detonate a nuclear bomb a few miles outside New York City, just for shits and giggles, then they should be stopped at some point along the way. This will seem like a made-up example to you but I purposefully don't want to confuse the issue with practical examples. We can all agree that at some point this should be stopped.

A reasonable time to stop it might be if intelligence agencies get a literal screenshot from a darkweb chatroom (from a concerned participant, where the participant thinks they're really going too far) where this is being planned in exacting detail but more information is needed to be precise. (For example, suppose the source of the nuclear bomb were not Russia but not enough information was given to identify it. There are actually quite a few nuclear states and many of them are quite corrupt. A short list includes India, North Korea, Pakistan.)

I would think that this kind of actionable urgent intelligence should unlock whatever privacy safeguards are in place, but the issue is that if there is a correct "technical" solution (if cryptography works 'correctly' and is not broken, in an academic sense), then there is no technical possibility to unlock anything. If Tor, crypto currencies, and encryption "work" (in a binary, yes it works, or no, it's broken sense) then following the receipt of such a screenshot there is no technical means of any further step.

Here I'm going to be philosophical for a second. The future of technology is nearly infinite human power. You can already in the next few seconds initiate a crypto currency transfer to anyone anywhere in the world, who can receive it without any banking infrastructure or oversight.

The arc of technology has been personal human enablement. When individuals become nearly God-like and all-powerful, it is dangerous to be in a position where, like the Muslims reporting the madman banned from his U.K. mosque for radical insanity, the status quo is that if you report your friend to the authorities saying, "My online friend, God-like in his powers, is planning to murder a million people just for shits and giggles, and he's kind of insane. Unfortunately, I don't know where he is or what he's doing, but I'm pretty concerned. He has a lot of money from a few ponzi schemes he ran. It's pretty credible for the following specific reasons (screenshots, quotes, etc)." And the only response from the authorities is, "Thanks for all this. We don't know where he is either, in the grand scheme of things a million deaths isn't that much and if it happens we will look at preventing another such case."

That's a pretty silly response, isn't it? That the only possible response is, sorry, nothing can be done.

Okay, now I've laid out why there should probably be some infrastructure on the back-end.

What I don't like is that this translates to humans literally reading people's private correspondence, web searches, etc. It's not very good.

What is a good middle ground?

Can't the NSA make things that run locally, so that no human is reading your correspondence or web traffic, but as you start researching nuclear weapons and making plans on how to murder a million people, and start making those transactions, all this starts adding up and, to quote the Constitution, its tools can receive instructions "particularly describing the place to be searched, and things to be seized", so that after such a report, its perpetrator can be found, or at least enough information can be collected to stop it if it is actually taking place?

I think that all of us here could be okay with being stopped at some point between purchasing a hundred million dollars in anonymous currency, and detonating a nuclear bomb. It's sensible. That can be part of the social contract.

It's difficult. Nobody wants to live with a judge, jury, and executioner in their home looking at everything they are doing in case they break some law.

I am glad that I personally don't have to answer these questions. But we can all agree on the need for privacy (no human looks at what you're doing), and also on the reasonableness, as each individual online progresses toward infinite personal power, for protecting the rest of society from credible and immediate, specific threats.

I agree with cryptographers who think of cryptography as a tool that is either working or broken. (If it has a back door, it's 'broken').

Perhaps if tools included a certain portion that runs locally they could increase the extent to which the tools are not actually 'broken' (i.e. they are actually working, and actually not backdoored), while also increasing the safety every single person has from other individuals being able to plan or pay for their specific death anonymously, and with impunity.

I realize that my suggestions here are not specific enough to be actionable, they are not clear recommendations. But I don't even see these possibilities being discussed (at least publicly), so I wanted to at least move the conversation a bit in this direction.

EDIT:

\---

I'm getting downvoted pretty heavily. Let me ask point-blank: are you okay with someone being able to spend two weeks on the dark-web researching how to make and detonate a bomb using totally innocent chemical purchases, and then your spouse, parents, relatives, or you, being an innocent victim of my exploding the results, or would you want that person to be stopped at some point after they started doing that? The future of information is that it is ubiquitous and easy to access [I edited this paragraph edited from first to third person.]

Actually secure communications would mean that it is technically impossible to see if someone has started communicating with people at ISIS who have overseen and helped people explode themselves. I am not saying communication should be weak and insecure, but should I really practically be able to start doing that if I want?

This is not some kind of false example, either.

Also, for downvoters: I think it is easier for you to agree with the other half of my statement, that nobody should be looking at our web traffic and correspondence, and that it should be actually secure, and also actually private.

<comment><USER44> > _I think we can all agree that if some totally below-the-radar crypto > anarchist who happens to have a few million dollars from bitcoins figured > out that they actually have enough access via the dark web to bribe a few > Russian generals and long story short detonate a nuclear bomb a few miles > outside New York City, just for shits and giggles, then they should be > stopped at some point along the way._

I agree with this, and nuclear disarmament seems to be the best way to stop it.

Any approach involving changes to electronic communications seems unlikely to be effective: people have been trying to bribe Russian generals for centuries, well before the internet.

> _Let me ask point-blank: are you okay with me being able to spend two weeks > on the dark-web researching how to make and detonate a bomb using totally > innocent chemical purchases, and then your spouse, parents, relatives, or > you, being an innocent victim of my exploding the results, or would you want > me to be stopped at some point after I started doing that?_

How is this different from you spending one day reading the 1971 _Anarchist Cookbook_? In almost a half century since it's been released, we don't seem to have had an epidemic of homemade bombs, so I don't seem to have an evidence- based reason to object to people being able to read that book. Is the dark web different?

Also, I live in America. You could just literally go buy a gun at Wal-Mart, and you have the legal, constitutional right to do everything you do up to the second where you point it (intentionally or not) at me or one of my loved ones and fire: you _cannot_ be stopped. Shouldn't I be worried about that instead?

<comment><USER45> It seems the problem logicallee is working is the massively growing destructive power available to individuals or small groups.

Technology is accelerating to the point where the destructive power that was formerly available only to state actors with proper command & control systems is now available to small states, groups, and even individuals -- chemical, bioweapons, delivery by drone, etc. It is now possible to mail-order custom gene sequences for garage bioengineering (yes, they do try to filter the requests against homebrew bioweapons, but the operative word is 'try'). Even computing power -- I'd be surprised if a random dozen people on this forum, properly motivated and funded, could not take down the US power grid within a year.

This scale of mass destruction in the hands of individuals is a far greater scale and scope of problem than the ability of any nutjob to go to WalMart and buy a hunting rifle to point at you, me, or a Congressman.

It is the kind of real problem that keeps serious security pros up at night. And there are many of these scenarios becoming more real all the time, even if logicallee's nuke example seems too fictitious for you.

The real question he's posing is whether its feasible to build an automated system that's sufficiently private and intelligent so that it could scan the comms without violating privacy while only alerting on genuine threats.

I think it's an interesting idea, but even if implementable, would fall to the <Who Guards the Guards?> problem. What is to prevent the people who build, maintain, operate the watch-system from abusing it? Nothing but the same level of ethical training that we have now, so this is simply adding one level of indirection.

<comment><USER46> But crypto is built from math, which is available to anyone who possesses a brain. Even if you locked down all the academic output related to encryption you can't ensure no one will discover another way to hide and transmit secrets either around or through your usually-private-except-for-serious-threats communications network. You'd have better luck trying to lock down harmful bioagents and fissionable materials, but as you alluded, as long as these technologies exist the world faces a security threat. It seems to me the only way to combat these threats is to construct a society where individuals never feel the need to leverage their increasing power, a police state where anyone's communications can be inspected or abused at will by an agent, a heirarchy, or an algorithm seems antithetical to such a society.</comment></comment></comment></comment>


Anti-Tesla pickup truck drivers take over a supercharger station – again - <AUTHOR> https://tech.slashdot.org/story/19/01/06/0041228/anti-tesla-pickup-truck-drivers-take-over-a-supercharger-station----again <comment><USER2> That is the worst web page I have ever been linked to from HN</comment>


Blink - Intent to deprecate: Insecure usage of powerful features - <AUTHOR> https://groups.google.com/a/chromium.org/d/msg/blink-dev/2LXKVWYkOus/gT-ZamfwAKsJ <comment><USER2> Once Let's Ecrypt [0] launches, I suppose most web developers won't have any more excuses not to use HTTPS. It'll be free, pretty easy and quick time wise, plus it'll give you an SEO boost.

Browser vendors are certainly doing the right thing by making http be marked as non-secure, and not implementing unencrypted http/2 and not allowing non- HTTPS access to powerful api are completely reasonable steps to take.

[0] [https://letsencrypt.org](https://letsencrypt.org)

<comment><USER3> If everybody gets an SEO boost, there is no boost. :)

<comment><USER4> If you want to be pessimistic about it, anyone who doesn't adopt will get an SEO drop

</comment></comment></comment><comment><USER5> Uhm, I strongly disagree with making fullscreen https only feature.

For WebGL and WebVR community this would be a big step backwards, making browser applications again second class citizen vs native apps.

And it's not like there aren't already strong enough protections in place. Try for example visiting this mock attack site:

[http://feross.org/html5-fullscreen-api- attack/](http://feross.org/html5-fullscreen-api-attack/)

In every browser I tried it was already obviously fake. It doesn't work already with current security tech:

1) browsers ask for fullscreen permission (with big unmissable dialogs)

2) emulated fake layout is very different from real layout (missing all per- user specific browser settings, e.g. bookmarks or extension buttons or any theme customizations, also font rendering looks different)

3) emulated fake browser UI doesn't respond to interactions in the same way as native UI

<comment><USER6> The point of that article was that people don't notice subtle changes, especially when their not tech savvy/tired after a long day of work/whatever. Also someone pointed out in the comments that some people tend to ignore changes and click on whatever to get to their destination.

<comment><USER5> Yes, that's true. But for people who don't notice changes there isn't much help anyways.

Even much more primitive phishing will still work on them (just think about those "you have virus / clean your computer" ads from past, with images looking like Windows pop-ups, or remember how those "Nigerian prince" scams intentionally use broken English to selectively address more gullible folks).

These new proposed security measures will not help those people much, they can still be phished from within browser tab content rectangle.

Instead these changes will just basically kill whole class of web applications for a benefit of small subset of population phishable enough with fullscreen attacks but immune to content rectangle attacks.

\-----

BTW recent Lenovo Superfish fiasco has shown us that in fact you can't even trust native browser security UI elements. Those real UI green locks on https pages can be as misleading as those JS/HTML generated ones.

I would much more prefer browsers to secure me from known rogue certificates attacks than from hypothetical hard-to-pull-off fullscreen phishing attacks.

</comment></comment></comment><comment><USER7> Though only tangentially related I do wish EME had been properly shot in the head.

It's just another Flash that hides behind being "html5" (as if they makes it all ok). At the end of the day it's proprietary code executing on my machine that I have little or no control over. It's not just a security risk, it's also a stability concern and generally a terrible idea.

Copyright enforcement should be left to law, content companies shouldn't be trying their hand at it. Who knows, maybe if their content didn't come wrapped in utter crap people might actually part with money for it.

<comment><USER8> I view EME as sort of a necessary evil.

There was never any chance that large content companies were going to be okay with serving unencrypted media over HTTP. So the choices were:

1\. No major film or television content on the web

2\. The survival of Flash/Silverlight

3\. EME

I'm not crazy about any of those choices, but #3 seems the most reasonable.

<comment><USER9> Between these options, 1 seems the most reasonable to me. I refuse to play along with anyone who thinks that they need to hijack my computer in order to sell me content. They want my money, they can sell me DRM free content.

<comment><USER10> Then don't use EME, it's that simple.

</comment></comment></comment></comment><comment><USER11> What is going to be the protocol for development environment? Should one deal with ssl just to quickly test out the code?

What if a service streams video, which requires full screen feature? It takes quite a bit more compute power to pack it into encrypted connection, and what if the video is not of any value as a secure content. Why should people be forced to encrypt and decrypt spending extra power (battery, in case of portable devices) on it?

SSL does not guarantee the security de-facto. Also, there is plenty of personal data that is being passed through a non-encrypted connection, which is way more valuable. If this is an attempt to increase amount of secure connections, it is a very inconvenient one. Why not keep giving bonus point for using it (like SEO higher ranking) rather than making pure HTTP not usable.

<comment><USER12> _What if a service streams video, which requires full screen feature? It takes quite a bit more compute power to pack it into encrypted connection, and what if the video is not of any value as a secure content. Why should people be forced to encrypt and decrypt spending extra power (battery, in case of portable devices) on it?_

Because otherwise a MITM can abuse the fullscreen feature. SSL is a way of ensuring content integrity, not just privacy.

I do think we should have a way of signing content without mandating encryption for these use cases, but until we do, HTTPS is the only choice.

<comment><USER13> _I do think we should have a way of signing content without mandating encryption for these use cases_

SSL has it, it's just usually disabled by default - null encryption with non- null MAC.

</comment></comment></comment><comment><USER14> Bizarre. HTTPS isn't a guarantee that a site is not malicious. Its not like I could go to a CA and ask them who they signed that cert for and take on any kind of legal responsiveness. Such is the state of the CA system that they will give a cert to anyone with access to a domains MX and some bitcoins.

Instead of this, maybe require there's a user mouse event on the call stack for things like fullscreen.

<comment><USER15> The intent is to prevent man in the middle -attackers from getting access to those features.

<comment><USER16> Why would they need the fullscreen access? I could see the interest for cookies or local storage, but fullscreen?

<comment><USER17> So they can pretend to be your entire browser.

</comment></comment></comment></comment><comment><USER18> Is [http://localhost](http://localhost) / 127.0.0.1 considered secure?

<comment><USER2> From what I can gather, yes to the former, probably to the latter.

</comment></comment><comment><USER19> I wonder how many "internet of things" things will stop working due to these changes.

<comment><USER20> Aren't IOT typically servers not clients? I can't imagine their pages require access to powerful APIs.

<comment><USER14> The word has been mangled to the point of no recognition, but for low power applications you would want the IOT device to be a client pushing when changes occur.

</comment></comment></comment><comment><USER21> Basically they are destroying the simplicity of the internet in order to push their own agenda. I'd get annoyed about it, but it's not going to be long before it all collapses under it's own weight and something new and lightweight turns up to take over from what http used to be good for.

<comment><USER22> Did you even look at the kinds of attacks that motivate these restrictions before concluding that there was a nefarious agenda at work?

I took a look at a Fullscreen API attack ( [http://feross.org/html5-fullscreen-api- attack/](http://feross.org/html5-fullscreen-api-attack/) ) and found it pretty creepy even though I knew exactly what to expect and what to look for. Tighter controls over that sort of thing seem like a great idea to me.

<comment><USER23> Maybe I'm dense but I don't see how requiring HTTPS would solve phishing attacks. To me it falls in the social engineering realm, people clicking link in their mail thay really should not. Having an extra 's' in the URL will not change that. Am I missing the point ?

<comment><USER24> Here's the scenario they're trying to prevent:

1\. Bob often views videos on YouTube, so he grants youtube.com permanent access to the fullscreen API.

2\. Eve runs an open wifi AP near a coffee shop. The AP includes a proxy server that redirects youtube.com requests to Eve's own server.

3\. Bob connects to Eve's AP. When he goes to youtube.com, he instead gets a response from Eve's server, which is designed to imitate a full desktop environment. Since Bob has already given youtube.com access to the fullscreen API, the browser grants Eve's site fullscreen rights without notifying Bob.

<comment><USER23> Ok. Here I can see the problem. That said, does this happens really that much ? Shouldn't we educate on open wifi instead ?

My point is HTTPS has a cost and is a barrier of entry, the trade off isn't always worth it, IMHO.

<comment><USER12> Open Wifi is not necessarily the problem. An AP with a shared password (99% of them) is also vulnerable, if the attacker also has a password. It's not reasonable to expect people to never use YouTube on public WiFi hotspots.

And the cost of HTTPS is pretty low nowadays. Cloudflare even offers it on their free plan, and it doesn't require you to set it up on your own server.

<comment><USER23> Do you really need to secure Youtube viewing on a public WiFi hotspots ? Unless you want to sell DRM movies, I don't see the need for HTTPS here. Unless you want privacy on a public network. But we're not talking about security anymore.

So you're suggesting trading a potential MitM but an official Cloudflare MitM ? :)

It is not only about a money cost, it is also about a complexity cost and false sense of security. HTTPS is not the be-all and the end-all of security. Just a step to security, if/when you need it.

I'm not arguing HTTPS is not needed. I'm the first to push for when needed. But it is not needed for watching cat videos, sorry.

<comment><USER25> > _Do you really need to secure Youtube viewing on a public WiFi hotspots ?_

This suggests you did not, in fact, see the problem. The attacker in this scenario is not limited to replacing YouTube videos. They can make _anything they want_ appear on the user's screen, including things like a Google login page, or even a bank login page.

<comment><USER23> You're probably right, I am not a security expert and might not be seeing the whole picture. You log into your bank website connected to an open WiFi hotspot ? I never would do that. I think there is a point where you have to apply common sense.

I do not care about the downvote, my opinion is what it is and I maintain my position. As I see it (me not been a field expert), HTTPS Everywhere will not save the world. You will still have people connecting to the wrongly spelled site (HTTPS or not). Some will even have a false sense of security which would be counter-productive.

I access my through HTTPS explicitly typing the URL. My bank ask confirmation out of band for every dangerous action (by SMS). IMHO, one should be educated to take necessary precautions. In Europe, banks have to cover frauds, the positive side effect is that some banks started to educated user on security (it's cheaper !). I don't know how it is in the rest of the world.

Just to be clear, I am not against HTTPS where it makes sense. I am against HTTPS everywhere as the only security measure. Because, that's what it will come to, "We have HTTPS so we're good, security checkbox ticked". That is not, IMHO, not a good way of thinking about security.

I guess my point is HTTPS everywhere is not the solution and should rather/also educated better/more on the risks of Internet.

That said, I wouldn't mind being pointed at a screencast/viedo (on youtube ;-)) showing how the scenario you refer to would unfold.

<comment><USER25> > _You log into your bank website connected to an open WiFi hotspot ? I never > would do that._

Many people do that, and it's quite safe to do so with a modern browser. Were it not, it would not be safe to do so in _any_ context, because man-in-the- middle attacks are possible on any connection, just extra easy on wifi.

> _I think there is a point where you have to apply common sense._

As you are demonstrating quite well here, "common" sense is not good sense. It is stopping you from doing things which are safe, and making you advocate for things which are unsafe.

> _I access my through HTTPS explicitly typing the URL._

You would be typing the URL into the equivalent of a remote desktop session. That is what you're not understanding.

> _My bank ask confirmation out of band for every dangerous action (by SMS)._

1) Most banks do not do that.

2) SMS is not a secure channel.

3) Banks are not the only target (again, google/gmail accounts are another good example).

4) Even if they could not transfer funds, they would now have a great deal of information about your finances right on their screen.

> _In Europe, banks have to cover frauds_

They mostly do in the US, too. This makes consumers less likely to care about security.

> _I am against HTTPS everywhere as the only security measure._

No one has advocated that. If you think they have, you have become very confused.

<comment><USER23> > As you are demonstrating quite well here, "common" sense is not good sense. > It is stopping you from doing things which are safe, and making you advocate > for things which are unsafe.

Now you're misrepresenting what I'm saying. I'm not saying to not use HTTPS when it is needed. I am saying it is not enough. That you argue that HTTPS is mandatory because you want to do your banking on open wifi hotspot baffles me. You should not be doing banking on open WiFi hotspot. PERIOD. I also say putting HTTPS everywhere does not help as much as you think. I am _not_ saying HTTPS is a bad thing. HTTPS is not a substitute for caution.

> You would be typing the URL into the equivalent of a remote desktop session. > That is what you're not understanding.

For that to happen the phishing server would have to draw a browser shell (ok, feasable), my list of tabs (still doable) and my "OS" taskbar/menubar, that, is not possible today. I would even argue it would be harder to mimic the 'outsides' of the browser then to present a fake a website. Website change all the time and people don't pay as much attention. Robbers prefer easy targets.

I'm not saying there are not such phising sites but I have yet to see one crafted with such attention to detail (which I think is not possible anyway). Most of those I have seen are not very elaborated. And it does not matter. They feel/look secure enough. HTTPS or not.

>> My bank ask confirmation out of band for every dangerous action (by SMS).

> 1) Most banks do not do that.

> 2) SMS is not a secure channel.

SMS is not a secured channel. True. But it is a _different_ channel and that is the point. Most bank dont do that but they should.

> 3) Banks are not the only target (again, google/gmail accounts are another > good example).

Yes, and not connecting to those site on an open WiFi hotspot is still a good practice. Again, HTTPS or not.

<comment><USER25> > _and my "OS" taskbar/menubar, that, is not possible today_

Please articulate why you do not believe that is possible.

> _Yes, and not connecting to those site on an open WiFi hotspot is still a > good practice. Again, HTTPS or not._

Please articulate why you believe that is good practice.

Don't say "common sense". State the underlying basis of your belief.

And finally, please explain why, even if everything you believe is accurate, it is somehow a negative thing to prevent attacks from being carried out on users who do not share your beliefs and paranoia. Social darwinism?

Actually, one more: Even if no one did any of these things on open wifi, they would still be vulnerable to these attacks, since every internet connection is vulnerable, so please explain why protecting people who do share your beliefs is a bad idea.

Nope, still got another: I travel for work with some frequency, including internationally. When doing so, frequently my _only available option_ is open wifi. Please explain why my livelihood should be destroyed because you, an admitted non-expert, believe using open wifi is a bad idea?

Oh, hey, yet another: Please explain why, even if doing these things were unsafe now, you oppose efforts to make them safe!</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment>


The only GO map without login or scanning - <AUTHOR> https://goradar.io/?ref=producthunt <comment><USER2> How... does it work? I see nothing for miles and miles and miles: [http://i.imgur.com/ttPAgEi.png](http://i.imgur.com/ttPAgEi.png)

<comment><AUTHOR> The map area is 10 miles so that the servers don't get crushed</comment></comment>


Longest Straight Line Paths on Water or Land on the Earth - <AUTHOR> https://arxiv.org/abs/1804.07389 <comment><AUTHOR> Should be called the "Bryson Line" [1] ?

[1] [https://en.wikipedia.org/wiki/The_Road_to_Little_Dribbling:_...](https://en.wikipedia.org/wiki/The_Road_to_Little_Dribbling:_More_Notes_from_a_Small_Island)</comment>


Ask HN: What are tips to make my code more straightforward for other developers? - <AUTHOR> I'm not a professional developer, so I usually code alone. I make tools to help pentester's jobs easier. Are you able to provide tips to make code as easy as possible to add quick features, or things people don't think about? <comment><USER2> It helps to have a clear structure where features can be treated as modules.

Code should be organized so you can make simple changes entirely in one place or a small number of places rather than having to touch many files in different layers.

It also helps to provide "cookbook" documentation or automation scripts (ex. [https://cookiecutter.readthedocs.io/en/latest/](https://cookiecutter.readthedocs.io/en/latest/)) that explains the way to make the kind of features that are commonly made.</comment>


Ask HN: Please Review Our Project, TwoTruths - <AUTHOR>

Hey folks,
This is my first post for anything other than scattered blog entries or news article.
Two friends and I created TwoTruths over a weekend (46 hours + a few since then), using a custom PHP framework and integrating with Facebook and Twitter. Apologies upfront, because our login requires one or the other (questioning whether to add email sign up given the social element of what we do).
http://www.twotruths.me/
It is basically a conversation starter for you and your Facebook friends or Twitter followers. When you don't speak to people for a while, it can be intimidating or awkward to start that catch up conversation, so we built this to make that easier. Surprisingly, you even learn new things about friends (or significant others) you thought you knew well.
We'd love some advice or thoughts on the UI/UX. We've thrown around whether game mechanics could work (adding points or making it competitive to see "who knows their friends best"), whether comments should be included after you take a challenge (thinking this would create an ongoing conversation as more and more people take that particular challenge), etc. Again, we're trying to help drive conversation between friends, so any ideas or thoughts in that area would be great.
Thanks everyone for any feedback!
Chris, Michael & Elenor <comment><USER2> It seems well built and is actually a pretty cool idea. Unfortunately, I'm not sold on the concept enough to actually sign up and return every day.

Have your considered building this into a social network that's more focused on forming good connections? I think the concept might work better as an app or a feature than a stand alone site.

<comment><AUTHOR> We had not considered that, just given the steep road ahead for those building full social networks, but you're absolutely right that it could work if focused on good connections over mass connections, or thinking about a Path- like experience on the web.

With the problem of returning every day, do you think this could be at least partially solved using the comments feature to drive conversation?

Thanks for the feedback, definitely appreciate it.

<comment><USER2> I understand that but you should think about this: are you really passionate about solving the issue of "anti-social" social networking?

I really don't know. I do know that "partial solutions" won't take you far. I'd find a higher purpose for your project that allows you to reach more people.

Would it hurt to try making this into an app? If you can't build your own solution framework, integrate it somewhere people need it.

<comment><AUTHOR> Very good points. Success does mean commitment, and definitely if we're really interested in solving the "anti-social" social networking issue.

I like the idea of incorporating as an app, though it brings up some questions around direction/ interaction.

Thanks again for the feedback. If you have any more thoughts, we'd love to hear those; otherwise, we'll circle back here once we've made additional progress.

</comment></comment></comment></comment><comment><USER3> Clickable: <http://www.twotruths.me/>

<comment><AUTHOR> Thanks, Colin. Appreciate it.</comment></comment>


Ask HN: improving my automatic adwords interface? - <AUTHOR>

Hello HNers,
Posting ads on AdWords confused me at first, and arguably still does, and I found that other people shared the sentiment. So I used machine learning to make an automatic keyword selector and campaign manager, and put together a company around it because I think this would be useful for others beyond just myself.
Right now, the backend is useful for me as-is, but I wanted to know what you guys thought of the latest prototype frontend I have put together: silvos.com/captain-crunch. (I have written an account scheduler for ads which sorts each ad into an account, so that is why the ad is the only input. Also, I am not a skilled web developer, but this prototype should get the point across. A user buys the ad through the interface, and receives an email at their PayPal email address with the number of clicks the ad received, without any manual work on my part.
I am confused because this doesn't feel like the right design of simple inputs and useful outputs. I have not been able to figure out what is wrong on my own, so I decided I would get your qualitative perspectives.
If you're curious about how the backend algorithm works, email me (firstname.lastname@example.com) and I can run a test campaign for you.
I have a lot to improve here so I appreciate your feedback. Thanks, everyone! <comment><USER2> This is a really cool idea! As someone who does a lot of SEM/social advertising, I think this has a great deal of potential. I think if someone did this for the Facebook Ads API (currently in Beta, but available if you apply) they could make a killing.

</comment><comment><USER3> I do $100,000 per month in SEM between Google and MSN. So for me, I obviously don't see value.

But if you want insights into something in particular, I could help out!</comment>


How I got from working 3 jobs to $12,000/mo in revenue - <AUTHOR> https://www.indiehackers.com/businesses/rockin-robin <comment><USER2> "First of all, I negotiated an opportunity to work from home at my full-time job so I wouldn't have to be in the office all day long."

I feel like this is key. I've been an entrepreneur for the first 10 or so years of my professional career and have had multiple businesses that I started out of the first one because I had so much flexibility managing my own time. Due to a number of circumstances I've been working away at a corp office for the last 3 years and only now I realized how hard it is to do anything "on the side" after spending most of the productive hours of the day in your boss' office.

I know, I know, I could bring my personal laptop and take long breaks throughout the day to work on side projects but aside from any moral considerations it's practically really hard to schedule calls, trying to not get noticed, being kicked out of meeting rooms, etc. In my mind, being able to work from home and set your own schedule is such a huge plus to kickstart a side business/project.

<comment><USER3> Some people wake up early (5-6 AM) to get 4-5 productive hours before going to work

<comment><USER4> That might work if you're building a product but most businesses require active selling, talking to clients, building relationships, etc which are generally done during conventional hours.

</comment></comment></comment><comment><USER5> ... with this one weird trick. Why do we keep voting up indiehackers.com advertisements?

<comment><USER6> Why do you see it as an ad rather than as an educational read? I'm not paying these companies anything to appear on Indie Hackers, nor are they paying me. And nearly every post on the front page of HN represents some company or other.

The stories on IH are generally developers talking about how they came up with their idea, what they do for sales/marketing, how much revenue they're making, what their work schedules are, etc. Makes sense that they appeal to the YC audience!

</comment></comment><comment><USER7> Be very careful to properly disclose your outside interests when working with startups. One simple email up front can save you a lot of pain and heartache on pay day.

<comment><USER8> I am curious. Could you please tell more what you mean by "Be very careful to properly disclose your outside interests"?

</comment></comment><comment><USER9> > It is psychologically easier to start off while having another job and > income stream.

So true. Really weird, but really true.

<comment><USER10> Agree. I highly recommend keeping your current job before starting any new venture.

<comment><AUTHOR> I do so as well, this may affect your growth opportunities, but you could look in the future without everyday fear running out of money and not being able to pay rent or kindergarten.</comment></comment></comment>


Foursquare experiencing another multi-hour site outage - <AUTHOR> http://status.foursquare.com/post/1251597171/partial-site-outage

<comment><AUTHOR> I really feel for those folks, this has been an awful week for them and it's only Tuesday. This is also really terrible publicity for MongoDB.

</comment><comment><USER2> I hope they find the root cause, specifically whether it is MongoDB or Foursquare's code at fault, or some combination.</comment>


Using Twitter To Identify Psychopaths - <AUTHOR> http://www.forbes.com/sites/kashmirhill/2012/07/20/using-twitter-to-help-expose-psychopaths/

<comment><USER2> See also: <http://news.ycombinator.com/item?id=4282565></comment>