Voice Calls: Secure, Crystal-Clear, AI-Powered - <AUTHOR> https://telegram.org/blog/calls <comment> torrent-of-ions I will definitely try this because I have trouble with all other voice chat services including Skype, WhatsApp and Hangouts. Often one of those three will work but not always.

But the most annoying problem with any internet voice chat is not so much the quality but the latency. Landline phones have noticeably lower voice quality but one can still enjoy a conversation perfectly well. High latency, on the other hand, absolutely ruins the experience.

I always see these services talking about "crystal clear quality", but never latency, which is a shame. Maybe there is simply nothing they can do about it. I've noticed latency get worse and worse on the Internet since I started using it in the 90s and nobody seems to talk about it.

There are so many more sources of latency on every layer on the modern internet and it's a damn shame. I remember when interleaving got enabled on my ADSL and latency to everything doubled overnight. Then there are NATs, and all kinds of filtering shit that ISPs insist on. Sigh...

<comment><USER2> The Opus codec ( [http://opus-codec.org/comparison/](http://opus- codec.org/comparison/) ) can enable very low latency audio. 26.5 ms algorithmic delay (the time it takes to go through the algorithm) by default, but can be set to a very impressive 5ms. Digital audio can't achieve the near no-latency analog POTS has, but it can get pretty darn close e.g. if Opus is used in the very low latency mode. I believe Mumble and maybe TeamSpeak let you choose the Opus latency. I know some other apps like WhatsApp, Wire, and Signal use Opus as well. I don't know what settings they use though.

Another problem is cell phones add ~150ms latency (pre VoLTE) and people that route calls through Google Voice adds an additional 150ms+ latency on top. If you ever talk to someone on a cell phone on google voice, it sounds like they're calling from the moon.

150ms is about the human limit before turn-taking and talking over each other becomes an annoyance. That's why cell-to-landline conversations (150ms one way) were tolerable, but cell-to-cell (300ms one way) conversations are abysmal. And that's all in the same area code. Once you add long distance, it gets worse.

<comment><USER3> Just fyi, POTS is digital up until the very last mile. While the network is digital, it uses time multiplexed serial PCM streams under the hood. Aside from the delay imposed by fiber transmission at the trunk level (~40 milliseconds from one side of the US to the next. If you're using a long distance network that packetizes the connection or sends a call on some weird route, that can certainly increase), the g.711 encoding delay should be fixed at 0.125 milliseconds.

<comment><USER2> Interesting. I didn't know g.711 was so low. Typical VOIP latency must then stem from D/A and A/D conversion and internet latency.

<comment><USER4> g.711 has such low latency because it doesn't take advantage of inter-sample redundancy in any way whatsoever - it's just raw 8-bit samples at 8 ksps with a compander on either end (traditionally on the analog side of the DAC and ADC).

</comment></comment></comment></comment></comment><comment><USER5> " Each time you make a Voice Call on Telegram, a neural network learns from your and your device's feedback (naturally, it doesn't have access to the contents of the conversation, it has only technical information such as network speed, ping times, packet loss percentage, etc.). The machine optimizes dozens of parameters based on this input, improving the quality of future calls on the given device and network."

Is it just me or does this sound like serious bullshit? Unless you have some hard evidence of course...

<comment><USER6> The 'neural network' is probably an SVM or logistic regression. There's nothing special that a neural network can learn with high-level features like network speed, ping times, etc.

In fact, it's probably just a TCP-like algorithm, i.e. decrease rate of packet sending if not getting ACKs back. One day, Intel might come out and say their microprocessors are AI-powered, since it has branch prediction.

<comment><USER7> I think that Samsung beat Intel to it:

"Neural network spotted deep inside Samsung's Galaxy S7 silicon brain (theregister.co.uk)" \- [https://news.ycombinator.com/item?id=12340348](https://news.ycombinator.com/item?id=12340348)

</comment></comment></comment><comment><USER8> "Each time you make a Voice Call on Telegram, a neural network learns from your and your device's feedback (naturally, it doesn't have access to the contents of the conversation, it has only technical information such as network speed, ping times, packet loss percentage, etc.). The machine optimizes dozens of parameters based on this input, improving the quality of future calls on the given device and network."

What sort of parameters are adjusted?

<comment><USER9> Sounds like marketing speech for variable bitrate encoding and/or adjusting compression aggressiveness.

<comment><USER10> > variable bitrate encoding

I hope not... VBR can easily leak all sorts of information (including the actual content of the conversation)

<comment><USER11> Whoa, I had never thought of monitoring VBR as an attack vector for recovering audio.

Do you have a link discussing this?

<comment><USER10> Sure, here are a couple papers on the topic:

[https://www.cs.jhu.edu/~cwright/oakland08.pdf](https://www.cs.jhu.edu/~cwright/oakland08.pdf)

[https://www.cs.jhu.edu/~cwright/voip- vbr.pdf](https://www.cs.jhu.edu/~cwright/voip-vbr.pdf)

It's fundamentally very similar to the sorts of issues you end up with if you compress then encrypt. If the attacker can make some educated guesses about the plaintext prior to the compression, the compression ratio can be a very powerful tool in their arsenal.

<comment><USER12> Wire implemented CBR for their encrypted calls, upstreamed it to WebRTC and submitted a patch to Signal, [https://medium.com/wire-news/call-security- constant-bit-rate...](https://medium.com/wire-news/call-security-constant-bit- rate-encoding-and-improving-webrtc-a85be6caa43a)

<comment><USER10> Silent Phone has used CBR since day 1.

</comment></comment></comment></comment></comment></comment></comment><comment><USER13> Does anyone have an opinion on the new "three-message modification of the standard DH key exchange" they introduced for calls?

From their API doc: [https://core.telegram.org/api/end-to-end/voice-calls#key- ver...](https://core.telegram.org/api/end-to-end/voice-calls#key-verification)

> Party A will generate a shared key with B — or whoever pretends to be B — > without having a second chance to change its exponent a depending on the > value g_b received from the other side; and the impostor will not have a > chance to adapt his value of b depending on g_a, because it has to commit to > a value of g_b before learning g_a.

> The use of hash commitment in the DH exchange constrains the attacker to > only one guess to generate the correct visualization in their attack, which > means that using just over 33 bits of entropy represented by four emoji in > the visualization is enough to make a successful attack highly improbable.

<comment><USER14> I haven't personally reviewed it, but based on their previous inability to make principled cryptographic choices and resistance to critical feedback from actual cryptographers… I'm skeptical.

<comment><USER15> can you point to some examples where the resisted critical feedback? I've heard people mention this but haven't actually seen anything convincing yet

<comment><USER16> Read up the comments on the telegram announcement post here on HN. From couple of years back, IIRC.

PS: on mobile. Could not.search.

<comment><USER15> Found it [1].

tldr: First message from TelegramApp has some marketing copy ("acm winner phds") but not horrible. The TelegramApp user remains calm/careful and mostly polite in every message after that. There are only a few cases of sideways slapping and they come from HN users. Despite this the conversation between TelegramApp and HN users remain informative debate and discussion.

1\. [https://news.ycombinator.com/item?id=6913456](https://news.ycombinator.com/item?id=6913456)

<comment><USER14> Being cordial and polite on Hacker News wasn't my concern. My concern is their repeated dismissal of feedback from experienced cryptographers.

Cryptographers can't seem to make sense of a _lot_ of their design decisions in the MTProto protocol. Their response to criticism has mostly been in the form of: if you can't demonstrate a break directly, then we don't care.

Given how fragile cryptography can be, this is an absurdly irresponsible way to maintain a cryptosystem. Modern cryptographic designs try to be _very_ principled, and steps are taken to prevent any kind of theoretical weakness, even if we don't know how to break it in practice. This is because cryptographic breaks only ever get stronger — never weaker.

As an example, TLS 1.0 using doing authentication for CBC modes with MAC-then- Encrypt was known to be weak, but it was only years later when researchers were able to turn this into a plaintext-leaking break. And MTProto is absolutely littered with unconventional or known-weak constructs, giving a lot of potential levers attackers can use to break it.

You might argue that it's fine for this to be the case, as long as they respond quickly to protocol breaks. The problem is, the _good guys_ only learned how to break TLS 1.0 CBC when the attack was published. Did the NSA/CIA/GRU/FSB know about these attacks before we did? There's no way to know. But if it had conservatively chosen an Encrypt-then-MAC scheme to begin with, such an attack would have never been possible in the first place.

That's not to throw the TLS 1.0 authors under the bus here. The weaknesses of that type of scheme were yet to be widely known. In the case of MTProto, weaknesses in their use of certain constructs _are_ widely known, and they don't seem o care.

<comment><USER15> I read through the linked thread in my previous post and I think it gives a good idea of the rift between the in-house-HN-cryptographers and those at Telegram. One will find the exact same disconnect between cryptographers that worked under heavy computational constraints, and those that have not. For example, in the Satellite TV industry.

The Telegram designers built a protocol with anticipation of some constraints. But rather than debate the plausability of the percieved constraints, the HN- crowd just dug into whatever they already knew and threw in a lot of snark in their response to close the door.

> Their response to criticism has mostly been in the form of: if you can't > demonstrate a break directly, then we don't care.

I haven't seen that. I went looking for it. If you have the patience and time please dig up a link or quote.

> That's not to throw the TLS 1.0 authors under the bus here. The weaknesses > of that type of scheme were yet to be widely known. In the case of MTProto, > weaknesses in their use of certain constructs are widely known, and they > don't seem o care.

I did see a good bit of discussion about the feasability of some of the weakness pointed out. They responded in a way that seemed to indicate they fully understood the issue but "chose" to take the risk. I'm not sure this means "they don't care". Perhaps it does. But this is where I started to see that the rift here was really about the perception of constraints, not lack of knowledge or, in my opinion, lack of care.

</comment></comment></comment></comment></comment></comment></comment><comment><USER17> I've managed to setup Telegram for most of my (non-technical) family - wife, siblings, mother (she doesn't even have a smart phone and just uses Telegram as a message client on her desktop. It's a very convenient way to share family related pictures).

Voice calls are an excellent addition. If these could now also be extended to video calls, I could likely ditch Skype forever.

<comment><USER18> A client of mine once explicitly asked to communicate via Wire [1] which is pretty similar to Skype but E2E encrypted. It was launched by a Skype co- founder, is easy to use and has a pleasant interface. And it's open source. I can't really tell if the product really does what it's advertising, perhaps someone with more expertise could chime in on that. I got stuck on it and I'm considering ditching Skype altogether for it. Perhaps not the solution you were looking for but interesting nonetheless!

[1] - [https://wire.com/en/](https://wire.com/en/)

<comment><USER19> It's open source indeed [1] and was recently audited for the quality of the crypto protocol implementation [2]. Not sure what questions you specifically have but I'm happy to answer as I'm part of the team.

[1] [https://github.com/wireapp](https://github.com/wireapp) [2][https://medium.com/wire-news/wires-independent-security- revi...](https://medium.com/wire-news/wires-independent-security- review-61f37a1762a8)

</comment></comment></comment><comment><USER20> I'm using Telegram as my main messaging system but I hope they'll open source everything. That's the only way to fully audit the service.

Telegram is not too bad but has too many grey areas at this moment.

<comment><USER21> Client and protocol are open source. What more do you need?

<comment><USER22> They have stopped publishing the source code for their clients.

<comment><USER23> They have?

[https://github.com/telegramdesktop/tdesktop](https://github.com/telegramdesktop/tdesktop) seems fairly up to date?

<comment><USER24> Latest commit on the Android version was six months ago: [https://github.com/DrKLO/Telegram](https://github.com/DrKLO/Telegram)

And yes, that's the official location of the Android app, linked here: [https://telegram.org/apps](https://telegram.org/apps)

<comment><USER23> it seems they are watching, they've uploaded the newer version

</comment></comment></comment></comment></comment></comment><comment><USER25> Signal has this as well. I trust their security (personal bias), but unfortunately the call quality is a non-starter at the moment.

<comment><USER26> As does Wire, just for the record.

They are one of the newer kids on the block. Open sourced in March 2016, End to End encrypted (everything and by default) since June 2016 (or the other way around). Supports chats, calls, video calls, file transfers and multiple devices (including Linux, though Electron...).

<comment><USER27> And when I tried it, for me seemed to have the best call quality, it was better than my network call quality.

</comment></comment></comment><comment><USER28> The emoji out of band authentication is cool, but probably annoying. You have to read those emoji by voice to the other end, so they can check them. That could be a pain if the emoji are chosen randomly from the 2600 available emoji.

The idea comes from the STU-3 secure phone, where there was a 2-digit number display to be read back by voice. It's one of the ways to detect a man-in-the- middle attack. If there's a MITM, the crypto bits sent and received are different, because the MITM is re-encrypting, and this is detectable if you have some out of band channel for comparing them. A MITM would thus have to be able to fake the voice of the other party.

With techniques like this, you can make an MITM work arbitrarily hard to maintain the illusion that it's the other party. I've proposed some ways to do this for web pages.

<comment><USER29> It's gimmicky. I prefer Signal's numeric encoding - easy to read aloud with no room for ambiguity.

</comment></comment><comment><USER30> But seriously how do they pay their bills? (I know VK brothers are super rich)

There are bots that relay huge media files

It's probably (imo) the fastest & most complete cloud based chat app

Everything.. Literally everything you share can be retrived over the cloud

& and now calling

That must be super expensive infrastructure? No investors no monetization

<comment><USER31> They're sitting on troves of data. Extremely few use the E2E encrypted "secure chat" feature (mainly because it isn't default, but also because it doesn't sync between devices) and all the chat logs and data are stored on their servers (and are readable by Telegram). They also store your address book on their servers.

I'm sure they will find ways monetize this. Data is the "new gold", as they say[1]...

[1] [https://www.google.com/#q="data+is+the+new+gold"](https://www.google.com/#q="data+is+the+new+gold")

<comment><USER32> Their FAQ[1] states:

Q: Will you have ads? Or sell my data? Or steal my beloved and enslave my children? No.

So I don't think they will make money by selling data.

[1] [https://telegram.org/faq#q-will-you-have-ads-or-sell-my- data...](https://telegram.org/faq#q-will-you-have-ads-or-sell-my-data-or- steal-my-beloved-and-ensl)

<comment><USER33> An FAQ isn't binding. What does their TOS say?

<comment><USER31> Are you really serious? This is a post snowden society.

> An FAQ isn't binding.

Probably not, but please beware that this service is not subject to US law, but the laws of the Russian Federation.

> What does their TOS say?

TOS are subject to change, right? And even if it wasn't, do you really think the TOS will stop a company run by a russian nationalist[1] offering a free service with a million dollar bill will stick by their word (which, in this case is literally a single word)?

[1] [https://www.instagram.com/p/-MrPWGr7aL/](https://www.instagram.com/p/-MrPWGr7aL/)

<comment><USER34> > service is not subject to US law, but the laws of the Russian Federation

They are not registered in Russia, afaik.

> russian nationalist[1] … [1] > [https://www.instagram.com/p/-MrPWGr7aL/](https://www.instagram.com/p/-MrPWGr7aL/)

That's just Pavel's usual populism. He says the same things about Russia or pretty much anything.

<comment><USER35> >They are not registered in Russia, afaik.

They are writing the software in Russia (right next to the VK's door to be precise), though. Source: local Saint-Petersburg newspapers.

</comment></comment></comment></comment></comment></comment></comment><comment><USER36> I tried [https://appear.in](https://appear.in) recently for a short call with a student and it worked well. A friend and fellow freelancer also uses it, he said. One good point about it is if you need to do a quick ad-hoc call - it is browser-based (probably uses WebRTC), and also does not need to you create an account or sign in. Plan to try it more in future, as well as TeamSpeak which I also mentioned in this thread. I had installed Wire too, both on PC and Android phone, but not tried it yet with anyone.

</comment><comment><USER37> Closed source, not end-to-end encrypted by default, end-to-end only device to device (so I can't swap seamlessly from a desktop to a mobile session). Not even the protocoll is open, so I am bound to their clients.

Sadly it was the only nice alternative when the snowden stuff was published. That means those of my peers who made it away from skype/fb/whatsapp are now on telegram.

<comment><USER38> > end-to-end only device to device (so I can't swap seamlessly from a desktop > to a mobile session)

How do you accomplish a seamless swap from desktop to a mobile session using end-to-end encryption?

<comment><USER39> iMessage has end to end encryption and supports multiple devices. Each device uses its own keypair and when a message is sent, it is sent encrypted for each of the recipient's devices.

[https://www.apple.com/business/docs/iOS_Security_Guide.pdf](https://www.apple.com/business/docs/iOS_Security_Guide.pdf)

<comment><USER40> The hard part is how do you manage a list of trusted devices.

The thing which is really sad is that there are no end to end encrypted group chats.

<comment><USER41> [https://riot.im](https://riot.im) is doing this.

e2e is in beta still, but they have key list management/verification in place already.

</comment></comment></comment></comment></comment><comment><USER42> Conference calls! That's what we need in a whatsapp/telegram like app. Make it a reality to see the end of telco domination in the voice space.

</comment><comment><USER43> This is your periodic reminder that Telegram uses sketchy crypto and should be avoided.

<comment><USER44> Most people who I know use Telegram(me included) use it because it's frankly the nicest(fast, looks good) Messenger out there, not because of its security features. Personally I don't use the secret chat functionality; I would use Signal if I wanted to communicate securely.

<comment><USER43> I don't choose my car for its seatbelts, but if they are broken, I reject the car.

<comment><USER44> Right, because you use seat belts every time you drive. So they are always a factor.

I do not use Telegrams security features though, so whether they are any good isn't relevant to me(and many other people).

<comment><USER43> Whether you use them or not, intel agencies use their lack. This is the naïve "I have nothing to hide" dodge about privacy.

<comment><USER44> As I already said, if I was concerned about intel agencies capturing my messages I'd use proper OSS encryption via Signal, not Telegram.

There simply are situations where I do not care whether my messages are encrypted or not, in which case I use the app that works the best for me, which in this case is Telegram.

</comment></comment></comment></comment></comment></comment><comment><USER45> How many times has this headline been changed? I've seen 3 different ones.

</comment><comment><USER46> No app wil ever accomplish consistent good voice quality over the internet. Ever. For that it's too much of an unreliable network. You may try some calls over Signal, think Hey! This works well! until you hit a moment where the route between endpoints is flaky, attribute it to Signal while using another app for that same call at that particular point in time would have given the same result.

Only when QoS will be honored by all internet routers will we reach something that is consistently reliable.

<comment><USER47> You are dumb if you really believe this. Technology always proves people wrong. Just wait for it.

</comment></comment><comment><USER48> Some artist had fun with this: we have a woman talking on her cell phone while driving and a fully clothed man in a bathtub, with a monocle.

</comment><comment><USER49> The NN approach sounds interesting, but there are no technical details and it might be hype-based marketing.

Is anyone familiar with solid published work on applying ML/AI to optimize network control (or, as done here, optimize application parameters depending on network conditions).

<comment><USER50> Funnily enough, 10 years ago as a required entry step before being able to do a thesis I scribbled something[0] about distributed components with probes (some automatic, some with user feedback exactly as suggested here) and knobs driven by some fuzzy logic feedback loop, to be e.g applied to codecs and buffer size in an A/V streaming scenario† (possibly bidirectional). Concluded by saying you could get better, self-improving results by using genetic algorithms and/or AI such as NN. Was basically laughed at during defense and dismissed as being way too sci-fi. Got sick of such constant condescending attitudes and dumped research, pursuing my career as a software engineer. Had I pursued I could have been the author on such a paper you're looking for! Pretty sure I could have patented the shit out of this anyway but that's not how I roll regarding software patents. Now I lost the LaTeX source and Java code as well as the resulting PDF, and can't even download the thing as a memento since it's behind some stupid paywall.

† turned out MS launched instant play adaptative 1080p streaming some years later on Xbox 360, which was exactly that.

[0] Supervision d'une Application à Base de Composants afin de Respecter des Contraintes Temporelles - [https://hal.inria.fr/inria-00000787](https://hal.inria.fr/inria-00000787)

</comment></comment><comment><USER51> I still vote Wire. It used to be buggy, but much better now, plus completely Open Source (Telegram is not).

I just placed my first Wire audio call from my phone a few minutes ago: great quality (better than my actual phone service), no noticeable lag.

<comment><USER52> _> It used to be buggy_

How long ago are you referring to?

I tried to use it around the end of 2016 to chat with friends and it was nearly impossible to use. We would try to add a contact but the other person would not appear online, despite having the app open in front of us.

Messages would frequently not be delivered, or take exceedingly long times to be delivered (hours). Notifications of a new message were also quite hit and miss.

Overall I liked the functionality of Wire, but the reliability was terribad.

<comment><USER51> Not sure, 6-9 months ago. Texting always worked for me, but audio & video were hit-&-miss.

Actually, thinking about it now, I haven't used video much lately, but audio has been much better the past 1-2 months.

</comment></comment></comment><comment><USER53> Can anyone familiar with the matter say how secure is the 4-emoji verification code?

<comment><USER54> > _Thanks to this modification, it becomes possible to prevent eavesdropping > (MitM attacks on DH) with a probability of more than 0.9999999999 by using > just over 33 bits of entropy in the visualization. These bits are presented > to the users in the form of four emoticons. We have selected a pool of 333 > emoji that all look quite different from one another and can be easily > described in simple words in any language._

33 bits of entropy seems quite low to me.

[https://core.telegram.org/techfaq#q-how-are-voice-calls- auth...](https://core.telegram.org/techfaq#q-how-are-voice-calls- authenticated)

<comment><USER55> That would be low if we were considering a long-term key. It seems fine for a one-shot authentication token? Eve is going to have to MitM a _lot_ of calls before she guesses this token correctly.

</comment></comment></comment><comment><USER56> Is it fully controlled by FSB?

<comment><USER57> Brothers funded by loans from Swiss banks and citizens of a Commonwealth island. From the paranoid angle try s/FSB/GCHQ.

[https://en.wikipedia.org/wiki/Pavel_Durov#Life_after_VK](https://en.wikipedia.org/wiki/Pavel_Durov#Life_after_VK)

</comment></comment><comment><USER58> My problem with Telegram is I want to use it but they wont let me. I use a budget phone service (freedompop) which apparently is technically voip, but I did not know until I tried to register for Telegram with it. They refuse to send me text verification. Wont work with my google voice number either. WhatsApp does not have this problem. And what if I want to use Telegram on desktop only? Why do I need to verify a phone number?

<comment><USER59> It worked with my Google Voice number just now. Could they have changed the policy? I did sign up with my iPad (with cell service) first then iPhone, so it was probably more open to not using the device's phone number.

<comment><USER58> Hey! What do you know? I guess they added support after enough complaints. Now I'll give it a go.

</comment></comment></comment><comment><USER60> The UI for trimming and setting the quality of sent videos is really neat. It's still annoyingly hard in 2017 to send videos from one mobile to another without needing to completely trash the quality via MMS or upload an often- gigantic file (captured in 1080p or higher) to an intermediary like YouTube or Facebook (and then wait for backend processing).

</comment><comment><USER61> This is awesome.. I have been trying to video chat with somebody more overseas. Whatsapp video, facebook video, skype, seems like the only thing that works for us right now is Duo.

Bad thing: this tech is trapped in Telegram which is quite political of an app. I wish they'd break it out into something like duo.

</comment><comment><USER62> I wish they allow arbitrary user identifiers, which are not tied to mobile operators. Just for geeks.

</comment><comment><USER63> Very welcome addition. Can anyone confirm if this feature will be available on the desktop app as well?

<comment><USER64> yes.

<comment><USER65> Source?

<comment><USER66> [https://twitter.com/telegram/statuses/847417578150428675](https://twitter.com/telegram/statuses/847417578150428675)

</comment></comment></comment></comment><comment><USER67> Very good. Great even. But there is a problem. Whatsapp has already won the chat/calls app war. Watch it grow massivly in the next year, i promise. Mostly due to incompetence of MS and Google.

<comment><USER68> > Whatsapp has already won

Globaly - maybe, for now. in some countries, however, it's not as popular as Telegram or Viber, for instance. (like Iran, for example)

<comment><USER69> Or WeChat (China), or LINE (Thailand).

</comment></comment></comment><comment><USER70> Wait, I saw nobody mentioned this, but I feel this is very similar to Slack, group-chatting basically, isn't it?

</comment><comment><USER71> I happened to be reading a comparison of Telegram and Whatsapp this morning [1]. I've never used Whatsapp, is it really this bad or is the reviewer clearly a massive Telegram fanboy/girl?

[1] [https://info.seibert- media.net/display/Atlassian/Comparison+...](https://info.seibert- media.net/display/Atlassian/Comparison+of+Telegram+Messenger+and+Whatsapp)

<comment><USER72> Telegram is superior to Whatsapp from every perspective _except_ for its smaller user base.

However, how can you take as unbiased a comparison table that uses adjectives as "Incredibly fast loading times", "UNRIVALED", etc.?

<comment><USER31> > Telegram is superior to Whatsapp from every perspective except for its > smaller user base.

I'd say, except for its security/encryption...

<comment><USER26> The encryption they _claim_ to use. Not saying they don't, just saying it's only "sort of" superior on encryption, given this caveat.

<comment><USER73> The same goes for Telegram. The android client hasn't seen any updates to it's github repo since sep 2016.

And, it is quite easy to verify that WhatsApp's encryption is doing what we think. A friend of mine managed to reverse engineer their protocol in 2012 in less than 24 hours, by himself. And there is quite a big chunk of the computer security market that would disagree with the claim that something has to be open source to be verifiably secure.

<comment><USER74> Couldn't WhatsApp faithfully implement the protocol, but also keylog and phone home occasionally? How would you know?

<comment><USER73> Sure, but then again so could Telegram. It's a rather fruitless discussion.

<comment><USER74> No it's not. The fruit is: use a sideloaded Signal which you built yourself if you really need to be secure. If you're not, Signal is still better than Telegram or Whatsapp.

<comment><USER73> Well, that I agree on, but that wasn't the discussion I was having :)

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER75> Are there any plans to bring group chat to Telegram?

<comment><USER76> Perhaps you mean group calls? Group chat is available in Telegram.

</comment></comment><comment><USER77> With talk of neural interfaces and augmentation will we have apps in the future that support human to human encryption I wonder?

<comment><USER68> With things like BLADE this is not even a far future [http://www.nature.com/nbt/journal/vaop/ncurrent/full/nbt.380...](http://www.nature.com/nbt/journal/vaop/ncurrent/full/nbt.3805.html)

</comment></comment><comment><USER78> a neural network learns from your and your -- typo

</comment><comment><USER78> a neural network learns from your and your

</comment><comment><USER79> Pied Piper, is that U ?

</comment><comment><USER80> In a world full of bloated Electron HTML5 / JS "desktop apps", I'm very happy to see Telegram on Windows is a native app (Qt). It feels so incredibly responsive compared to everything else.

<comment><USER81> The funny thing is that Qt apps used to be derided for bloat (15MB of DLLs! _15MB!_ ) but the rise of Electron has made Qt seem featherweight by comparison.

<comment><USER80> I've been involved in a project that went from standard Win32 controls to Qt, and while I was very much against Qt at the time (such bloat!), I can't deny how easy it has made cross platform UI work. With many apps being written in HTML/JS, a C++ Qt framework is still magnitudes faster than a JS interpreter.

<comment><USER82> I have zero experience with Qt but have heard that it has problems with High DPI presentations. Now It seems that they did something in that regard in Qt 5.6, but do you have anything to say or an idea about the maturity of it?

<comment><USER83> Qt classic (C++) apps run flawlessly on my 4K desktop (150% scale in Windows).

QML/QtQuick apps only support integer scaling for whatever ridiculous reason ("fuck your monitor we need to be pixel perfect" or whatever) so they're either tiny or huge.</comment></comment></comment></comment></comment>


Fred Wilson: Favoriting Ads - <AUTHOR> http://avc.blogs.com/a_vc/2007/08/favoriting-ads-.html

<comment><USER2> As the people commenting at fw's blog say, it just isn't going to work. It's also been done quite a few times.

Maybe if you tried a "fun" twist instead, like a link that says, "Don't bother other people with this ad". Make it explicit, you know.

BTW, I'm a consumer of web ads, and my ctr with adwords is usually between 2-3 percent. (For certain keywords, as high as 50 percent.) My adsense ctr? For this month... 0.02 percent. One click total. So, there's definitely room for improvement.

</comment><comment><USER3> So do I give an upvote if I like the ad, if I approve of it, or if I'm actually likely to follow up on it with a purchase? An ad could easily be one of those and not the other two, and I don't want to send mixed messages to advertisers. Of course, I use adblock and flashblock on most sites (a few sites I do allow ads), but if this caught on enough to convince advertisers to stop using crappy / annoying ads, maybe that would change.

</comment><comment><USER4> What would their business look like if Adpinion worked with someone like Cox News? <http://www.coxenterprises.com/corp/home.htm> <http://www.coxnews.com/index.html></comment>


A Python Reading List by Wesley Chun  - <AUTHOR> http://www.informit.com/articles/article.aspx?p=1849069

<comment><USER2> This looks less like a reading list and more like a lead-up to the author propping up his own book.

He completely fails to mention any of the more advanced Python books like _Expert Python Programming_ or _Pro Python_ and especially Lutz's _Python Programming_ which seems to have exactly the same type of content as he's book (general knowledge about various python libraries).

<comment><USER3> What got me more was the massive overlap of some of those books.

A reading list should allow you to progress.

<comment><USER4> @mapleoin, @rhizome31, @wilduck: yep, that's another list, for "expert Python readers". i would like to add that at some point, but my editorial constraints were 1500 words or so. i'd also like to review all those before making suggestions too. i think you're right in that there's probably some overlap with mark's book, but our writing styles are very different (check Amazon reviews for more details), and i've tried to add more contemporary applications in this edition of Core Python.

@ashconnor: that's another valid type of reading list. in this one, i think i compiled 3 discrete lists instead of your more progressive idea, which is a good one. i'd like to see what's in _your_ list. as far as the overlap is concerned, yes, you're right about that as far as the material goes, however the delivery is different and suited to a variety of reader types.

</comment></comment></comment><comment><USER5> I wish someone would write a good book focused on more advanced aspects of the Python language: generators, metaclasses, descriptors, etc. From what I could tell from the reviews and TOC, some books such as _Pro Python_ or _Expert Python Programming_ seem to introduce those techniques, but it doesn't seem to be very in depth, and I don't need a book for the other topics they cover. There are a lot of blog posts about this but it's always based on toy examples, so while it's not hard to grasp how those techniques work by themselves, I fail to see how to use them in real-world projects. I'd love to read an in-depth guide on those techniques, with several examples of progressive complexity that solve real-world problems. I don't think it needs to be very long, but it probably needs to be well thought.

<comment><USER6> My favorite way to learn about something like metaclasses in python is to go to stackoverflow and search for '[python] metaclasses' then order by votes. Open up a few of the links that look interesting, and you'll get to see some good uses. In this case, you'll also end up with this awesome explanation near the top:

[http://stackoverflow.com/questions/100003/what-is-a- metaclas...](http://stackoverflow.com/questions/100003/what-is-a-metaclass-in- python)

In practice, this works for a wide variety of topics.

</comment></comment><comment><USER7> Anyone have a good book which analyze the source code of Python? Or just describe how important/most-common-use functions/methods be implemented in Python?

<comment><USER8> Beautiful Code (O'Reilly, <http://shop.oreilly.com/product/9780596510046.do>) has a chapter on the dictionary implementation.

</comment></comment><comment><USER9> It's interesting that Wesley recommends both _Dive Into Python_ and _Learn Python the Hard Way_.

Zed Shaw, the author of the latter, actually has a big rant on why he doesn't recommend _Dive Into Python_.

<http://oppugn.us/posts/1272050135.html>

<comment><USER4> @kqr2: this is what led me to my opening remark on how different learning styles require different styles of writing ... believe it or not DiP has gotten _good_ reviews... just check Amazon. the problem i alluded to is that it's not for everyone.

Here's are similar comparisons between my book and Mark's as documented by Eric Wilson both on his blog as well as in an Amazon review... see <http://amazon.com/review/RKG44D8GQYLNL> and <http://wilsonericn.wordpress.com/2011/09/26> for details. So yes, some people don't like it, but to others, it's just what they needed.

</comment></comment><comment><USER10> I have gone a long way just using Mark Lutz' Learning Python and Programming Python, and looking up anything not covered in those two books.

</comment><comment><USER11> I took a class from Wesley Chun on Python while at VMware and he did a good job at teaching Python. Sadly apart from writing simple scripts at home I haven't gotten a chance to work on full-fletched Python project.

<comment><USER4> @bankim: thanks for the kudos! i have to admit i'm one of those mutant engineers that actually _likes_ teaching; hopefully my experience using Python really helped with giving you that perspective as opposed to someone who's just teaching you Python syntax which you can basically learn on SO or online elsewhere!</comment></comment>


Send a profile of your freelancer and we will valid him through our database - <AUTHOR>

We have screened more that 100 000 developers/designers from odesk(upwork)/elance for last 6 years, and have great quality rated database of profiles, can give it for free.<p>Or you can send us a project here: https://goo.gl/MMRNih <comment><AUTHOR> Are you in this list?</comment>


Conifer – collect and revisit web pages - <AUTHOR> https://conifer.rhizome.org/ <comment><USER2> Keep in mind that the captured pages doesn't work in offline mode (which is the main point for archives). In my opinion, this is not a complete self- hosted archive solution.

It seems that they want users to use their online service instead (in order to collect user data of course) ... This is why they give you "free" 5GB account :)

<comment><USER3> That's clear from the front page.

If you want to do it yourself, use the original open source tools that this is based on, and that they paid to develop.

 _Conifer is an online service based on Webrecorder software._

</comment></comment><comment><USER4> What's up with their Github? The link in the footer is broken: [https://github.com/rhizome-conifer/conifer](https://github.com/rhizome- conifer/conifer)

And their Github organization has no public repositories. Is the code in the process of being moved from somewhere else?

<comment><USER5> Looks like it's moved here [https://github.com/webrecorder/conifer](https://github.com/webrecorder/conifer)

<comment><USER6> According to the site ([https://blog.conifer.rhizome.org/2020/06/11/webrecorder- coni...](https://blog.conifer.rhizome.org/2020/06/11/webrecorder- conifer.html)), webrecorder is becoming Conifer, so I'm guessing they've renamed the project but not transferred it yet.</comment></comment></comment>


Ask HN: Why no regex AND? - <AUTHOR> Why does the syntax for regular expressions include an "or" (union) operator but not an "and" (intersection) operator? <comment><USER2> FWIW, [http://adsabs.harvard.edu/abs/2008arXiv0802.2869G](http://adsabs.harvard.edu/abs/2008arXiv0802.2869G) says: "Similarly [to complement], when constructing a regular expression defining the intersection of a fixed and an arbitrary number of regular expressions, an exponential and double exponential size increase, respectively, can in worst-case not be avoided."

I found the 'greenery' project, which says, at [https://qntm.org/greenery](https://qntm.org/greenery) :

> Elementary automata theory tells us that the intersection of any two regular > languages is a regular language, but carrying out this operation on actual > regular expressions to generate a third regular expression afterwards is > much harder than doing so for the other operations under which the regular > languages are closed (concatenation, alternation, Kleene star closure).

The developer has code, which lets you do:

      >>> from greenery.lego import parse
      >>> print(parse("(ab{0,3})*") & parse("(abba)*"))
      (ab{2}a)*
      >>> print(parse("((ss*)t*)") & parse("((ss*)+(tt*))"))
      s+t+

I have no other experience with the code, but it was nice to know that such a package exists.

The author also wrote that it was "the most algorithmically complex thing I've ever implemented."

</comment><comment><USER3> A regex is one big implicit AND already. The OR is an exception to the normal rule.

/(abc|def)(123|456)/

You can read that as "(abc OR def) AND (123 OR 456)". The string "abc789" wouldn't match, for instance.

<comment><USER4> If I understand what OP means by "and", it doesn't mean "(abc OR def) AND (123 OR 456)" — it means "(abc OR def) FOLLOWED BY (123 OR 456)". Let's look at another example, with a hypothetical & operator:

       /(\D\S)+/
       /(\D|\S)+/
       /(\D&\S)+/

If you look at the string "b5 ", the first regex matches "b5", the second regex matches the whole string because all of the characters are either not a number or not whitespace, and the third regex only matches "b", because that's the only character that is both not a number and not whitespace.

<comment><USER5> \D is a subset of \S, so the \S accomplishes nothing (said another way, there is no character that matches \D that doesn't also match \S).

Secondly, there are very few intersecting character classes (sets) that I'm aware of, and in all cases, you could achieve the desired result more clearly in other ways.

Said another way: "AND" would just make regexes even harder to understand/approach, and that is almost always undesirable.

<comment><USER4> I was just trying to illustrate how the logic of AND differs from what was shown above, not give a useful example.

A more practical example might be something like

        /(10|22)(.*crab.*&.*apple.*)90/

in order to only match strings where the content between the numeric codes matches both "crab" and "apple" in any order.

To be clear, I don't know that it's useful enough to warrant inclusion in a regex engine. I'm just trying to provide a useful illustration.

</comment></comment></comment></comment><comment><USER6> Use this syntax for logical AND,

      (?=...)(?=...)

[http://stackoverflow.com/a/24102539](http://stackoverflow.com/a/24102539)

<comment><AUTHOR> This syntax is not supported by the tools I use. If we're going to add to the language, why not just add a true intersection operator? My question was meant to be more theoretical - what was the rationale behind incorporating union into the basic syntax, but not intersection, when regular expressions were first adapted to text processing?

<comment><AUTHOR> I do have awk available, which allows one to combine regular expressions using logical operators, but I'm interested in the historical and theoretical aspects of my inquiry, if any.

</comment></comment></comment><comment><USER7> AND is explicit in the groupings.

<comment><AUTHOR> Could you please clarify what you mean by this? Are you referencing concatenation as being a form of logical AND?</comment></comment>


Grubhub Could Still Be Charging a Fee When a Customer Calls a Restaurant - <AUTHOR> https://www.buzzfeednews.com/article/venessawong/grubhub-phone-order-call-fee-coronavirus <comment><USER2> Great, so Google is part of this con artistry too. This damages their brand. I am using search or maps to get the business's phone number and Google is actively participating in a deception. I consider it fraud. Google and Gruhub benefit from this deception.</comment>


Ars Technica's ultimate board game gift guide, 2019 edition - <AUTHOR> https://arstechnica.com/gaming/2019/12/ars-technicas-ultimate-board-game-gift-guide-2019-edition/ <comment><USER2> No DreamScape? [https://boardgamegeek.com/boardgame/231038/dreamscape](https://boardgamegeek.com/boardgame/231038/dreamscape)</comment>