Katy Perry's Dark Horse Lawsuit Makes Waves in Music Industry - <AUTHOR> https://www.cbc.ca/news/entertainment/dark-horse-music-industry-1.5235743 <comment><USER3> I wonder at what point similarities with past works becomes inevitable. There's only a finite amount of original music out there, especially if you're talking about the length of an average riff or motif, leave out a lot of the more extreme attempts of contemporary art music, and stick to what sounds pleasing in popular music genres. And the output of number of musical compositions seems only to be increasing. An interesting short story in this vein is [http://www.baen.com/chapters/W200011/0671319744___1.htm](http://www.baen.com/chapters/W200011/0671319744___1.htm)

A bit on the melodramatic side, but explores the same general point.

<comment> 52-6F-62 Punk rock would be a minefield. And that's all only come out of the blues (skipping some historical points) which relies heavily on "standards".

So many of the compositions along that tract are made up of three to five notes in a limited variety of voicings and arrangements.

I - III - V - <USER2>

Try Johnny Be Goode. Chuck Berry has his reputation but he could have pulled a move like this a large number of times by now [and somehow hasn't! (don't quote me on that, though)

I (4 Bars) - III (2 Bars) - I (2Bars) - V (2 Bars) - I (4 Bars)

Or something like that. But there's 90% of the song, repeated over.

<comment><USER4> Obligatory Axis of Awesome - 4 Four Chord Song Exmple

[https://www.youtube.com/watch?v=5pidokakU4I](https://www.youtube.com/watch?v=5pidokakU4I)

<comment><USER5> Rob Paravonian's Pachebel Rant I think predates this: [https://www.youtube.com/watch?v=JdxkVQy7QLM](https://www.youtube.com/watch?v=JdxkVQy7QLM)

</comment></comment></comment></comment><comment><USER6> Good video breakdown: [https://www.youtube.com/watch?v=0ytoUuO- qvg](https://www.youtube.com/watch?v=0ytoUuO-qvg)

<comment><USER7> The video is absolutely worth watching, but one of the more relevant bits is this:

> [...] in Dark Horse it's just the background texture for one of the verses. > It has the same musical function as a chord progression or a drum groove: it > serves to highlight the melody but it's not the song itself. Up until this > point it seemed like only melodies could be copyrighted in the composition > of song, however the recent court decisions surrounding Robin Thicke's > Blurred Lines and Marvin Gaye's Got To Give You Up has thrown all of this > into question.

> This is why the lawsuit demanded a trial by jury: because they wanted to > confuse non-musician non expert jurors with fancy music theory jargon.

He also specifically calls out the expert witness, saying:

> You're doing it in a fairly intellectually dishonest manner because I > sincerely doubt you would make the arguments that you made in court at [an] > academic conference for example, or you wouldn't write them down in a > scholarly article, because your academic peers would absolutely eviscerate > you for saying some of those things -- and yet in front of a jury of your > peers you said them.

<comment><USER8> I don't understand why a Jury of Peers [1] wouldn't be comprised of domain experts and not just random people off the street. And it seems like having domain knowledge is likely to get one NOT selected for jury duty. Can any lawyers chime in on this (even armchair hn lawyers)?

[1] [https://criminal.findlaw.com/criminal-procedure/what-is-a- ju...](https://criminal.findlaw.com/criminal-procedure/what-is-a-jury-of- peers.html)

<comment><USER9> I always assumed it's peers as opposed to superiors. I.e. Your jury is not the king and queen but other commoners like you.

<comment><USER10> A peer of the defendant?

Because the defendant was a musician in this case.

<comment><USER11> The standard of "substantial similarity" in copyright law depends not on how an expert would see things, but on how a reasonable average person would see things. Juries are not perfect, but a jury of random people is probably the most qualified way to determine the question "would average people see these two things as substantially the same."

Leonard French—a YouTuber and actual copyright attorney—does a good job covering the legal standards and issues here: [https://youtu.be/t-tsw6Z4eHc](https://youtu.be/t-tsw6Z4eHc).

<comment><USER10> > a jury of random people is probably the most qualified way to determine the > question "would average people see these two things as substantially the > same."

A jury of random people can be confused and then convinced by lawyers. That's the way they like it, and that's the problem with jury selection - they chose people specifically because they are not knowledgeable.

<comment><USER12> Whats better? Experts that can be purchased? Elected or appointed judges who owe favors to those who elected or appointed them?

<comment><USER10> > Whats better? [...lots of straw-men...]

To start: Not removing jurors simply because they're knowledgeable or have critical thinking skills.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER13> I posted this the other day. Absolutely terrible, IMO. A minor artist can take millions from an artist who releases a song with a passing resemblance. You can hear similarities in SO many songs. And SO many songs are inspired by others - great art is full of inspiration.

I dread where this ends up.

<comment><AUTHOR> This sort of feels like the start of the music business's version of patent trolls. I think this verdict devalues music and hampers creativity.

<comment><USER14> New business model: have an AI generate every chord progression in every tempo, release the "songs" on your own label, and sue everyone who releases a song after you.

<comment><USER15> Is there a legal counter to this? Frivolous copyrighting?

<comment><USER14> There are tons of legal counters, almost any of which would be a slam dunk case for having the AI-generated company's copyright revoked and the company disbanded.

But patent trolls are smart enough to have blazed a trail where you sue small time record labels that can't afford to fight you in court and are willing to settle. Any fight that goes to court, you just dismiss the suit to avoid losing and setting a precedent.

</comment></comment></comment></comment></comment><comment><USER16> In the early 1990s I worked for Jimmy Cauty and Bill Drummond's record label, back when they were dominating the UK and European pop charts as The KLF ([https://weirdestbandintheworld.com/2011/10/20/the- klf/](https://weirdestbandintheworld.com/2011/10/20/the-klf/)).

One day we received in the mail a cassette tape and a letter from a law firm representing a composer or publisher (I can't remember which) of a famous Broadway soundtrack from the 1960s. The letter accused the KLF of infringement. The cassette contained one of the songs on the Broadway soundtrack, an instrumental section of which repeated a three note riff that sounded a lot like the same three-note sequence from one of the KLFs biggest hits. The rhythms and song structures were otherwise nothing alike.

It didn't seem like an obvious example of copying, and it was quite possible it was a coincidence or some obscure influence on The KLF or their core musical collaborators, who would have been youths when the Broadway soundtrack was released.

"Are you going to fight this?" I asked the label's president.

The answer: "No."

From The KLF's perspective, it wasn't worth a long, expensive legal fight they might lose. The KLF had been burned before for rampant unauthorized sampling in a previous incarnation of the band called The JAMMs, as described here: [https://en.wikipedia.org/wiki/1987_(What_the_Fuck_Is_Going_O...](https://en.wikipedia.org/wiki/1987_\(What_the_Fuck_Is_Going_On%3F\))

Also, the label president didn't say it, but potential bad press could have also been on her mind. At the time, the KLF had the British music press eating out of their hands, and a public legal fight could change the narrative of the KLF as being brilliant pop iconoclasts to something less favorable.

</comment><comment><USER17> > "If you can be liable for allegedly copying a three-note phrase, I think > that really dampens the creative output of artists," said Keyes.

I don't like where this is going. Those songs have key differences in percussion and partly in melody too, as explained in the graphic. This sets an interesting precedent, to say the least.

<comment><USER18> in the graphic 16 notes are green (meaning the same) so saying 3 is not accurate at all

<comment><USER19> Three _different_ notes. Repeating the same note is _rhythm_ , but the allegations are about _melody_.

<comment><USER18> three different tones, but you are ignoring the most important aspect of modern music: rhythm. a modern music piece uses only a few different tones

</comment></comment></comment></comment><comment><USER20> Just listening to both songs once, I didn't notice anything close.

What I'm curious about are the cases where it is extremely obvious that one song is based on another, and no one says anything.

Case in point: "Jolly Roger" by Adam and the Ants [1], from 1980. This is extremely similar to "The March of the MacGregors" by Ennio Morricone, from the 1966 film "Seven Guns for the MacGregors" [2].

It's not only the same melody, "Jolly Roger" is also largely the same arrangement.

[1] [https://www.youtube.com/watch?v=hc_- vSIy3fY](https://www.youtube.com/watch?v=hc_-vSIy3fY)

[2] [https://www.youtube.com/watch?v=N5JQ1JTsJ4k](https://www.youtube.com/watch?v=N5JQ1JTsJ4k)

</comment><comment><USER21> Anecdotal, but I'm a big fan of Lecrae's music and Joyful Noise was probably the biggest hit in Christian hip hop of the time. First time I heard Dark Horse on the radio I laughed and told a friend that they totally ripped off Joyful Noise, it was very obvious since that riff is the focal point of the song. Don't know if I agree with the lawsuit but the similarities are there.

Joyful Noise: [https://youtu.be/jTLeHuvHXuk](https://youtu.be/jTLeHuvHXuk)

Dark horse: [https://youtu.be/0KSOMA3QBU0](https://youtu.be/0KSOMA3QBU0)

</comment><comment><USER22> This is direct fallout from the Marvin Gaye Estate/ Robin Thicke "blurred lines" lawsuit mentioned in the article.

Those songs aren't that similar (the jury didn't even hear both songs if I remember correctly), and after the verdict wasn't corrected on appeal the stage was set for more of these. The "easy money" angle of results (5 million to the estate of a singer for a 70s song.... just get lawyers).

It seems likely we are going to see more and more of these lawsuits. Sort of a sad state.

</comment><comment><USER23> What a schadenfreude for me. I see most people are saying it sucks, I for one can cheer on. Screw the music, movie and media industry. Tons of laws and garbage we suffer on the internet today is because of them and their lobbying efforts. There approach towards everything has been litigation hell, let them feel their own pain.

<comment><USER24> While I share your amusement that the publishing industry is hoist with their own petard creators will inevitably be targeted as a result of this decision. That really troubles me. I see this decision as a weapon for the publishing industry.

"Pirates" have been held-up as being publishers' enemies. I think this decision will serve to make independent creators a bigger target. Machine learning-based analysis of music along w/ this decision will create a distopia where independent musicians are hit with automatically-generated copyright infringement extortion letters. It'll be similar to the letters "downloaders" received a few years ago, except that the infringement will be the act of creation rather than "consumption".

My hope is the lunacy of this decision will spark more conversation about reigning United States copyright back into some semblance of its original form. I've been pining for that conversation since the creation of the DMCA, though, and it shows no sign of coming. The litigation wasteland that this decision will create might make that happen, but, then again, it might just serve to cement the idea that you can't be a legitimate content creator w/o going thru the traditional publishing system (and all the rent-seeking that comes with it).

</comment></comment><comment><USER25> The problem is using juries for this. Music copyrights should be adjudicated by a panel of professional musicologists, funded by a cut of the awards. That way there's at least some consistency. The concept would extend to other disciplines.

Of course a purely functional improvement to governance is a political nonstarter in today's environment.

<comment><USER26> It was the opinion of a professional musicologist, presented to a jury, that resulted in the lawsuit being successful. At least with a jury there's a chance of calling bullshit, even though it did not occur in this case.

<comment><USER27> Jury in pretty much any case is a subpar solution. However, patent or copyright ones are total bonkers to be decided by jury panels.

Leaving justice outcome to chance is rather weak way to 'benefit the society'.

</comment></comment></comment><comment><USER28> I wonder if you could make an AI program to make a bunch (millions)of unique melodies a minute or less and publish them somewhere like YouTube. Then just scan new hit songs and see if they somehow copy what your computer generated..

</comment><comment><USER29> On the plus side, looking forward to the coming total legal meltdown of country music

<comment><USER30> To say nothing of reggae, dubstep, etc. etc.

<comment><USER31> Noise should be fine tho

<comment><USER32> Actually noise is the most homogeneous of all...

</comment></comment></comment></comment><comment><USER33> How was Flame able to demonstrate that they heard the song before?

Remember that independent discovery is a valid defense a against a copyright infringement claim. Katy Perry's legal defense was that nobody had ever heard Flame's music. The CBC article doesn't seem to indicate how the jury was convinced that Katy Perry's team knew of the other song, except that "obviously they heard it because it was awarded a Grammy". Huh? Is that all it took?

</comment><comment><USER34> I was wondering, does Shazam can differentiate well between these two songs? I'm not entirely sure about the internal working of it, but was curious to know how these pattern recognition apps can help in this.

Also, reminds me of the Silicon Valley where Richard was able to disproof Patent troll by using his music/search app.

<comment><USER35> The technique you're looking for is Acoustic Fingerprinting [1]. There's a pretty easily understandable python implementation[2] of it if you're interested. In Shazam's case it is looking for peaks in the sound's spectrograph, so I don't think it would likely confuse two songs based on melody alone. It would have to be very close in rhythm, melody, and possibly even be in the same key.

[1] - [https://en.wikipedia.org/wiki/Acoustic_fingerprint](https://en.wikipedia.org/wiki/Acoustic_fingerprint) [2] - [https://github.com/worldveil/dejavu](https://github.com/worldveil/dejavu)

</comment></comment><comment><USER36> I would be more sympathetic to Katy Perry's case here if I could ever get past the fact that a major part of "Firework" sounds so much like Erasure's "Always".

I'm all for creative freedom, but massively profitable pop music labels shouldn't be able to just crib the essence a catchy melody and make it the whole basis of their song just because the person who wrote the original version wasn't that popular. If it really was a coincidence in this case, then it's unfortunate, but it isn't life-changing to someone as well-off as her. If the original composer really was copied from though, actually being credited and received recognition as deserved, could be life-changing, so I don't blame him for suing.

</comment><comment><USER37> Incredible to think that rap music would never have existed or become a popular genre if this law existed in the 80's and was weaponized against artists.

Ultimately this will strengthen a labels position as signed artists will be "allowed" to be influenced by songs the record label already owns.

Anyone else will be stuck in court.

There's a fantastic documentary on this called Copyright Criminals that breaks down this area and just how intertwined the entire music industry is as artists are naturally inspired by each other. The conclusion from this film was that innovation and creation will then come from places where these laws do not exist.

</comment><comment><USER38> Does this mean Axis of Awesome will finally get paid for Four Chord Song?

[https://m.youtube.com/watch?v=5pidokakU4I](https://m.youtube.com/watch?v=5pidokakU4I)

</comment><comment><USER39> A similar case involving Kraftwerk was decided recently. [https://www.billboard.com/articles/business/8524267/kraftwer...](https://www.billboard.com/articles/business/8524267/kraftwerk- european-court-justice-ruling-metall-auf-metall) "European Court Rules In Favor Of Kraftwerk In 20 Year-Long Copyright Dispute"

</comment><comment><USER40> This reminds me of Under Pressure and Ice Ice Baby, the latter also having to pay up.

<comment><USER41> In that case, the baseline was directly ripped off, it wasn't just "sounded similar", it was an actual sample.

<comment><USER42> If sampling to create new art were better protected, then cases like this wouldn't even come up. The documentary "Good Copy Bad Copy" was talking about this 12 years ago

<comment><USER43> Yeah I think we're long overdue to reevaluate what copyright means in music. I think it should be much closer to how we treat fashion where anything but a direct rip off is 100% fair game (and that is even more about trademarks because the actual design can't be copyrighted).

</comment></comment></comment></comment><comment><USER44> This is literally how musicians create new music. When I was in high school jazz band, every improvisation had pieces of popular jazz songs in it. That's just how it works.

</comment><comment><USER45> This is obvious a case of "be careful what you wish for" the music industry has itself to blame for this. I hope it will get more ridiculous over time.

</comment><comment><USER46> After getting away with ripping off "All the things she said" it must be pretty galling to get dinged by this one.

</comment><comment><USER47> I don't know much about music, but there's only so many ways to arrange notes and of those ways there are far fewer ways to arrange them that sound ... pleasing to the ear.

What happens when all the pleasing ways are copyrighted and owned by some sort of Pantone for music?

Good grief what are we becoming?

</comment><comment><USER48> Good artist copy. Great artist steal. However, in this case, I'm hard pressed to believe it's a case of either.

<comment><USER31> I think the main problem is that the artist would have to at least be good.

</comment></comment><comment><USER49> What about sampling and remixes?

</comment><comment><USER50> There is only so much someone can do with a particular set of notes and instruments. It is sad for the arts that a three note riff is the basis of lawsuits.

</comment><comment><USER18> 16 notes in the same sequence? that's too big of a coincidence

<comment><USER51> It's not 16 notes but three notes. C B A. The first note is repeated for a measure, the second is repeated for a half note, and the third is played once. Yes, it's undoubtedly a coincidence. See [https://i.cbc.ca/1.5235857.1564861522!/fileImage/httpImage/i...](https://i.cbc.ca/1.5235857.1564861522!/fileImage/httpImage/image.jpg_gen/derivatives/original_780/dark- horse.jpg)

<comment><USER18> the repetition is super important. in modern music the rhythm is more important than the variety of tones. the same rhythm and the same tonal distance is too big to be a coincidence

<comment><USER51> How large do you think the design space is?

Technically, it's enormous, maybe 8^15 possible melodies.

But what about _good-sounding_ melodies? That drastically reduces the space.

What about _memorable_ , good-sounding melodies? Most melodies aren't catchy, so that limits the space some more.

What about _culturally-appropriate_ , memorable, good-sounding melodies? It likely wouldn't make sense to use a Turkish opera melody in a pop song. Genres typically encompass a small space of melodies (e.g. Blues, Boogie Woogie).

What about such melodies that follow a particular rhythm, or match the vocalist's range, or that follow a desired chord progression?

After all this is considered, you're probably down to only a million combinations. But there are a billion songs out there...

<comment><USER18> the range of notes in pentatonic scale is only five. but the rhythms (the important part of modern music) have a lot more combinations. katy perry's writers used the exact same rhythm with the same notes, which is highly improbable

</comment></comment></comment></comment></comment><comment><USER52> Finally, these major label "artists" have to compensate the creatives they steal from.

<comment><USER53> Which "creatives"? Cause it looks like he ripped it off himself - he should probably get sued.

[https://www.youtube.com/watch?v=0ytoUuO- qvg](https://www.youtube.com/watch?v=0ytoUuO-qvg)</comment></comment>


The Mark of a Masterpiece - <AUTHOR> http://www.newyorker.com/reporting/2010/07/12/100712fa_fact_grann?currentPage=all

<comment><USER2> A great example of investigative journalism. Read this piece of "dead media" and consider how many blogs you know with similar quality of reporting.

It's interesting that his mention of "proprietary image-processing method" in the benign beginning did trigger an alarm in my head before I got to the second part.

<comment><USER3> The level of work that David Grann put in is a marvel. He generates an idea for a story, researches it, and has enough for an article. He has a queasy feeling about a subject of the piece (not unlike the art connoisseurs might have), and investigates further. He turns up lots of dirt on Biro, enough to put his claims into doubt. He has enough to write an article. But he doesn't! He investigates the fingerprints further, and finds expert analysis that indicates that the fingerprints are phony. Not writing the article yet, he takes all of his evidence back to Biro to examine his reaction.

The editor also deserves credit. This is a damning article, but there is no evidence of sidestepping or evading the truth. All of the extra research was extremely time consuming, and when the author yelled, "This guy is a fraud!", he wasn't told to publish what he had, he was told, "ok, show me the evidence."

"The man who keeps finding famous fingerprints on uncelebrated works of art" takes on a sinister tone after reading the article

<comment><USER4> Arrgh! I think I just accidentally downvoted this comment while zooming on the iPad.

<comment><USER5> It has been corrected for.

</comment></comment></comment></comment><comment><AUTHOR> Talk about a story in two parts - they build Biro up as an inventor and maverick art-and-fingerprint expert who identified a new Leonardo, and then tear his credibility to shreds!

And I was glad that Gladwell's _Blink_ didn't get a mention.</comment>


Ask HN: How do you meet founders if you haven't built anything cool? - <AUTHOR> Here is Sam's recommendation - https://www.youtube.com/watch?v=scPm4VMklBI&list=FLek5ilbSRojwKI_I80lVH6g&index=5<p>How do you do that if you haven't built anything cool? I honestly just want to make more friends. I can code a little in Swift/Objective C. <comment><USER2> One of the things you could try is planning a lunch or dinner or trek or some other activity that is enjoyable and sort-of informal-ish. Invite 1-2 of your founder friends and ask them to bring 1-2 of their friends along. Make sure the group doesn't become so large that members subdivide into subgroups. This way not only you, but your other founder friends can expand their network. And, if on the off chance that someone doesn't get along well with someone else, they still have someone in the group to enjoy the fun activity with.

<comment><AUTHOR> Working on this :)

</comment></comment><comment><USER3> Go to meetups, conferences, etc and just mingle and socialize. Just talk to people and get to know them. There's a monthly lunch and learn near me for infosec and the number of people you meet and network with in a semi formal setting is great. People show up who aren't even part of the industry but want to learn. Has definitely lead me to expanding my network of contacts.

<comment><AUTHOR> I'm not a fan of huge groups but thank you for the suggestion. I also recommend watching Sam's response in the details above about Meetup's.

</comment></comment><comment><USER4> Metro areas will have meetups for entrepreneur/startup folks, eg Seattle has 200+! Find some you like and go, hand out cards. Try a few and refine, attend each a few times, to get a good evaluation of the group. Friend up on LI/Twitter,etc, build network, find possible founders, lather, rinse, repeat

<comment><AUTHOR> I appreciate your feedback. My issue with this approach is that you come across as everyone else who's just trying to "network" as Sam mentioned in the youtube link I provided.

I think a better approach is to learn how to code and build something to show others. That way you come across as someone who genuinely wants to be a friend.

I found tutorials to learn C# for free here if it helps others - [https://unity3d.com/learn/tutorials/topics/scripting](https://unity3d.com/learn/tutorials/topics/scripting)

</comment></comment><comment><USER5> There are a few ways.

1\. Join a large company that recruits extraordinary talent, but has many startup founder alumni (e.g. Google, Facebook, Uber).

2\. Join a startup, work for a few years. After an exit, start a company with your colleagues.

3\. Go to school and meet your cofounders there.

<comment><AUTHOR> 1\. Moving to Google is an option. 2\. Already did. 3\. Not an option ATM, thank you tho!</comment></comment>


Php 5.4 vs 5.3: is really fast and with less memory leaks  - <AUTHOR> http://news.php.net/php.internals/57760 <comment><USER2> Why is the title talking about memory leaks? The listed benchmark is comparing "PHP/O+ memory usage". Memory usage isn't memory leaks.

Just because something uses a lot of memory doesn't mean it's leaking memory. Only when that used memory never gets freed or reused you can talk of leaks.

The linked benchmark isn't taking this into account /at all/. It's just measuring memory usage.

From my own experience with PHP, while it's using a lot of memory at times, it doesn't usually leak it, unless you produce code that cause it to leak (circular references before the GC days), but that's really the programmers responsibility.

<comment><USER3> The last time I suffered a huge memory leak in PHP was with HTML Purifier on PHP 5.2. It was impossible to process more than a few documents at a time, even from the CLI, because HTML Purifier seemed to leak every byte of memory it used. Lots of circular references.

With PHP 5.3 with the new GC and the latest version of HTML Purifier, there is no memory leak anymore. PHP has come a long way since the days when you had to respawn Apache processes every 500 requests.

</comment></comment><comment><USER4> Minor nitpick: the fact that something uses more memory does not mean that it "leaks", using the common definition of the word "leak".

</comment><comment><USER5> I'm a bit suspicious that Wordpress is listed under req/sec, but is missing from the memory usage table. Hopefully an oversight... unless Wordpress is still the king of memory hogs :)

<comment><USER6> Wouldn't surprise me, the whole thing is fairly monolithic and tightly coupled.

</comment></comment><comment><USER7> Is "Zend OptimizerPlus" any form of an opcode cache?

Ah it is indeed an opcode cache, just wasn't familiar with it as a commercial product

[http://files.zend.com/help/Zend-Server- IBMi/optimizer_plus_c...](http://files.zend.com/help/Zend-Server- IBMi/optimizer_plus_component.htm)

Good to see the performance boost is maintained with an opcode cache and not negated.

<comment><USER8> I'd much rather see this with APC benchmarks.

I mean, that's _supposed_ to be the native Opcode Cache with PHP!

My WAMP distro (<http://www.devside.net/server/webdeveloper>) is switching to it, as it's finally stable enough to use in production (eAccelerator had it beat for some time).

Also, Zend Optimizer only works with PHP as a non-thread-safe / FCGI process in PHP 5.3, so there goes it's use under the prefered Windows mod_php setup (Windows handles threads really well). The only time you want to use FCGI on Windows is if there are serious memory leaks.

It's hard to ignore Windows as a PHP paltform considering it's the _majority_ of the webdev segment for PHP and about 1/3 of production for PHP.

<comment><USER9> .. It's hard to ignore Windows as a PHP paltform Wait - What? I use both Windows and _Nix, and have always moved to_ Nix for better speed and security. Do you have links to this statistic? I would prefer to use 64Bit, but there is no current support for it in PHP.

<comment><USER8> People from Apache, PHP and MySQL have published stats (in conferences and points) that show the Windows and Linux deployment figures for downloads, development work, and production deployments, over the years.

The majority of dev work (like local website development and testing) with Apache, PHP, and MYSQL was under Windows. 1/3 of production work was also Windows. This was several years ago and I have seen these numbers increasing in Windows favor.

<comment><USER10> Where do they get those stats from? Most people deploying or developing on linux will get the packages for all of those things from their distro.

<comment><USER11> Even as early as 2003:

<b>Although PHP is universally thought of as implying Linux, Apache and MySQL, nearly 7% of PHP sites [when counting by ip address] run on Windows. This has doubled over the last year</b> (from Netcraft: [http://news.netcraft.com/archives/2003/08/30/php_growing_sur...](http://news.netcraft.com/archives/2003/08/30/php_growing_surprisingly_strongly_on_windows.html) ).

PHP on Windows grew much more later on, what with Microsoft even making several specific changes to IIS et all to accommodate it better.

</comment></comment></comment></comment></comment></comment><comment><USER12> In our PHPCR tests, it looks like PHP 5.4 is about as fast (or slightly slower) than 5.3, but uses between 25% to 50% of the memory. Note however that this is with heavy usage of compiled PHP extensions like midgard2.

</comment><comment><USER13> "Less" memory leaks -- would that be the same number of memory leaks but each of them smaller, or does the author actually mean _fewer_ memory leaks?

<comment><USER14> When I was in medical school, I ran into this level of pedantry all the time, especially on the surgical services (We don't "do" surgery, we "perform" surgery; we "do" operations!). Or maybe it's the other way around. Either way, it made me a little sad. Consider ignoring all the literal misappropriations you encounter daily and simply listen to people. It makes for a much more pleasant experience.

<comment><USER15> English _less_ is to _fewer_ as JavaScript == is to ===. So if you see someone misuse a term, consider _informing_ them.

// less is for general mass, fewer is for countable nouns; == is for general comparison, === is for comparable things of the same type

<comment><USER11> Miguez de Icaza explains here why you're not getting laid (much):

<http://tirania.org/blog/archive/2011/Feb-17.html>

<comment><USER15> I suspect personal attacks do more harm to one's social standing than weighing in on an already in progress grammar discussion.

</comment></comment></comment></comment></comment><comment><USER16> The title of this post is amusing. Only "less memory leaks"? None would be nicer. (Also "fast" is relative. When you're known for one of the slowest interpreters getting large performance increases is easy. It would be better to bench against something that really is fast, like the JVM for example.)

<comment><USER17> Python & Ruby are both slower interpreted languages than PHP, for all their lovely syntax.

The JVM is slower to develop for, and when probably 50% of projects on the web are stuff that's built in less than 2 months, using the JVM adds too much complexity where it really isn't needed.

If you want speed (almost) as good as the JVM without using an interpreted language, use Node. Unless of course you only know the one language from your CompSci days..

<comment><USER18> > Python & Ruby are both slower interpreted languages than PHP

Source? That's not what the Programming Language Benchmark Game says...

[http://shootout.alioth.debian.org/u64/which-programming- lang...](http://shootout.alioth.debian.org/u64/which-programming-languages- are-fastest.php?calc=chart&v8=on&python3=on&yarv=on&php=on&perl=on)

Although that's probably without an optimiser at all.

<comment><USER19> Maybe that should be qualified "in a web context".

<comment><USER20> Still a big [citation needed]. Compare with something like cached Mako templates in Python and I seriously doubt it's competitive.

<comment><USER17> Compare it with a micro-cached Varnish or nginx .. caching is outside of the "speed" parameters. Of course, you could take a look memcached if you want :)

I can't find the reference I remember but it fits roughly with the link posted (the scale seems to match the max times rather the average times). The differences were tiny but the order was PHP, Python, Ruby if I remember correctly (PHP was in front, PR may have been switched).

I'll try get a link but I doubt i'll find it.

<comment><USER20> In the case of Mako at least, caching doesn't mean caching in the way you mean it. It's more akin to opcode caching in PHP, saving the actual python code generated from the template, not the result. Just saves from reparsing the template every time it's rendered, but the actual template logic still runs.</comment></comment></comment></comment></comment></comment></comment>


LWJGL: Lightweight Java Game Library 3 - <AUTHOR> https://www.lwjgl.org/ <comment> le-mark Writing Java game applets was what got me started in software development back in the late 90's. Game development in Java was always a huge challenge for several reasons; perceived (and real) slowness, slow startup, distribution, etc.... But putting a game in a web page anyone could play was really cool back then (to me at least). Lwjgl was always one of the marquee projects. The lack of value types[1] in Java has always been a hindrance, in particular when doing vector math calculations for physics simulations. And now all these years later, Java still doesn't have them. It's been many years since I've checked, but once there were several gifted indie game developers using Java, Notch being the biggest success story from that scene. Other than Minecraft, I've not heard of any popular games implemented in Java, has there been any?

[1] [https://en.wikipedia.org/wiki/Project_Valhalla_(Java_languag...](https://en.wikipedia.org/wiki/Project_Valhalla_\(Java_language\))

<comment><USER2> lack of value types makes many games a pain in the ass to do performantly.

basically anyone thinking they might want to use Java could use Monogame instead and have a much better time.

<comment><USER3> I've used both libgdx/LWJGL and MonoGame extensively. They're both fine. MonoGame has its own set of problems (a byzantine build systems, spotty platform support, etc.).

Practically, not having value types is not really the kind of problem you'd expect it to be. Cache coherence with something like Mono or the JVM is less of a priority (nice-to-have but let's be real here) and a bunch of arrays of primitives looks uglier than C# structs but it mostly comes out in the wash.

</comment></comment></comment><comment><USER4> Now that the JVM is a multi-programming language platform, I hope things like this become more popular.

Kotlin, Frege, Clojure, Fantom, Ceylon, JRuby, etc. There's a language for everyone. So building more value into the JVM with projects like that would be really great.

The JVM is probably the most advance VM currently, and hopefully it'll just keep getting better, maybe faster startups with the new module system, hopefully in java 9 they add value types, etc. All to say, I think more people should look into the JVM as a platform for the future.

<comment><USER5> More popular? It's already used in the second most popular video game of all time.

<comment><USER6> Minecraft?

</comment></comment></comment><comment><USER7> For any unfamiliar, this is the library Minecraft was originally built on. I've used it to develop some graphically intensive programming tools myself, and have always been pleased.

</comment><comment><USER8> We've all heard the poor story with Java in regards to performance, and the arguments for/against it, so I'm not going to dwell on that. A significant amount of work is being done on the GPU now more than ever anyway.

At least in my experience, I've had a great deal of fun working with LWJGL and it is a pleasure to use. It's very unopinionated and doesn't try to force you into any sort of specific structure. On top of that, Java + LWJGL hide a significant portion of the cross-platform mess that you inherently see in this field. No matter where you stand on the issue, setting up a project to build and run cross platform, and managing its dependencies is a pain point in C/C++. Add a trivial maven configuration once and you're good to go the majority of the time. Having a mature package manager is also something that you shouldn't ignore.

No one should shy away from writing a game if all they're familiar with is Java/some JVM language. It's a gradient between choosing the right tool for the job and premature optimization. Here's a video of what looks to be a dead project, but still serves as a decent tech demo of a nice looking game running on the JVM [https://www.youtube.com/watch?v=eM_bABrFERs](https://www.youtube.com/watch?v=eM_bABrFERs) .

</comment><comment><USER9> I got into software development through a LWJGL project, and it changed my life.

<comment><USER10> Serious? If so I'd love to hear the story.

<comment><USER9> I had a crazy idea re: a multiplayer roguelike engine that would be scriptable. It was a pipe-dream, mostly due to my skill level, and I abandoned it after using it as a hobby for roughly 3 years when it became clear it needed a massive rewrite. However attempting it taught me an insane amount OOP and modern development practices. The Java client rendered with LWJGL, and it was very easy to start playing with basic concepts for graphics and voxel worlds. Without the ease of LWJGL the project wouldn't have taken off at all.

I went from doing general IT to being a professional software developer, and the first thing I ever starting coding was that engine.

</comment></comment></comment><comment><USER11> Is there any good books or tutorials on how to get started in games development? I would love to take it as a hobby but the tutorial scene is so saturated I find it hard to cut through the chaff, so it would be nice if someone from this community could recommended a good starting place.

<comment><USER2> handmade hero. [https://handmadehero.org/](https://handmadehero.org/)

<comment><USER12> I wouldn't recommend handmade hero, especially to someone who's just getting started. First two weeks of handmade hero could be skipped by just using SDL, rather than rolling out Windows specific windowing, rendering and audio.

</comment></comment></comment><comment><USER13> Great library, particularly for beginners who have done a Java 101 course. But why is it being posted now?

<comment><USER14> Because version 3 just got released.

<comment><USER15> Has it not been a while?

<comment><USER16> A year ago.

</comment></comment></comment></comment><comment><USER17> Is there a way to use LWJGL for mobile games?

<comment><USER15> Absolutely. A somewhat higher level library building on lwjgl (2) called libgdx has good documentation and examples on it - The Google Pixel live wallpapers (3D models of places, with some parallax effect) are written using it. There is also a framework called flixel building on top of libgdx, which also has demos for Android.

<comment><USER18> I think Ingress (by Niantic Labs) is a more prominent project using LibGDX

</comment></comment></comment><comment><USER19> Worth checking out LibGDX if you're i to Java game dev also.</comment>


Emotion Detection in Games? - <AUTHOR> http://www.gamefromscratch.com/post/2015/11/15/Emotion-Detection-in-Games.aspx <comment><USER2> I've been on-and-off interested in facial expression for a while, and can't help but feel that 'the emotion tool' is kind of flawed.

Unless there's been a groundbreaking shift in the last 12 months or so, this software will be using the Facial Action Coding System to recognize muscle contractions which are then interpreted as 'emotions'. FACS is an amazing tool (can't recommend learning it enough if you're interested in this stuff), but it still relies interpreting the context of the expression to determine an emotion. It's a notation system for expressions, not an identification system for emotions.

There's an off chance that their algorithm has crowdsourced their data which can be even worse because the emotions we display and the ones we feel aren't always the same. For example, I may force a smile to cover fear. FACS training can take 100+ hours because a lot of heuristics for identifying expressions need to be unlearned.

It's a bit of worry when [https://www.projectoxford.ai/demo/emotion#detection](https://www.projectoxford.ai/demo/emotion#detection) uses mostly posed photos to demonstrate their software. The third photo contains perhaps one smile that shows signs of being genuine, the rest seem to be posed (I'd need higher resolution to be sure). If this third photo was accurately reading their emotions (cf. expressions), then the results should not be that they are happy.

Replacing the emotions with names for expressions would make me feel a little more comfortable about using this: 'happy' with 'smile', 'angry' with 'glare' and so on. But then it seems a lot less useful so I see why they've described/marketed it the way they did.

</comment><comment><USER3> We have been using similar software ([http://www.noldus.com/human-behavior- research/products/facer...](http://www.noldus.com/human-behavior- research/products/facereader) ) in our research into human observation in context aware computing. On the sensing side it would be interesting to see how this compares. In our experience, the observation goes quite well as long as you have enough pixels to work with, and good lighting on the face. Whether you can get that depends on the use case. For instance, when we worked with our national public broadcaster on capturing and deriving emotion and intention awareness in television viewers, things are fine in a 'laboratory' setting, but 'real living room conditions' where you get dark grainy low quality images from typical television 'Skype' cams were far more challenging.

</comment><comment><USER4> Direct link:

[https://www.projectoxford.ai/emotion](https://www.projectoxford.ai/emotion)

</comment><comment><USER5> If this is meant for players, I wonder how effective it would actually and how much of the gaming population it would actually affect.

When I'm reading, watching a movie, or playing a game, I'm generally pretty stone-faced with little to no actual reaction to reflect what I'm thinking as I consume the media in question.

<comment><USER6> But the fact that you are stone-faced during those activities is due to the fact that there is no reaction. If you jump on Skype you're not stone-faced anymore, as you know that you can express yourself through face reactions. If your game were to get more interesting whenever you put a bored face, that would _very quickly_ end tour stone face! You would not even notice that you're asking for more difficulty, your dopamine shots will do the work for you :)</comment></comment>


Article claims hand rolled C code can perform dot product faster than Numpy - <AUTHOR> https://medium.com/analytics-vidhya/beating-numpy-performance-by-extending-python-with-c-c9b644ee2ca8 <comment><USER2> I don't know how the inner-workings of NumPy work...but this article seems quite plausible because it's making use of parallel computation in order to achieve a faster result.

The title just seems to imply skepticism over what looks to be a legit approach.

<comment><AUTHOR> Ya. The article seems plausible, but NumPy uses Blas/Lapack which can do parallel computation, so thats what is confusing about it to me.

</comment></comment><comment><USER3> > Have you ever wondered how does NumPy perform its complex computations so > fast? The secret is that it uses lower level programming language — C.

I thought NumPy used the LAPACK libraries at its core, which are written in Fortran:

[https://en.wikipedia.org/wiki/LAPACK?wprov=sfla1](https://en.wikipedia.org/wiki/LAPACK?wprov=sfla1)

<comment><AUTHOR> Same. Which is why this confuses me.

</comment></comment><comment><USER4> Very neat idea. Seamless interplay between layers like that is nifty to think about.</comment>


Writing for Beginners - <AUTHOR> http://www.nicolefenton.com/build-2013/

<comment><USER2> This was a nice read, thanks.

I always find it useful to remember this when sitting down to write: the word "essay" comes from the French, meaning "to attempt." Montaigne used it to mean, he was making _an attempt_ to put his thoughts into words. In some sense, it is like saying you write as a beginner: you start with only your thoughts -- no idea of the outcome -- and go from there.</comment>


20 Years of Impulse Tracker, Part 3 - <AUTHOR> http://roartindon.blogspot.com/2014/10/20-years-of-impulse-tracker-part-3.html

<comment><USER2> Ah Impulse Tracker, how I miss you. These days I'm running Renoise, a modern tracker (crossed with a regular DAW), and I adore it, but theres a special place in my heart for Impulse Tracker (and another tracker that I used to run on Windows 95, but I can't ever remember what it was).

<comment><USER3> Here here! Recently I went back to remaster my old .IT tracks using Schizmtracker (an impulse-clone, which I'm running in Gentoo Linux) and it made me so nostalgic!

Three cheers for Jeff Lim's fine work, and what a champion for releasing the source!!

</comment></comment><comment><USER4> Partially related, the afternoons I enjoyed with friends creating music on the Amiga with ProTracker.

Anyone remembers Amigas being on sale with ProTracker running as the demo software?

</comment><comment><USER5> "License

License for this source code is pending."

Sort it out!</comment>


Ask HN: Review my startup mojoLive (CV/Career Management) - <AUTHOR>

We're looking to change how you go about managing and maintaining your professional CV. One of our goals is to encourage you to keep your CV up to date so you (and everyone else) won't forget how awesome you are.
Now that we've built out the profile management functionality, we're looking to build a recommendation/suggestions engine to help point you in the right direction in terms of career moves. This could be anything from attending specific conferences and meetups, reading certain books, learning new skills, all the way to leaving your current employer.
http://mojolive.com/profile/corey <comment><AUTHOR> Direct link to my example profile: <http://mojolive.com/profile/corey>

Direct link to the homepage: <http://mojolive.com>

Direct link to an early beta invite so you can skip the private beta waiting line a bit quicker, courtesy of myself: <http://mojolive.com/invite/corey>

So, what do you think? Any and all feedback is welcome. If you see anything glaring, please consider filing it on GetSatisfaction :D

</comment><comment><USER2> I like the design. On the sample profile, I like the timeline tab.

Your landing page seems a little confusing to me. Your tagline says "If life is a game, then level up..". ok so the product lets you create a profile and earn caps/points to represent career progression? Worth a shot but not sure how useful mixing the 2 will be. Just my 2 cents.

<comment><AUTHOR> Thanks :)

I'd say the caps are both a representation of your progession as well as a motivator; encouraging you to keep your profile up to date with new information. I'd love it if we could get people to remove the somewhat taboo nature of frequently updated their public CVs even when they aren't looking for a change in scenery. While caps/points aren't necessarily the answer to that, I believe that providing suggestions for personal growth and improvement would be strong motivators.

</comment></comment><comment><USER3> I love the design. Whichever framework you are using I suggest a cleaner URL for user profiles. For example for me I would like to have www.mojolive/frantzdyromain</comment>


Lizard Squad teen gets no-jail sentence for 50,700 fraud, harassment charges - <AUTHOR> http://arstechnica.com/tech-policy/2015/07/lizard-squad-teen-gets-no-jail-sentence-for-50700-fraud-harassment-charges/

<comment><USER2> If this guy was like, 13, maybe this would be ok. But 17... he should be punished.</comment>


Chinese pilot project could bring electronic tracking to all cars - <AUTHOR> http://www.reuters.com/article/us-autos-china-tracking-idUSKCN0WB0XF <comment><USER2> Some U.S. states are doing away with license plate registration stickers; instead, police cars will automatically scan every license plate they see and check the owner for expired registration and any other violations or crimes. In other words, police will investigate everyone they encounter (on the road), with no probable cause or other requirement.

The technology to do it is not news; it already exists and will improve. Only laws can protect you.</comment>


TellHN: My Weekend Project (GAE Reverse Caching Proxy) - <AUTHOR> http://github.com/symkat/SymPullCDN

<comment><USER2> Cirruxcache has been around for a while, and works great: <http://code.google.com/p/cirruxcache/>

</comment><comment><USER3> Cool, but there are similar projects out there. E.g. <http://cdn- cloud.appspot.com/>

Not sure that response times from app engine are that nippy compared to a 'proper' CDN.

What would be cool would automatically distributing images via google's image serving CDN. You can use the get_serving_url method in app engine to return a CDN enabled url for any image in the blobstore. Its super fast and allows dynamic image resizing.

</comment><comment><USER4> Another project to enable people to use GAE's generous free account without actually developing on GAE's platform:

<http://github.com/viatropos/queuable>

This one sends a request to Heroku as often as once a minute, to avoid paying for Heroku workers.

<http://heroku.com/pricing>

</comment><comment><USER5> pretty cool. might be worth making the uri a key_name to make the lookup faster:

[http://code.google.com/appengine/docs/python/datastore/model...](http://code.google.com/appengine/docs/python/datastore/modelclass.html#Model_get_by_key_name)

discussion on efficiency difference of get vs fetch:

[http://groups.google.com/group/google- appengine/browse_threa...](http://groups.google.com/group/google- appengine/browse_thread/thread/b0a837a47bf0cc36)

</comment><comment><USER6> I wrote something similar a while back to offload parts of legacy sites on Google App engine.

<http://github.com/silas/gaem>

</comment><comment><USER7> You should be using <http://trafficserver.apache.org/> 80k req/sec (small objects)

</comment><comment><USER8> Not a fan of the ginormous block comments. Why do people like these?</comment>


The Automated Fake Album Project - <AUTHOR> https://fakealbum.interviewstreet.com/facemash/

<comment><USER2> This should really be choosing between two albums generated from the same (artist name, title, cover art), rather than completely different configurations.

I'm finding it difficult to judge fairly when the art, title and album name are different.

<comment><USER3> That was how we originally built it, but we found it less fun to rate in testing compared to this version. Hopefully the increased votes-per-person outweigh the loss of fidelity.

<comment><USER4> I think you guys should've just shown one picture at a time and allowed people to upvote or downvote it.

<comment><USER5> Those sort of contests usually aren't as statistically significant.

</comment></comment></comment></comment><comment><USER6> The biggest problem is font colours that are unreadable on the background. Obviously that must be an algorithm-too-far for most of the competitors.

<comment><USER7> Unfortunately, for our team, we had to revert to a version of our generator that was about 5 hours old due to a issue with one of the library dependencies. We didn't catch this until last minute, so basically all of our low-level pixel analysis got thrown out the window.

</comment></comment><comment><USER8> It appears possible to compare two album covers that were created by the same generator (some of them have pretty distinct styles). Not sure if this was considered, or how it factors into scoring.

<comment><USER5> I was thinking the same thing - I got a lot of them in a row. If they're using standard techniques for ranking win/loss competitions, they're artificially decreasing the sigma (not entirely correct but, think of it as a margin of error) for no reason.

Funny, a website based on giving out coding problems didn't realize that coding bug. Then again, I've experienced tons of bugs when I was playing with their main software, so I'm not surprised.

<comment><USER9> As someone who competed in this contest, that wouldn't be the only bug. There was a lot of bugs in the submission/grading process - so much so that my team got frustrated enough to leave early.

<comment><AUTHOR> We had glitches agreed because the kind of problems we introduced were the first for us - Game simulation. We have been doing ACM style programming contests which works brilliantly, this was an experiment. We know our mistakes and this will rock next time. Thanks for participating.

</comment></comment></comment></comment><comment><USER10> There's bias introduced based on the visual appearance, some of the fonts used are terrible - and (as mentioned) the contrast.

</comment><comment><USER11> Can't... choose...! <http://cl.ly/3L0d0F1A0r0E3z231R0X>

Fun contest - I'd love to see the winners when this is all over :)

</comment><comment><USER12> I made this generator a couple of years ago... <http://www.makemyalbumcover.com/>

</comment><comment><USER13> This is my favorite so far...

<http://imgur.com/XY6Uj>

</comment><comment><USER14> Nice URL naming..../facemash

</comment><comment><USER15> I saw this "generate album art 'algorithm' " on a 4chan thread three years ago when I used to frequent there. Brings back memories.

</comment><comment><USER16> Reminds me of the Album cover generator. <http://albums.demozoo.org/>

</comment><comment><USER17> as someone who finds it easier to produce sounds than to give them useful and meaningful names after the fact, i love this. if i found a version that can deterministically generate a full ID3 tag of generated info given any mp3 input, i'd use it daily to fight the scourge of files named lkajf_39_q.mp3 in my output bin.</comment>


The Future of Firefox and Why It Matters - <AUTHOR> http://curiousinsanity.blogspot.com/2009/07/future-of-firefox-why-it-matters.html

<comment><USER2> _"Firefox is a culture. We look at every stat, every figure, fervently. When the alphas and betas are announced, we run them in parallel along with our regular Firefox version to track bugs and discus"_

I would love to see some actual data supporting his claim. I also don't see anything concrete on why the the future of Firefox matters</comment>


Software startup roles - <AUTHOR> http://codeincomplete.com/posts/software-startup-roles/ <comment><AUTHOR> I wonder if one person can do all three, particularly in the context of Saas. Atleast in the start.

Would love to listen from someone who has been doing all three himself/herself. How did you manage it. Any particular use case where its possible/easier. Cases where its difficult..</comment>


Cloud Save - <AUTHOR> https://chrome.google.com/webstore/detail/omiekjeapoonbhiemenfoccbdpeagdah?hl=ko#

<comment><USER2> By our very own antimatter15[0] who happens to also be 16 years old now. Has also released lots of other cool things for the web like the Ajax Animator[1] and an excellent article[2] on the whole VP8 vs H.264 video wars that clears up a lot of misinformation. His Github[3] is _very_ impressive.

[0]: <http://news.ycombinator.com/user?id=antimatter15>

[1]: [https://chrome.google.com/webstore/detail/ginffkjapdobanedcb...](https://chrome.google.com/webstore/detail/ginffkjapdobanedcblllenliboglpkp)

[2]: [http://antimatter15.com/wp/2011/01/the-ambiguity-of-open- and...](http://antimatter15.com/wp/2011/01/the-ambiguity-of-open-and- vp8-vs-h-264/)

[3]: <https://github.com/antimatter15>

</comment><comment><USER3> English version: [https://chrome.google.com/webstore/detail/omiekjeapoonbhieme...](https://chrome.google.com/webstore/detail/omiekjeapoonbhiemenfoccbdpeagdah)

Or just delete the "?hl=ko#" at the end of the orginal url. It had me really confused for a while.

</comment><comment><USER4> Great to see that the Chrome Web Store's URLs aren't any more usable than when it launched.

"Oh, my app? It's at [https://chrome.google.com/webstore/detail/omiekjeapoonbhieme...](https://chrome.google.com/webstore/detail/omiekjeapoonbhiemenfoccbdpeagdah)

<comment><USER5> No wonder they want to hide the URL bar in the new Chrome!

</comment></comment><comment><USER6> Doesn't seem to include a filename - there's talk of not needing a file system, and while you can save data without a filename, it's harder to load the correct data if you don't know what it is.

Or... could searching be the alternative? And perhaps tagging? Like gmail for docs. If your document includes a title that's unique, then that string is sufficient to identify it. You could also list them all with a very brief preview, if you've not quite sure what you're looking for (browsing).

<comment><USER7> Right-Click -> Save As -> Dropbox will let you change the filename and Save.

</comment></comment><comment><USER8> Didn't work for me with Dropbox. Saved something to my Dropbox, but the file it saves wouldn't open properly.

<comment><USER9> Ditto here with PDF => Google Docs

<comment><USER10> Worked fine for me. Tested with that same PDF, and with a random JPG, both with gdocs as the target. This extension will be absolutely awesome on my CR-48.

</comment></comment></comment><comment><USER11> A neat idea, but somewhat unnecessary for me personally as a DropBox user. I can just save locally to disk and it will appear in DropBox.

<comment><USER7> It is useful if you're using a computer that is not yours.

<comment><USER12> A computer that isn't yours that you have to download an extension and provide a user login?

<comment><AUTHOR> If you login to the chrome browser, all of your extensions are automatically installed.

</comment></comment></comment></comment><comment><USER13> Works fine for me. Just uploaded the Quantum Entanglement PDF from the front page of HN onto my Google docs. I can see this being big.

</comment><comment><USER7> <http://news.ycombinator.com/item?id=1446801> :-(

</comment><comment><USER14> Is this Googles answer it iCloud? A context menu?

<comment><USER14> Ugh, I wish I could delete the above comment. I made it as I was in a hurry to leave.

Is this Google's answer to iCloud? A context menu? _

<comment><USER15> You weren't being downvoted for the grammar — rather for not bothering to click through or at least hover over the link and find out that's not actually on Google.com, but rather on a Google Site for antimatter15.</comment></comment></comment>


Google AI begins battle with humanity's best Go player tonight - <AUTHOR> http://arstechnica.com/information-technology/2016/03/google-ai-begins-battle-with-humanitys-best-go-player-tonight/ <comment><USER2> Link to the stream: [https://www.youtube.com/watch?v=vFr3K2DORc8](https://www.youtube.com/watch?v=vFr3K2DORc8)

Starts at 7:30 PM PST, 10:30 PM EST.</comment>


How we split test our job listing titles with Optimizely - <AUTHOR> http://visual.ly/blog/javascript-lovers

<comment><USER2> (Addressing the owners of visual.ly)

I hope that "Chance to beat baseline" column isn't a naive measurement of "confidence" that's updated on every iteration.

I've mentioned this several times in threads such as these, but if you're blindly applying basic statistical analysis to a partially completed test, you are badly misinforming your customers.

Please read this: <http://www.evanmiller.org/how-not-to-run-an-ab-test.html>

Of course, if you are taking these results into account I apologise for mentioning this again and wish you every success.

</comment><comment><USER3> One must love conclusions like this: "Even though the results aren't statistically significant (...), we were able to learn ..."

</comment><comment><USER4> Hilariously cool. Hopefully this report is the nail in the coffin of the "ninja" job posting fad.

Buttttt, since you're measuring clicks and not job candidates hired (the actual important metric) is there really a relevant takeaway from the data?

Hard to quantify but if this is proper conversion rate testing you've got to make sure you're optimizing around the proper metric.</comment>


New Hampshire Bill Backs Bitcoin for State Taxes - <AUTHOR> http://panampost.com/belen-marty/2015/02/04/new-hampshire-bill-backs-bitcoin-for-state-taxes/

<comment><USER2> I grew up in New England, so I can provide a bit of relevant context:

New Hampshire is a very quirky state, politically, in a number of ways. In a sense, New Hampshire state government looks a lot more like city-level or county-level government in many other states.

Compared to other states, state representatives are far more likely to "average citizens" instead of career politicians - just everyday people who have decided to do as single term in state government, and have little to no plans to run again. This is very frustrating for the leadership of both chambers, since it makes it very difficult to whip votes! On the other hand, it arguably makes it easier for elected officials to buck party lines and vote their conscience, if they so choose.

In addition New Hampshire does not (last I checked) have direct-vote ballot initiatives the way California does, but it does make it much easier for citizens to propose legislation. Whether or not this legislation gains traction or actually passes is a separate matter. Look no further than the long history of repeated attempts at marijuana policy reform in NH to see just how difficult it can be to predict which bills will end up gaining traction[0].

As a result, it's very common to see bills that are proposed and supported by a small contingent of backers, but never end up going anywhere. This bill may or may not end up passing, but just keep this context in mind whenever you read news about a bill being brought to the NH legislature with only a handful of supporters.

[0] This issue is actually a particularly fascinating case study in NH government, because NH is a very libertarian-leaning state, and it baffled reform advocates for the longest time that they had such difficulty in getting NH to pass relatively uncontroversial reform measures.

<comment><USER3> New Hampshire has one state representative per 3,291 citizens, which means each representative is being elected by an extremely small electorate. This is the smallest in the country. The US average is one state representative per 60,000, and the largest, California, is 465,674 people per representative.

The state is also subject to huge rapid swings in the majority. In 2008 Republicans won 43.5% of the seats, in 2010 Republicans won 72% of seats, in 2012 they won 45% of the seats, and in 2014 they won 60%.

While you could certainly argue that there are some benefits to this system, This American Life had a good episode on some of the cultural problems that this system has led to (see Act 2) - [http://www.thisamericanlife.org/radio- archives/episode/478/r...](http://www.thisamericanlife.org/radio- archives/episode/478/red-state-blue-state)

</comment></comment><comment><USER4> Reminder: New Hampshire Porcupine Festival is one of the best technology events of the year in the USA. Tech talks, hackathons, firing guns w/ 3D-printed magazines, homeschooling, mesh networking, all sorts of drones / FPV vehicles, and on and on. And you can buy just about anything with cryptocurrency, from organic vegetables to an AR-15.

If you haven't been, it's really a must-see phenomenon.

[http://porcfest.com/](http://porcfest.com/)

<comment><USER5> ... and of course Bitcoin 101 is one of the first talks, right after "Outdoors safety". Oh man, wish I could go, wrong part of the world for me.

<comment><USER4> Also, the 'official' schedule is only the 4 main tracks (plus music and kids activities, etc). In addition, there are several DIY tracks at the various camps, including the "Alt Expo," which has many of the more advanced tech talks (about a quarter mile from the main pavilion as the quadcopter flies).

There was also a 'pirate tent' which had a PGP-keysigning / local beer exchange party that was absolutely over-the-top.

Dozens of - probably over a hundred - NH beers (many of which were single keg or smaller) for trade only (no money exchanged hands) and a pretty serious PGP web. Quite a freaking sight.

June can't come quickly enough! :-)

I'll actually have a newborn at that time, so I'm not 100% sure of my ability to go this year.

<comment><USER6> I have thought about going for years. But now that you mention PGP-keysigning, that's clinched it. I had no idea. I guess that's not the sort of thing you put on a normal flyer.

</comment></comment></comment></comment><comment><USER7> Would Bitcoin be stable enough to accept and maintain? Serious question. It seems like the state would have to immediately exchange the Bitcoins for dollars, which costs money and would have a very specific impact on the market (maybe that's the point?).

<comment><USER8> I suspect they would cash out immediately. After all the taxes are denominated in USD. The article mentions that the state wouldn't pay any fees though, that's the part I'm really curious about.

<comment><USER9> The bill specifies that the plan must include the use of "an appropriate third party payment processor that will process bitcoin transactions at no cost to the state."

This doesn't mean that there would be no fees, it means that the payment processor could only charge fees to the taxpayer, not the State.

<comment><USER10> BitPay currently offers this to merchants and non profits so it may not be that much of an ask.

</comment></comment></comment></comment><comment><USER11> I don't see how this doesn't cost us money unnecessarily, otherwise I wouldn't really care one way or another if we start accepting internet fun bucks.

The State is still going to do business in USD; looking at the volatility of USD/BTC exchange rate, exchange fees and infrastructure/training, I don't see how this is anything but a loosing proposition.

<comment><USER9> > I don't see how this is anything but a loosing proposition.

Its a winning proposition to the third-party payment processor mandated to be contracted by the bill, and -- presuming the method of accepting bitcoins is that the payment processor takes bitcoins and provides the state with USD -- its not a losing proposition for the State so long as the bitcoin costs are set at a level such that the state always gets the full USD value of the taxes and fees.

I don't see how its really a losing proposition.

<comment><USER12> So what happens when there is a massive fluctuation in price and that third- party payment processor declares bankruptcy? It's not like this is being backed by a major financial institution.

We're talking about a currency that could lose half it's value in a matter of hours. And when their total tax revenue is $3.2 BILLION, what third party processor is going to be able to soak up the potential losses?

<comment><USER13> Q: "So what happens when there is a massive fluctuation in price"

A: Nothing, as all bitcoins would be instantly converted into US Dollars removing all currency volatility risk. I directly made sure that was in the bill to address that concern.

Best, Rep. Schleien Prime Sponsor of New Hampshire House Bill 522

<comment><USER14> What can 'instantly' possibly mean in this context? The same day? minute? millisecond? Triggered by how big of a change?

<comment><USER10> Using a payment processor like BitPay would allow this. Essentially you click to pay in bitcoin, you redirect to the BitPay site, you pay them bitcoin and they transfer the USD value to the recipient (in this case the state).

So an individual could pay $10k in bitcoin and the state would receive $10k in USD. BitPay currently offer their service for free that would meet these requirements.

[https://bitpay.com/pricing](https://bitpay.com/pricing)

so to answer your question instantly means instantly.

<comment><USER12> So who is giving BitPay cash for the coins instantly? Are there literally buys just chomping at the bit, even when the market is in a downward trend, to buy coins from BitPay, for cash, _instantly_ after they put them up for sale? At some point the piper has to be paid, and if it isn't a large financial institution, I'm still not seeing how this plays out. There has to be someone to soak up the massive loss in value...

As far as I can tell, BitPay has less than $100 million in investment, I don't see how that even comes close to covering the risk.

<comment><USER10> Bitpay uses exchanges such as Bitstamp to sell the coins immediately. There are plenty of buy orders there to cover these purchases. Note that this doesn't mean every tax bill is due to be paid by bitcoin but individuals could if they wanted to.

Perhaps you are unfamiliar with bitcoin, I'm not sure. For every seller on a exchange there is a buyer. Yes if there happened to be a flash crash this may be an issue but generally this hasn't been a problem. As an example, bitpay will lock in the dollar value for a 10 minute period, as long as you pay in that window they guarantee the retailer the USD value and the buyer the BTC price. To achieve this they would keep some funds in btc all the time, then when a sale like this comes in they sell the equivalent amount (or a part of it) to hedge against future fluctuations.

I think you are thinking that the states entire tax revenue would come via this method, currently I doubt there are enough BTC in that state to achieve that outcome. But anyway this proposal is feasible as it currently stands.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER13> It has just been announced that the hearing for this bill will be on February 12, 2015 @ 11:30 AM EST at the NH Legislative Office Building in Room 2002

If any of you would like the opportunity to speak on behalf of this bill -- your help would be welcome!

</comment><comment><AUTHOR> Link to the bill: [https://legiscan.com/NH/text/HB552/2015](https://legiscan.com/NH/text/HB552/2015)

</comment><comment><USER15> What's the benefit? It seems like it would just add more complexity to the tax process and therefore increase the cost of the entire process.

<comment><USER13> Benefit:

Less Costs to the State (lower transaction fees) + $0 set up fee. More secure than credit card transactions.

Safer/More Secure + Cheaper = Benefit

\---

And yes completely constitutional. Nobody is issuing currency. It's simply providing a means of payment that is getting converted into US Dollars through a third party payment processor. BitPay was mentioned as a company that provides those services above.

Hope this clarifies.

Eric Schleien Prime Sponsor

</comment></comment><comment><USER16> IANAL... is this even legal given that the US Dollar is the only official currency of the United States?

<comment><USER17> the hilarious thing is that it is TOTALLY unconstitutional.

Article 1 section 10 provides that "No State shall... make any Thing but gold and silver Coin a Tender in Payment of Debts."

Of course, striking down the act by virtue of its violation of this provision would also expose the fact that dollars are no longer gold and silver, either, and thus are also unconstitutional as legal tender for the states.

<comment><USER18> But the state isn't making Bitcoin legal tender, and states don't make dollars legal tender, either.

"Legal tender" is something that can be used to pay debts and that a creditor is legally required to accept. Dollars being legal tender is something instituted by the federal government.

States, on the other hand, must accept dollars to pay state taxes (as that's legal tender), but they can also accept anything else they like in lieu of dollars (if both the state and the person paying taxes agree on this alternate payment), whether that's Bitcoins, chickens, or performances of the Thriller dance.

<comment><USER17> I stand corrected, but will keep the karma points.

</comment></comment></comment></comment><comment><USER19> There is a big body of literature demonstrating how the value of money is derived from the state's ability to levy and enforce taxes[1]. In fact, this is the basis of most sovereign currency regimes with floating fx. In these regimes, governments issue currency out of thin air and levy taxes to force its ubiquity. However, at the U.S state level(CA,FL,TX,etc) and in the case of the Euro(France,PIGS,etc)at the national level, these entities are constrained by tax revenue and ability to borrow same as a household or business. Thus, instead of bitcoin, which is backed by nothing, why not have states issue their IOU's to pay state liabilities but also accept those IOU's to retire liabilities to the state. Naturally, this idea is in lieu of federal aid which has been withheld to states because of austerity politics.

[1] [http://neweconomicperspectives.org/2011/06/modern-money- theo...](http://neweconomicperspectives.org/2011/06/modern-money-theory- primer-on.html)

</comment><comment><USER20> It's probably a bit too soon for something like "pay my taxes in bitcoin"... but ultimately a government transacting in a transparent fashion such as this _MUST_ be a step in the right direction? No?

<comment><USER21> I don't believe this would add transparency. All they would likely do is immediately exchange it for USD. I don't think they would keep it in a wallet where we could keep track of their expenditures.

<comment><USER22> What follows is unlikely:

If the majority of taxpayers were to pay in Bitcoin, revenues would be transparent, which is a step toward a free and open public audit of budgets.

<comment><USER23> You know that you can get the NH budget and audit it yourself, right now, right?

<comment><USER22> Free and open were the key points. Since the transactions are public they are independently verifiable. I am not accusing the state of lying or fraud, but this would be a check on that possibility.

Again it is not likely that Bitcoin would ever make up enough of the tax revenue for the thought to even be relevant. It was only in response to the transparency question.

</comment></comment></comment></comment></comment><comment><USER24> Someone could create a POS machine that rendered taxes directly to the state at the time of sale or in batches. Also people could discover a company's sales figures by watching the blockchain.

<comment><USER10> You could see how much was being paid to the state but not by whom. This adds transparency at the state level as payments would be made to a known address, however where the payments are from would be anyone's guess.

<comment><USER24> I think you could figure it out pretty quickly by tracking/making your own purchases.

<comment><USER10> Not if the merchant give each buyer a new bitcoin address (best practice), did not store all their bitcoin on a single address (best practice) and used any sort of exchange to hold coins at any point (common practice) all of these would obfuscate the merchants actual holdings, sales etc. Enough so that it would be difficult for a competitor to track you accurately enough for it to be worth the effort. Plus if they did have any other bitcoin income or savings it would cloud the situation even further.

Once you are one step (transaction) away from the known address i.e. The one you sent coins to in order to track them, you have no way of knowing or proving that the merchant controls any subsequent address.

If for example bitpay handled their transactions you would see funds sent to bitpay, if the merchant kept 100% in btc but only got paid out by bitpay weekly then how do you know what was sent to the merchant?

</comment></comment></comment></comment><comment><USER25> Can state taxes currently be pain in New Hampshire with anything other than USD?

</comment><comment><USER26> The right way to do it, as far as I can see, is to allow people to report their taxes in whichever form of money they prefer. US Dollars, Euros, gold would all be a valid numeraire to use when reporting your current assets and income to the IRS. And the currency you choose to report your taxes in, is the currency you pay taxes in.

This is just currency competition. Nothing more than that. The ability to freely choose which currency you want to use to measure value.

Whether bitcoin should be considered alongside dollars, yen and silver is an open question. If people are allowed to report their taxes in bitcoins, they can really shoot themselves in the foot. But, personally, I'm generally speaking not in favor of the government preventing people from shooting themselves in the foot.

Say, for example, I choose to report my taxes in bitcoins. I currently hold 10 bitcoins and $1,000. Later, the price of bitcoins in dollars (BTCUSD) falls from 225 to 50. This means that one dollar is now worth 1/50 bitcoin instead of 1/225 bitcoin. I then buy 20 bitcoins using the $1,000, and -- because I report my taxes in bitcoins -- it means I've realized a capital gain of ($1,000×(1/50) - $1,000×(1/225)) = 20 BTC - 4.4444 BTC = 15.5556 BTC, on which I pay capital gains tax. The _bitcoin value_ of my dollars has increased (before 1/225 bitcoin per dollar, now 1/50 bitcoin per dollar), so I have to pay bitcoins to the IRS if I convert dollars into bitcoins, after the bitcoin price falls.

This just shows that bitcoin really isn't ready to be used as proper money. Proper money is a money you would report your taxes in. Bitcoin just isn't stable enough in value yet.

<comment><USER27> Why would the state want to take on the complexity of dealing with the situation you described, just to encourage "currency competition"?

<comment><USER26> I don't think the complexity would be that great. It's not like different tax rules apply, it's just a different numeraire. Now, remember, people reporting their taxes are not forced to change anything, they are just given the opportunity.

I guess the basic reason I promote currency competition is that I think people have the right no use whichever money they prefer. And in order to not give preference to the national currency, produced by the central bank, it must be possible to report ones taxes in another currency/money.</comment></comment></comment>


Encrypted, deduplicated remote backups - <AUTHOR> http://www.stavros.io/posts/encrypted-offsite-backups/

<comment><USER2> What's wrong with tarsnap? [http://www.tarsnap.com/](http://www.tarsnap.com/)

 _Added in edit: I see that people are saying it 's expensive, and I appreciate that. When I bundle it into my considerations of how much I spend on other things, what I get, and my level of confidence in the service, it seems a good deal to me. In the interests of full disclosure, I don't actually use anything like this, as I have a storage solution provided for me. But when I did the sums a while ago, I decided that tarsnap would be my choice if I needed to make one. For people to say it's expensive is a useful additional data point for me. Thank you._

<comment><USER3> Expensive? Don't we have patio11 regularly telling Colin (Percival) that he's not charging nearly enough?

<comment><USER4> By telling him to charge more, what he's saying is more or less to drop the consumer market and sell to bigger businesses.

It would probably be better for Tarsnap's financial health, but it wouldn't make it a better product for people like the OP who just want to save pictures of their dog.

</comment></comment></comment><comment><USER5> What about Duplicity [1] ? Seems to hit all the right points - encrypted, remote, based off of differentials.

There's even a front end of it called Deja Dup [2] being distributed by the GNOME team and used in Ubuntu.

[1]: [http://duplicity.nongnu.org/](http://duplicity.nongnu.org/)

[2]: [https://wiki.gnome.org/Apps/DejaDup](https://wiki.gnome.org/Apps/DejaDup)

</comment><comment><USER6> Personally I use crashplan, its more expensive than your max price requirement if you use their cloud services, but I also back up way more data (300+GB), mostly family photos+videos. Also, since its unlimited storage I don't really care if I suddenly have a couple of extra gigs to store after xmas or whatever. Oh and finally I can use the same app to backup to my home server so basically everything is backed up locally and remotely with one app and is encrypted/deduplicated.

I used to use Arq and it worked great but then the backups became too big.

EDIT: forgot you wanted opensource... oh well... anyway this works for me.

</comment><comment><USER7> I'm disappointed there's no comment here from tptacek telling you off for that decidedly dodgy-looking mac-then-encrypt, or the timing side channel in your mac verification. He must be slipping :)

<comment><AUTHOR> Haha, the MAC-then-encrypt should be fine, since it's stored files, and how is anyone going to use the timing attack when the script runs on trusted hardware anyway? :P

</comment></comment><comment><USER8> Meeting most of the requirements on that list, I have found Arq[1] to be a great backup solution on OS X. It stores encrypted, incremental backups on S3 and although the client itself isn't open source, the data format is[2]. The company also maintains an open source recovery tool[3]. The only requirement that isn't met is cost, because S3 costs about $60/yr for 50GB.

[1] [http://www.haystacksoftware.com/arq/index.php](http://www.haystacksoftware.com/arq/index.php)

[2] [http://www.haystacksoftware.com/arq/s3_data_format.txt](http://www.haystacksoftware.com/arq/s3_data_format.txt)

[3] [http://sreitshamer.github.io/arq_restore/](http://sreitshamer.github.io/arq_restore/)

<comment><USER9> Happy Arq user here, but the cost of S3 is why I have it store in Glacier instead. It all really depends how (and how often) you plan on accessing the backups.

</comment></comment><comment><USER10> If you're using a Linux-based system [http://liw.fi/obnam/](http://liw.fi/obnam/) might also be a good choice.

<comment><AUTHOR> I tried that on 500 KB when I was testing it and it took a few minutes to back things up. I'm not sure if it's linear, but I wouldn't want to try the full set if it's that slow...

<comment><USER11> obnam's speed is mostly determined by file size and latency. With large files and low latency, it can push several megabytes a second off my laptop.

It's pretty excellent in every other respect.

<comment><AUTHOR> Hmm, I'll give it another shot, thanks. Does it only transfer the diffs too, or does it have to read everything off the remote server?

<comment><USER12> [http://liw.fi/obnam/ondisk/](http://liw.fi/obnam/ondisk/) attempts to answer that in some detail. In summary: Obnam splits file data into chunks and stores each chunk only once. It looks up chunks using checksums, and does not need to download the chunk data again (unless you turn on verification mode to protect against checksum collisions). Obnam does download B-tree nodes, though, but they should be a fraction of the size of the file content data.

<comment><AUTHOR> Thank you for the summary, it sounds pretty reasonable. I will read the full document now, hopefully it will elucidate even more.

</comment></comment></comment></comment></comment></comment><comment><USER13> Really nice utility. More developers should dip their toes into crypto and develop applications like this. :)

A comment in the code about why it's OK in your case to use the same key for MAC and encrypt would be useful. I think you're fine. See here: [http://security.stackexchange.com/questions/37880/why- cant-i...](http://security.stackexchange.com/questions/37880/why-cant-i-use- the-same-key-for-encryption-and-mac)

I needed to implement deduplication in my system. Since I controlled the server, I developed a slightly more elaborate system which doesn't have the limitation of a predictable IV (predictable from the encryption key).

So in my system, I derive two keys from the same passphrase (PBKDF2 with different salts). I encrypt as usual with unpredictable IVs. When uploading, the HMAC of the plaintext and SHA-256 of the ciphertext are both loaded.

To check for duplication, the client asks if a certain HMAC is already present. And it's an error (at the server) to upload multiple ciphertexts with the same HMAC.

<comment><AUTHOR> The vulnerability in that post is for using AES-CBC with AES-CBC-MAC with the same key. I'm using AES-CBC and HMAC-SHA512, which should be okay. The design was reviewed by cryptographers and was given a green light, plus I tried to use as little custom crypto as possible for this exact reason :)

</comment></comment><comment><USER14> I feel that the main problem with online backups is simply a matter of bandwidth. I have in excess of 3 TB of data and even if I only backed up things I considered _critical_, it would still be so much that it would take a week to upload and cost me hundreds of dollars of data overages. Such is Canada.

It's very telling that I'm even considering this, but if there existed a backup service where I could mail them a hard drive to load my data initially, and then upload only incremental changes, I would be all over that. Of course, uploading videos and such would still be out of the question.

<comment><USER15> "if there existed a backup service where I could mail them a hard drive to load my data initially"

Crashplan provide this option. I've never used that specific part of their service personally, but I've been a satisfied customer of their unlimited family plan for several years.

<comment><USER16> Right. See the "Seeded backup" section here: [http://www.crashplan.com/consumer/details.html](http://www.crashplan.com/consumer/details.html)

</comment></comment></comment><comment><USER17> On a slightly larger scale, we work with customers to do encrypted logical database backups using GPG and s3/Glacier.

Works pretty well, and we're able to de-duplicate because we keep local copies and make use of hardlinking. A bit of logic around s3cmd to look for hardlinked files before uploading takes care of the remote de-duplication (which isn't realistic after the files are encrypted).

Not quite as easy to adapt to non-linux machines or as practical for smaller files, but it's still quite useful.

</comment><comment><USER18> Can encbup be used for automated backups? Seems like it's using symmetric encryption, so that the passphrase would need to be entered or passed as an argument on each run.

Not sure if it meets all your requirements, but duplicity [1] has support for asymmetric encryption via gpg pub/priv key pairs.

[1] [http://duplicity.nongnu.org/](http://duplicity.nongnu.org/)

EDIT: just noticed the article mentioned duplicity as insufficient.

<comment><AUTHOR> You can specify the passphrase on the command line, but it's less secure. Automated backups are my use case, so that's what it's meant to be used for.

I wanted to also add GPG encryption, but I'd be unable to store the key locally, so I couldnt find a way to get it for subsequent backups. I'll have to see how duplicity does it.

</comment></comment><comment><USER3> Another option might be Cyphertite. I have no direct experience with it but I love the browser made by the same group (Xombrero).

[https://www.cyphertite.com/](https://www.cyphertite.com/)

Not clear to me from a quick overview of their site if they do de-duplication.

<comment><USER4> Yes, they do deduplication. I'm using Cyphertite for some of my backups. Works fine, and the pricing is a bit more convenient than Tarsnap for home users.

</comment></comment><comment><USER19> _EncFS in reverse mode with rdiff-backup would pretty much be ideal, but EncFS currently has two bugs that prevent this from working._

Does anyone know what this refers to? It sounds like a winning combination to me.

<comment><AUTHOR> Two things, one doesn't store the encfs.xml file in the reversed directory, so it doesn't get backed up automatically, and the other, more important (for my use case) is that there's no way to make multiple directories appear under one (symlinks are exposed as encrypted/broken symlinks). This means that you can only back up one dir per repo, which I found too constraining.

</comment></comment><comment><USER20> Boldshare matches your feature list exactly. Client code will be open source. Beta in November: [https://boldshare.com/](https://boldshare.com/)

<comment><USER21> > Client code will be open source.

On the link you provided I found the following:

"Parts of the programm relevant for security and networking actions will be open source."

"Parts of the program" might not do it for everyone (me included). Will anyone be able to audit the full source code of the client and compile it themselves, like e.g. tarsnap? Otherwise I fear the usual trust issues arise.

If I missed some information at your linked site which says the entire client will be open source, then please correct me.

<comment><USER20> You can still tell what exactly happens. Two separate processes might be used: one for crypto + network which is open source, the one manages synchronisation (which is the secret sauce of all cloud-sync services, if it works really good).

Updated the FAQ: [https://boldshare.com/?lang=en#faq](https://boldshare.com/?lang=en#faq)

<comment><AUTHOR> You won't know if the other process is transmitting your key, though.

<comment><USER20> Communication between open and closed source processes runs via IPC. Since all the IPC functions are declared in the open source part, you can exactly check what data is exchanged between the processes -> You can see that keys are not transmitted.

<comment><AUTHOR> How can you check that the closed-source process won't ever read the key from the disk without elaborate contortions?

<comment><USER20> What should it do with it? It can't send it anywhere: Block network access for that process if you don't trust it.

Key won't be accessible on disk anyway, only in RAM during crypto and will be destroyed immediately afterwards.

<comment><AUTHOR> You can make it so that it will only store the key in RAM, but then you'd have to enter the key every time it launches, making automatic backups impossible.

Although, I agree, if you only allow the open source network access, AND can ensure that the key won't somehow be smuggled in the data the closed source process sends, you're probably fine.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER22> I'm surprised no one here has mentioned Bitcasa. They provide unlimited storage for $99/year, and everything is encrypted locally before being sent over the wire.

<comment><USER23> Not open source.</comment></comment>