Four in 10 Americans don't see retirement ever happening - <AUTHOR> https://www.bnnbloomberg.ca/retirement-four-in-10-americans-don-t-see-it-ever-happening-1.1269777 <comment><USER2> I don't mean to sound mean but it seems to me as a European that Americans value comfort and convenience over being prudent and thrifty. I hear stories from people on massive salaries yet struggling to make ends meet due to a lifestyle of extravagant food choices, car purchases and other material junk which is not necessary. The saving grace of all of this is the recent trend on the topic of FIRE- people who realise they don't need all that junk and prefer financial freedom over a life of servitude.

<comment><USER3> As an American, I'd say your statements have a grain of truth to them but you're probably not looking at the right demographic. The people with "massive salaries" barely make a dent in those statistics. Those numbers come from people in the middle and working class. I have a lot of sympathy for them, having been there myself a long time ago. It might not be their fault that their means are more limited, and being poor shouldn't have to mean a lifetime of unceasing self-denial. I don't begrudge anyone their occasional moment of (relative) luxury. On the other hand, going into massive persistent credit- card debt for the sake of having the latest phone or TV is just _crazy_ and it's a common syndrome. There's something very sick about a society that pushes that lifestyle on people who never got a good enough education to realize that there are better alternatives. It's predatory. So your criticism (if it was even that) is justified, but IMO misses the real point of _how we came to be that way_.

<comment><USER4> Nah it's definitely a thing. Generalisations are borne out of truth. Just look at all the waste ... Living far from work, driving alone in an Escalade or huge pickup 30 miles to work, cooling entire houses to 18C etc. It's in your face everywhere you look. Even the toilets are wasteful!

<comment><USER3> I'm not saying those things don't happen. I'm just saying they're the tip of the iceberg. The part below the waterline - the part that does the real damage - is the vastly greater numbers of middle-class and poor people, and the reasons why they behave the way they do. The glittery ice on top barely matters. The real problems are the advertising and finance industries which were way oversized since long before tech came along, an educational system that leaves most people vulnerable to their manipulation, and politicians who make the whole situation worse with their misguided (or venal) policy making. Maybe callous condescension makes some people feel better about themselves, but it's really not very helpful.

</comment></comment></comment></comment><comment><USER5> I'm one of the four, unfortunately. I fully expect to be working until I die or at the very least until I am physically and/or mentally unable. I'm starting to resign myself to that future and can only hope I continue to enjoy the work that I do.

</comment><comment><USER6> Personally I think the younger generation will rethink the entire notion of what retirement is. The stereotype of counting the days til 65 and then all of a sudden you're playing golf every day for the rest of your life is just comical.

<comment><USER7> That version of retirement is extremely modern (postwar-Great Society ish). A return to working life or poverty for seniors would be a return to form.

Until Social Security and Medicare happened most seniors lived in abject poverty. [https://www.nasi.org/discuss/2015/08/social- security%E2%80%9...](https://www.nasi.org/discuss/2015/08/social- security%E2%80%99s-past-present-future)

</comment></comment><comment><USER8> The majority of the remaining 6/10 have inadequate retirement savings. I believe the average 401k balance of 45-50 YO is between $96k to $108k.

<comment><USER9> Not disagreeing with you, but I don't actually know the answer to this question: what's the proportion of retirement savings that's in a 401k? I'd expect that someone with 108k in a 401k has a pretty substantial amount outside of it too, right?

<comment><USER8> Probably not. 45-50 YO are still to young to have pensions. The fact of having a 401k pretty much means no pension. Everyone I know with a traditional pension is 60+.

I'm lucky to come in on the tail end with a 401k and employer funded annuity, but any hires at my employer in the 21st century just have a 401k.

<comment><USER9> Right, I didn't assume pensions (tbh I'm young enough that defined-benefit pensions sound like a strange anachronism to me). I wasn't asking about retirement flows but rather retirement stock: I would have imagined that someone with that level of 401k savings would also have retirement savings that didn't live in a tax-advantaged account. My parents never had enough money to put in their 401k, and I've always maxed it out, so I don't have a good model of how partial-contribution decisions are made, but I would've thought that some level of liquid savings would (on average) come before locking up money in a 401k

<comment><USER10> > I would've thought that some level of liquid savings would (on average) come > before locking up money in a 401k

This is correct. But most personal finance wisdom advises keeping no more than 6 months - 1 year of expenses in liquid savings. After that, funding your 401k to get the maximum company match, then your IRA and Roth IRA, and maxing out 401k, is preferred. If there's still money left over after that, it goes into post-tax investments.

<comment><USER8> Problem is you can't fund a 401k and traditional IRA at the same time. Then you can't fund a Roth IRA if you make too much (and it's only $3k/year anyway). The government has rigged it so they are getting a cut of your retirement savings, one way or the other.

<comment><USER10> You can fund a traditional IRA and 401k up to a certain MAGI.[2] If your spouse doesn't work, or their work doesn't offer a 401k, you can fund a traditional IRA for them as well. Roth IRA is $5.5k/year.[0] If your 401k plan allows in-plan conversions you can also do mega backdoor Roth IRA contributions up to something like $37k. [1]

0\. [https://www.nerdwallet.com/blog/investing/roth-ira- contribut...](https://www.nerdwallet.com/blog/investing/roth-ira-contribution- limits/)

1\. [https://thecollegeinvestor.com/17561/understanding-the- mega-...](https://thecollegeinvestor.com/17561/understanding-the-mega- backdoor-roth-ira/)

2\. [https://www.quickanddirtytips.com/money- finance/retirement/c...](https://www.quickanddirtytips.com/money- finance/retirement/can-you-contribute-to-a-401k-and-an-ira-in-the-same-year)

</comment></comment></comment></comment></comment></comment></comment><comment><USER11> But only one in 2 numbers in the title were in number form.

</comment><comment><USER12> Frankly, the American Dream of retirement and 'golden years' has long passed. The 2008 crisis wiped out everything people I know had for retirement. I'd rather save my cash than put it into another person's hands hoping for modest interest returns at the risk of knowing we're just around the corner from another 2008-like crisis. I'm working to make something for my wife after I'm gone. I'd be a horrible retiree anyway. Still to much of a kid at heart.

<comment><USER8> My 401k is now worth about 5x what it was in 2008, mostly due to compounding, which is why I don't understand "people losing everything". They would of had to sell it all at the bottom of the market.

<comment><USER13> > They would of had to sell it all at the bottom of the market.

Yup, that's pretty much it. Unfortunately many people don't have the stomach for the market and end up selling at the worst possible time trying to avoid additional losses.

After all, if everyone was totally rational and held through downturns then market crashes would largely be eliminated.</comment></comment></comment>


Remind HN: RTP Hackers & Founders this Friday  SplatSpace in Durham - <AUTHOR>

Hey guys, this is just a reminder that the RTP Hackers & Founders meetup will take place at SplatSpace (http://www.splatspace.org/), starting at 6:30pm (Eastern Daylight Time), Friday May 13, 2011.
The old submission can be found here:
http://news.ycombinator.com/item?id=2521615
The event can also be found at meetup.com: http://www.meetup.com/RTP-Hackers-Founders/events/17569181/
I hope you'll join us! <comment><AUTHOR> Clickable:

SplatSpace: <http://www.splatspace.org/>

Old submission: <http://news.ycombinator.com/item?id=2521615>

Meetup page: <http://www.meetup.com/RTP-Hackers-Founders/events/17569181/></comment>


Welcome to Ars Technica, version 7.0 - <AUTHOR> http://arstechnica.com/business/2012/05/welcome-to-ars-technica-version-7-0/ <comment><USER2> Sigh, my visits will be a lot fewer now. Not because of the _site_ change but because of their _RSS_ change. We now get a headine and a one line lede rather than the first paragraph and maybe an image.

I'm hoping this is only temporary, site gets revamped, then the rss feed gets fixed based on the new site engine, but I worry it won't.

I do know that if it stays this way they will have lost pretty much all my page views. I may read it if its linked here but I don't have time to click through to the site just to see if a link baitey headline has any substance. I expect that of HuffPo but not Ars.

Sad Panda.

<comment><USER2> Thank you Ars, the RSS feed is back.

</comment></comment><comment><USER3> No more "serving the technologist for <X years in scientific notation>" Sad to see Condé Nast has sucked the humor out of yet another site.

</comment><comment><USER4> Feels a bit like The Verge or is it just my perception?

</comment><comment><USER5> You (arstechnica) appear to have misplaced your favicon.

P.S. I'm not going to enable and go through a wufoo form, just to contact you on this.

<comment><USER6> I was going to contact them about it too but this wufoo thing just returns 404.</comment></comment>


So a Model T was greener than a modern car? - <AUTHOR> http://www.guardian.co.uk/commentisfree/2008/oct/17/automotive-carbonemissions

<comment><USER2> Flagged for link bait. The full title is: "Comment is free Response So a Model T was greener than a modern car? No way"

Also, stupid question, the Model T and the modern car are not comparable. You can't commute on a modern highway to work in to Model T. You can't commute to work on a horse, either.

<comment><AUTHOR> _"... Flagged for link bait. The full title is ..."_

Settle petal. The title was edited to reduce the word count and still reflects the intent of the article.

The idea that the Model-T is greener than modern cars is a compelling one when GM, Ford et.,al. drag their feet releasing an efficient car that uses less carbon emissions and produces less waste. The engineering and technology exists to solve this problem yet _"how many cars"_ can you walk down the street, pay your money and pick up a non or very low emission car?

In the petrol shocks of the 70's when OPEC throttled petrol supply Western car manufacturers ignored smaller the more efficient smaller cars. The Japanese did not and stepped up to the challenge. Now as more pressing challenges appear again, Western car manufacturers once again drag their feet.

<comment><USER2> Compelling? It's wrong.

<comment><AUTHOR> _"... Compelling? It's wrong. ..."_

Contrary statements are fine if you can explain why. Why is this wrong?

<comment><USER2> "The idea that the Model-T is greener than modern cars is a compelling one"

The entire article is about debunking the idea "the model T was more 'green' than a modern car" ---to the extent that the magic word "green" has any rational meaning that can be discussed at all. I have nothing more to add.

</comment></comment></comment></comment></comment><comment><USER3> Wow, green or not, I am amazed that the Model T got more than 20 miles per gallon. That seems extremely efficient for the first mass production car ever.

<comment><USER4> The key thing that kills mileage is weight. Model T has a weight of only 1200 lbs.

By comparison even a tiny dedicated race car like a Lotus Elise weighs close to 2000 lbs. Hell if we go back 2 decades, the poster child of tiny cars, the Honda CRX has a weight of 2200 lbs. Even the all time tiny car, the classic mini cooper was 1400 lbs.</comment></comment>


Gearing Up for Steno - <AUTHOR> https://jladdjr.github.io/steno/2020/02/06/gearing-up-for-steno/ <comment><USER2> Fun fact: I wrote the article in steno! (on a Georgi!)</comment>


The Latest on Yahoo Search BOSS - <AUTHOR> http://www.ysearchblog.com/2011/02/08/latest-on-boss/ <comment><USER2> epi0Bauqu what does this mean for you and DDG?

<comment><AUTHOR> Should mean a more long-term stable API.</comment></comment>


WeWork Needed a Bailout, But Adam Neumann Still Leaves a Billionaire - <AUTHOR> https://www.bloomberg.com/news/articles/2019-10-22/neumann-clings-to-billionaire-status-after-wework-gets-a-bailout <comment><USER2> There is another less discussed downside to Vision Fund's reckless spending and overvaluation of startups.

While Travis & Adam make their billions, the employees at Uber and WeWork are granted overvalued options and stock that subsequently crashes.

The Uber stock is still below where it was 5 years ago and may never recover. The WeWork stock will likely never recover.

As an employee, I would avoid working for a company that is taking funny money from VF. Its a big warning sign to see a company raise from VF given what has come to light.

<comment><USER3> Every time I see these shenanigans it validates my position of turning options into cash if I'm above water ASAP, and getting as much of my raises into base salary as possible.

Twice burned (2001, 2009)...

<comment><USER4> Meh I regret selling any GOOG in the low $200s

<comment><USER5> It was still the right move. As every poker player knows, just because you lost doesn't mean you played the hand wrong.

<comment><USER6> It wasn't necessarily the right move. He/she likely had asymmetric information about where Google was going and how likely it was to continue succeeding.

If they couldn't sufficiently exploit that, then that's on them (assuming they had access to all the relevant metrics).

It's great to diversify, but blindly selling isn't some sort of virtue to optimize for...

<comment><USER7> depend, as I wrote above. If I give you 2 options.

1) $300K in GOOG 2) $300K in cash

if you dont believe that using all of the $300K in cash to buy GOOG immediately is the smart move, yes, you should be blindly diversifying.

<comment><USER6> I think we're largely in agreement.

If you can't leverage the asymmetric information about your company to make a competent buy/hold/sell decision then yes by all means diversify it all.

I just want to make sure the point about asymmetric information is clear though. And it's more relevant in private companies than public ones.

If you're not willing to buy and hold private company equity even after having access to asymmetric information about the firm, then you should consider leaving the company entirely. If you don't then that defeats the entire purpose of taking a chance on a private company and being compensated in equity which can't be acquired through traditional means. You're accepting the equity presumably because you think it's worth a lot more based on the asymmetric information and market opportunity.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> As Matt Levine said, if you owe the bank a million dollars, you have a problem. If you owe the bank 100 million dollars, the bank has a problem.

<comment><USER9> I don't know who said that first but it certainly wasn't Matt Levine.

<comment><USER10> But the big question (for longtime readers) is: does that misattribution count as securities fraud?

<comment><USER11> Did you disclose to your employer that you were going to ask that question on HackerNews? If not, that's securities fraud.

</comment></comment></comment></comment><comment><USER12> Given that softbank is a public company, surprised there is not more shareholder outcry over the strategy of visionfund. In a way it is public money which is bailing out WeWork. Not to mention some of the questionable investments in Indian market (OYO, PayTM, Snapdeal) that seems to follow hyper valuation growth without seeing hyper value of growth of any of these companies.

</comment><comment><USER13> I don't think anyone is to blame here except the people that gave him money in the first place.

<comment> w-j-w You honestly can't think of anyone else who is responsible? How is WeWork not fraud? How was it legal for Neumann to take all of that money?

<comment><USER14> What is fraudulent about WeWork?

<comment><USER15> This is a problem with the modern age. If someone is too clueless, arrogant, or deluded for us to prove they had criminal intent, is it really a crime?

In my ideal world, yes. But under the US justice system, perhaps not. Both political and business leaders have gotten away with amazing amounts of what I'd say is at best criminal negligence because they say, "I didn't know" or "I thought it was fine" or "I believe in my vision".

</comment></comment></comment></comment><comment><USER16> Yet any early employees who signed on with compensation in the form of stock grants/options/RSUs have lost out on years of compensation.

Claiming that it's a risk/reward tradeoff is nonsense, as ICs don't have any meaningful say on the path to exercising their "income", and there are huge incentives for founders and VCs to arrange deals like this.

I really hope that people start realizing that this is a core behavior in business and stop letting themselves be screwed by people who aren't actually taking on meaningful risk.

<comment><USER17> I've been saying for years that stock grants/options/RSUs are like playing the lotto, and salary/benefits are more important. They're also a tool to keep people in roles they no longer want, because of a promise of a great payoff someday.

<comment><USER18> How are RSUs like playing the lotto if you work for one of the big 5 (GAFAM)? I work for one and my RSUs vest monthly and they are autosold so i get a USD based direct deposit each month. While it does very slightly, I wouldn't consider it the lotto.

<comment><USER19> You were awarded them 1-4 years ago though. That's when the value mattered.

To add to that, it's not like when you join a low-performing company you can just leave because you think you can get better value somewhere else. The cost of switching as an employee is very high.

Obviously it's a bit less of a gamble than the lotto, but it's not like decisions that were made 30 days ago are being played now, it's much longer term than that.

</comment></comment></comment></comment><comment><USER20> Since when did loss making pre-IPO companies become "TOO BIG TO FAIL" ?

<comment><USER21> When they own/lease a shit ton of physical assets

<comment><USER22> I don't think they have many assets on their books, relatively speaking. They lease most, if not all, their property. Neumann took personal loans to buy properties, keep them off balance sheet, and leased it back to wework.

This news came out well before the s1. It's a miracle it took the s1 to get investors to give a damn when there were so many governance issues and conflicts of interest out in the open well before.

<comment><USER23> they're one of (if not the) largest lessees in NYC (and other cities around the world), with long-term leases. A lot of landlords would have a conniption if these guys went out of business. Would rock the commercial RE market.

<comment><USER24> I find it hard to believe they are the largest lesee in NYC. They aren't even the largest co-working space rental company (it's Regus, by a landslide).

</comment></comment></comment></comment></comment><comment><USER25> This redefines failing upward.

The lunacy of this is astounding.

<comment><USER26> Not really. WeWork had $12.8B in funding. Now they're valued at $8B. They'll be valued at a lot less if they go bankrupt, so if Softbank can stabilize the company, they can cap their losses. Risk is also baked into that valuation, so if Softbank fixes things, they'll come out ahead.

<comment><USER25> Another perspective would be he got probably one of the 10 or 20 biggest pay days in history for giving We an 80% haircut. And that was directly on him. All he had to do was stop being a jerk and they probably would have slid through.

I'm comfortable calling 80 a failure.

</comment></comment></comment><comment><USER27> I have to ask when are the investors in softbank or the vision fund going to question this bail out? I'd be furious if it were my money being flushed down the toilet this way.

<comment><USER28> I read somewhere that softbank is a huge benefactor in japan central bank QE. So basically vision fund is for people with more money then they know what to do with and didn't really earn it the hard way.

They could have spent it more wisely.

<comment><USER29> There is a hell of a lot of money that doesn't have a safe home. If you're wealthy in 2019, it may cost you money just to stash it somewhere low risk. Now extend that to sovereign funds, etc., and you can start to see why these obvious shenanigans are tolerated. A zero percent "return" is a net gain over holding in savings or bonds in a lot of places.

<comment><USER30> It depends on your definition of "wealthy".

If you're worth less than 12 digits, you can easily "stash" your money in 3-month US treasury bills. They currently yield about 1.63%. [https://www.bankrate.com/rates/interest-rates/91-day- treasur...](https://www.bankrate.com/rates/interest-rates/91-day-treasury- bill.aspx)

Granted, if you're a Russian Oligarch or similar, this might not meet your definition of "a safe home". Otherwise, they're about as low risk as possible.

I agree with your take on sovereign funds etc. The whole world can't just park its excess cash in T-bills.

But unless you're talking about the dumbest of this money, it should be very broadly diversified: worldwide stock markets, bonds, real estate, natural resources, and smaller amounts to things like venture capital.

</comment></comment></comment></comment><comment><USER31> How does one justify giving $1.7B to someone who looses $219k/h?

</comment><comment><USER22> How do you get around the paywall? The usual tricks don't work... Besides paying money.

<comment><USER26> > paying money

One trick to rule them all.

</comment></comment><comment><USER32> Elizabeth Holmes should have doubled down!

</comment><comment><USER33> Lesson: If you're rich and mess up, you'll become yet more rich.</comment>


Ask HN: How does HN earn money to keep going? - <AUTHOR> <comment><USER2> Hacker News is actually relatively cheap to run, because Y-Combinator owns and maintains the server hardware in-house. Instead of paying a monthly bill to a cloud company, they opted to pay a lot (relatively) for a dedicated server and amortize the cost. The only ongoing costs are electricity, internet bandwidth and (I assume) offsite backups.

The last information 'dang confirmed was that Hacker News is a server with something like 256GB RAM, dual 3Ghz decacore Xeon CPUs and 10TB of storage space (I'd guess maybe closer to 20 these days).

That costs a few thousand to build, including the motherboard, case, power supply and a good cooling solution. Unfortunately, you'd probably pay the total cost of the hardware _per month_ with a cloud service :)

So that's the hardware. Y-Combinator also has (at least two) full-time moderators who need to be paid. But while it might not directly bring in any revenue, Hacker News is one of the best industry watering holes. It's a powerful brand mechanism that brings together a lot of high-signal people that are either worth investing in for startup ventures or who are capable of helping those that Y-Combinator chooses to invest in. It doesn't need to see direct returns on the forum because it offers excellent human capital for seeding investments and ideas (see Dropbox, for example).

<comment><USER3> > The last information 'dang confirmed was that Hacker News is a server with > something like 256GB RAM, dual 3Ghz decacore Xeon CPUs and 10TB of storage > space (I'd guess maybe closer to 20 these days).

Wow, that's a lot more than I expected, considering how simple and lightweight the website is.

<comment><USER4> Doesn't mean all the space is used. And 10TB isn't a big deal. El-cheapo laptops used by soccer moms have 1-2TB drives.

<comment><USER5> My chromebook has 16gb SSD. I want an apple laptop, but the cheapest has only 128gb SSD.

</comment></comment></comment></comment><comment><USER6> It's a private venture of Y Combinator company. Why do you think it needs any earnings?

<comment><AUTHOR> I'm curious because it takes a lot of time and attention by moderators to keep the HN atmosphere as civil and informative as we experience now.

How are the moderators compensated? There are no ads or anything on HN.

<comment><USER7> There are advertisements placed on the front page by yc companies looking to hire.

<comment><AUTHOR> I always thought they're free.

<comment><USER7> If it was free anyone could post ads looking to hire. It's exclusive advertising to a high value potential customer.</comment></comment></comment></comment></comment>


ICO.gov (click on continue without agreeing to cookies) - <AUTHOR> http://www.ico.gov.uk/news/current_topics/website_changes_pecr.aspx <comment><USER3> Argh!

99% of people have no clue what a "cookie" is used for and just hear that it is "evil" and such. At the same time, these same people have no problem exhibiting themselves of Facebook or tracking their positions on Foursquare.

@gov: Just make something like this (<http://www.networkadvertising.org/> > "Conumer opt-out") legally binding for tracking networks (not for individual web sites!) and the whole "Cookie" paranoia is solved.

<comment><USER4> _> 99% of people have no clue what a "cookie" is used for and just hear that it is "evil" and such._

99% of people also don't know how to evaluate the safety of a food additive.

Most don't even know proper food handling procedures and couldn't even evaluate the food safety procedures of their favorite restaurant's kitchen (assuming they even had the time to do so).

Hence, governmental regulatory bodies. You might not agree with the regulatory environment, or with the outcomes, but the regulatory position _is_ logically consistent.

 _> At the same time, these same people have no problem exhibiting themselves of Facebook or tracking their positions on Foursquare._

Ignorance aside, people are quite often circumspect with what they share on social networking sites; they, honestly have _no idea_ the level of tracking and data sharing that occurs.

Even still, your statement is an unfounded generalization; there are clearly plenty of people that don't use Facebook (or Foursquare) and _do_ have a problem "exhibiting" themselves.

 _> @gov: Just make something like this (<http://www.networkadvertising.org/> > "Conumer opt-out") legally binding for tracking networks (not for individual web sites!) and the whole "Cookie" paranoia is solved._

As a consumer, I prefer opt-in for analytics, user tracking, and unsolicited spam.

<comment><USER5> I'm not sure your comparison with food safety is completely apt; This cookie law is the equalivant of being asked "Do you consent to the use of sodium benzoate in your food" before entering any restaurant. Most people will have no idea what to make of that, and will probably hate being asked every time.

It would be different if tracking was such a problem that it was outlawed all together (like dangerous food additives are), as that would be clear to everyone how to proceed.

</comment></comment></comment><comment><USER6> In their privacy policy they list the cookie that 'Is essential for their site to function'

"Essential site cookie|ASP.NET_SessionId|This cookie is essential for the online notification form to operate and is set upon your arrival to the ICO site. This cookie is deleted when you close your browser."

They also say that they've left it there because: "as we're unable to remove it from one part of the site without affecting another"

So apparently incompetence is an excuse for leaving cookies in place. Problem solved!

<comment><USER7> Does ASP.Net depend on it for some reason? I used to do some work in Java Server Pages, and in JSF we were stuck with something called viewstate, that were kept either as a blob in the page or as reference in the page to a blob stored on the server. Technically not a cookie, but for all intents and purposes the same as a cookie that gets deleted when the browser is closed.

<comment><USER8> Blocking the cookie lets me view a few pages of the site perfectly fine. I guess the session is required in one small part of the site and it wasn't easy for the developers to make the site only set the cookie in that place.

</comment></comment></comment><comment><USER9> websites had that coming for a long time.

It's a common industry pattern to overdo things and then get regulated.

take e.g german gas stations, they went from adjusting their prices occasionally (e.g. when the oil price changed) to price changes several times per day in order to gouge the most out of the customers. Now, they will get regulated and only be allowed to change their price once per day... they basically asked for it.

Same for international roaming fees in Europe, from insane to regulated..

Cookies were used to tracks people's shopping carts and that was fine, same for a site to recognize you. Nowadays they are used to identify and track you in global ad networks etc.. again, asking for it..

<comment><USER10> This is why we can't have nice things, abuse of something useful for ends undesirable to the masses leads to it getting banned for all uses.

</comment></comment><comment><USER11> That's the same site that paid £585 for their favicon <http://news.ycombinator.com/item?id=2175321>

<comment><USER12> I think that says it all. Clueless.

<comment><USER13> I take it you didn't read the comments on that post then? The ones that explained why the upfront cost of £585 is not at all unreasonable.

</comment></comment></comment><comment><USER14> From the linked page:

> Currently our website contains one cookie that we do not use, but is > essential for part of the site to operate. At present we have left this in > place across the site, as we're unable to remove it from one part of the > site without affecting another. This session cookie is set on a user's > arrival to the site - at which time they're informed that the cookie has > been set - and is deleted when a user leaves the site.

I'm fairly sure the advice from the ICO that I read earlier was quite blunt about cookies that were not strictly necessary: you can't set them without consent just for your own convenience.

There is a silly box at the top of their page that asks you to accept cookies and tells you off if you click "Continue" without doing so, which seems entirely contrary to the principle of this new law to me, before you even get to this mysterious cookie they apparently set anyway.

<comment><USER13> The important bit is "but is essential for part of the site to operate." To me, that clearly falls under the "strictly necessary" banner, albeit that it probably shouldn't be set until you enter the part of the site that requires it.

Government IT moves at a glacial pace, and just like everyone else they're still trying to figure out how this stuff should work. That's why they've deferred enforcement for a year.

<comment><USER14> > The important bit is "but is essential for part of the site to operate." To > me, that clearly falls under the "strictly necessary" banner

They say that, but it is easily demonstrable that running a web site providing static content such as they do does not require the use of any cookies or similar technology at all to provide the service the user is requesting: millions of web sites manage it every day. As you say, if only part of their site requires the cookie for some genuine reason, perhaps they should only set it there. In any case, there is really no excuse for not explaining properly what the cookie is for or for cluttering up the screens of visitors who don't check your "do whatever you want" button just to make the extra panel go away.

Bottom line: the exemption is not for cookies that are required because you hired poorly trained web developers or picked an inconvenient tool somewhere on your hosting platform. It's for cookies that are essential to providing the service that visitors are expecting. The ICO themselves have been very clear on this in the guidance they published in the run up to the handover, and their own site is flagrantly violating at least the spirit of the rule if not the letter of the law -- which AIUI they have responsibility for interpreting in the UK, so if they can't get it right, what hope is there for anyone else?

</comment></comment></comment><comment><USER15> Unfortunately this is another case of throwing the baby out with the bathwater, and incidentally not really solving the problem.

Firstly there are various kinds of cookies. There are ones that are stored on your hard-disk, and others which exist only in memory (for the life of the browser instance.)

There are ones used for marketing and tracking purposes, and others (notably session cookies) that allow the server to track the "state" - thus allowing for "web apps" as much as web-pages.

So their idea is to just "ban cookies". Or, as they have done, get all sites to have a "allow cookies" switch. Don't turn that on? well then you can't use any part of the site. And if you do turn it on, it's "all or nothing" - <USER2> can't allow say _just_ the session cookie, while banning the tracking cookies?

As to the possibility of enforcing this? Let's not even go there...

<comment><USER9> what other option is there? To mandate browser source code that implements cookies in a lawful way?

And where is the broad coalition of "don't be evil" browser vendors and websites that proudly claims "we don't track you" and that would have made such laws unnecessary?

</comment></comment><comment><USER16> I'm so not looking forward to seeing jsessionid in my urls again.

</comment><comment><USER12> I really want to know what there jurisdiction and who this effecting.

Does this apply to all EU traffic?

OR does this only apply to websites hosted within the EU?

OR does only apply to EU companies?

Plus how on earth do they plan to enforce this?

<comment><USER17> Unfortunately this is not just a UK thing. Every EU country is forced to do this.

A similar law was passed in Sweden just the other week and will come into effect on July 1, despite heavy criticism from pretty much everyone.

So how could they pass such a law? It's from an EU directive, more specifically 2009/136/EC [1]. A directive is something that every member state is _required_ to implement into national law, whether they like it or not. AFAIK every member state is supposed to have implemented this by now. Sigh.

[1] [http://eur- lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2...](http://eur- lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2009:337:0011:0036:En:PDF)

</comment></comment><comment><USER18> Couldn't a site just declare a single session ID as essential, and store everything else server side? Or is the problem that you usually don't keep server side session data indefinitely? I suppose you couldn't use client side JavaScript on your cookies in that case either.

Does this apply to HTML5 localstorage too?

<comment> mike-cardwell Whether or not you declare it essential is irrelevant. What matters is if it actually _is_ essential.

As for localstorage, read the guidance from the ICO:

[https://www.ico.gov.uk/~/media/documents/library/Privacy_and...](https://www.ico.gov.uk/~/media/documents/library/Privacy_and_electronic/Practical_application/advice_on_the_new_cookies_regulations.pdf)

Third paragraph: "These changes apply to storage or gaining access to information stored, in the device of a subscriber or user. This means the use of cookies and similar technologies for storing information."

Fifth paragraph: "The Regulations also apply to similar technologies for storing information. This could include, for example, Locally Stored Objects (commonly referred to as "Flash Cookies")."

</comment></comment><comment><USER19> This is exactly why we are currently cutting back on bloated Government departments in the UK. I can see this being repealed in 12 months, it's a ridiculous, unenforceable law.

<comment><USER20> To be fair, I think it's based on a European directive that all European countries will need to enforce sooner or later (unless it gets changed).

</comment></comment><comment><USER21> If you block cookies on that website you don't see the message.

If you don't click 'accept cookies' or 'continue' but simply browse the site, you've apparently accepted some cookies.

</comment><comment><USER22> Okay, so I don't really use cookies ever, the only one I use is for the PHP Session Identifier. Is this going to be allowed? D:

I'm guessing that it will be because ICO is allowed..

<comment> mike-cardwell It depends on when you set it and why. If you just set it as soon as anyone visits your site, and there is no essential reason for you doing that for the site to work, then you are breaking the law.

If you only set it when somebody logs in to your site, to maintain a logged in session, then it will be fine.

</comment></comment><comment><USER23> The Internet is a really big part of our current society; the concern of a lot of people. You'd expect that the advisory board of decision-makers of such important things would consist of the smartest and most knowledgable persons available - the persons who invented the web, the persons who are making it work and who are taking it forward.

I haven't done any research. Does anyone know who gives these guys advice?

</comment><comment><USER24> "unless the cookie is strictly necessary to provide a service requested by the user"

Isn't this open to some interpretation? Seems like a pretty wide loop hole. Seems that this will allow a site to set/read it's own cookies no problem. Third-party ad-networks and trackers though, yeah, they would not fall within this definition I think. And isn't that a good thing?

<comment><USER22> I don't think it's a good thing. Many websites rely on advertising to allow them to even exist

<comment> mike-cardwell So? All those websites have to do is ask permission from the site visitor to track them. Rather than tracking them without their consent...

And if people don't want to be tracked, and the site loses out by not tracking them, so be it... That is a better situation than somebody being tracked without their knowledge/consent.

</comment></comment></comment><comment><USER25> But why? "[tick] I accept cookies from this site... what is a cookie?" a user may ask.

</comment><comment><USER26> How do they check if you have cookies enabled without setting one? Aren't they breaking the law in the process?

</comment><comment><USER27> Imagine millions of websites greeting you with a cookie acceptance dialog ...

</comment><comment><USER28> unfortunately, that's not the regular clueless legislator.

That's an example of the shift of power happening in the web.

Remember when you started using firefox because of all the options and "about:config"?

Now, remember how you ditched it for Chrome, but have to start firefox to be able to use crazedlist.org because to disable cross-site referrer on chrome you have to recompile it? (they even removed the command line option!)

In a few chrome versions (what happens every 15min), I doubt you will be able to disable cookies.

<comment><USER11> Never heard of crazedlist.org but you can use extensions for cross site referring <http://code.google.com/chrome/extensions/xhr.html>

<comment><USER28> Don't think we are talking about the same thing.

I'm talking about the referrer headers.

It used to have an option. Then they moved it to a command line[1]. now they removed it completely!

Disabling referrer header kills some google features in adwords and analytics. So they have more than enough reason to kill it first.

[1] [http://darklaunch.com/2011/05/07/chrome-disable-referer- head...](http://darklaunch.com/2011/05/07/chrome-disable-referer-headers)

<comment><USER28> If anyone else is bugged by the lack of control on your referrer headers, star this <http://code.google.com/p/chromium/issues/detail?id=84177>

For the address bar, i had no luck finding a bug. anyone?

<comment> mike-cardwell FWIW, on Firefox I use the refcontrol addon, and I've not experienced any problems yet. If the referer domain is different to the domain of the request, it modifies the referer to be the root of the site being requested.

<comment><USER28> that's even better than the about:config option of allowing it just for clicks, not for scripts/iframes/etc. thanks</comment></comment></comment></comment></comment></comment>


The Open Book Project - <AUTHOR> https://github.com/joeycastillo/The-Open-Book <comment><USER2> I personally prefer the decoupled model of the PC: buy any hardware, install any OS.

At the moment, KOReader[1] runs on Kindle, Kobo, PocketBook, and many other e-readers – and is completely open-source.

[1] [http://koreader.rocks/](http://koreader.rocks/)

<comment><USER3> I use koreader on my Kobo Clara HD, but it's frustratingly "open sourcey". I say that as an ardent FOSS enthusiast who runs Linux as his primary os. What I mean by that is: bad ux, difficult to install, millions of super specific options crowding out the ones you actually want, etc.

I still use it over the default kobo software, but I really wish it was better.

</comment></comment><comment><USER4> I really like the Idea.

Since I bought a reasonably open Kobo recently, I feel the main pain point with eRaeders though is actually getting something to read on them. A dozen stores with DRM exist and the few sites without DRM naturally have limited selection. Also reading pdfs is really not great, yet converting them seems also unreasonably hard. So the problems seems not to be the hardware only, but the whole stack from hardware over software to content.

Still, an open eink device could be fun and can certainly be used for more than just reading books.

<comment><USER5> >the main pain point with eRaeders though is actually getting something to read on them

Pretty sure Calibre gives you the ability to convert to open formats.

<comment><USER6> Calibre on its own will convert between formats and there are plugins that will strip drm. I have no idea about the legality in various parts of the world but it is a solid solution for liberating content and making it portable

<comment><USER7> Yeah, but it can't usefully convert PDFs. To make a PDF usable on an e-reader you've got to trim the margins, and chop it into pages that exactly fit the e-reader screen (in landscape, due to line length issues)--and even then some just can't be converted. And in doing this you need software that knows where to cut pages and whether to insert padding so that lines don't get cut off. And you never want to use OCR or text extraction, which suck. It's an extremely difficult process, but since panning and zooming on ereaders is unusable it's the only way I've found that works (I use the k2pdfopt software)--the alternative is just using a tablet for PDFs which is what I increasingly do.

<comment><USER5> PDFs are already an open format and the software that you are looking for would take 5 billion dollars of research money to produce. Every PDF is formatted differently.

<comment><USER7> k2pdfopt, which is free, works for almost every PDF.

</comment></comment></comment></comment></comment></comment><comment><USER8> This takes on the wrong side of the closed e-reader problem, IMHO. There are lots of top notch devices available for cheap, but they have closed software. However they generally run Linux.

Making a custom kernel/distribution for existing devices would be a better way to go. The Open Inkpot project tried this years ago, but never really got anywhere.

It's low-hanging fruit though: compared to what projects like lineageOS are doing, this is very doable.

And if this Open Book project ever gets usable hardware out, they'll _still_ have to take on the software side.

<comment><USER9> KOReader seems to be exactly that.

</comment></comment><comment><USER10> Nice project. Not being a hardware person, I personally look at open source and different data formats. I try to buy books directly from publishers who provide Kindle, ePub, and PDF formats with purchases. The thought is awful of losing my Amazon account and losing access to hundreds of audible book purchases and I don't know how many Kindle purchases. I try to spread my closed platform purchases also to Google Play Books and iBooks to spread out the risks but Amazon gets most of my business. I do like that my family gets access to my Google Play books.

Really off topic and a little bit self serving to mention this: as an author, I stopped publishing physical books because I like to be able to easily update material and my eBooks are released under a Creative Commons license in three file formats with no DRM. I encourage my readers to share my books.

</comment><comment><USER11> The most annoying thing about e-reader is the size of the devices. I wish someone built a device with an A4 letter screen. This would make reading scientific papers much easier.

<comment><USER12> ReMarkable, Onyx, used Kindle DX.

</comment></comment><comment><USER13> This should have been called The Open _eBook_ Project. Books and ebooks are really not the same thing at all.

<comment><USER14> >Books and ebooks are really not the same thing at all.

In what sense are they not? My first thought when hearing the word "book" is of a particular template of contents and layout that could be instantiated on paper or on a digital device; I guess I'm thinking of something like an ISBN, rather than a specific physical artifact. And that's pretty much the same concept that comes to mind when I hear "ebook".

What is the difference that you're thinking of?

EDIT: in other words, I suppose that my concept of a book is based on the usual interpretation of the question "Have you read that book?"

</comment></comment><comment><USER15> Honestly, I don't see any relevancy in the statement of this project. Using kindles and other ebook readerds for about 6 years and always asked to recommend one, I've learned that ebook readers are one of the most realiable devices ever built, so you'd better buy a used one and take it off the market than produce yourself another devices honestly no one needs at the moment. A lot of the people buying ebook readers usually end up ditching them just because their 'reading hype' didn't catch on, or their company's read and roll program (we have Bookster in Romania) is cheaper to use (as it's free) than buying and converting books all the time.

But, ebook readers are cheap and easy to use (if bought used), even kindle's amazon. Since you have a kindle e-mail address you can just use an app to convert every non-kindle-format file into a compliant one, that's it if you don't want to use Calibre via USB or WebServer. I use eBooker on my Android phone.

<comment><USER16> This is true. I still use occasionally a Kindle DX I bought in 2010. Sure the battery lasts only for a couple of days now, and it has always been slow, but it still works, and is a great reading device. It even still has free 3G internet.

Though to be honest I much prefer my 12" ipad pro with high refresh rate for reading papers.

</comment></comment><comment><USER17> Makes sense to apply to the sponsorship, either through GitHub itself, with its matching program, or through OpenCollective.

</comment><comment><USER18> LIke others are pointing out here, there seems to be bigger issues in the __software __world of digital reading, while on the hardware front seems to be OK.

Converting pdf files to epubs is unreliable and often just produces garbage. Calibre may be open source but it seems to be controlled by just one person. pdf2html seemed to be making some nice progress but now seems to be not maintained any more.

In a perfect world we'd have completely open, maintained and well-known conversion software and reader software. There doesn't seem to be a Linux or Firefox in this category.

</comment><comment><USER19> I desperately want this. I've been looking for something open source like this since I bought my first Kindle.

</comment><comment><USER20> what I'm looking for at the moment is an ereader that I can install syncthing on so I can easily add or remove books at any time from my other devices. having to plug in to another computer and manually sync with calibre or whatever is a bit of a pain.

a few people have got it running on the kobo but the install process seems a bit tricky. there's also the option of using an android based eink and then maybe sideloading the syncthing apk.

the other thing I like about this idea is that i could continue reading a book on my phone or computer if I was really stuck, or if I forgot to charge my ereader... which I do quite a lot

</comment><comment><USER21> I think I admire the energy and dedication behind this, but I can't see getting one.

I've been involved with eBooks for over 15 years. It began when my then employer decided all IT staff members should have PDAs. A Handspring Visor Deluxe running Palm OS 3.1 appeared on my desk. I started looking for stuff that would assist in my work as a Sysadmin.

An early discovery was Plucker - a desktop program and Palm client. Plucker was designed to spider websites, and convert what it grabbed into something that could be viewed on the Palm device. A good deal of the documentation for stuff I dealt with was in HTML, and Plucker desktop could convert locally stored HTML files to versions viewable on the PDA. I could carry a documentation library in my pocket.

It was a hop, skip, and jump to realizing I could read other things as well, and a good bit of Project Gutenberg and other things issued under licenses that permitted it joined the party. (I still have about 4K converted Plucker documents in a 7Z archive.)

While I still have a working PDA, the next step was a 7" Android tablet. A variety of eBook viewers for Android existed. My choice was the open source FBReader for Android. I had previously used a version of FBReader written in C under Windows and Linux. FBReader for Android was a Java port, but worked pretty much the same was. The win for FBReader was multiple format support. I prefer ePub, but FBReader can display Mobi, FB2, and a few other things native, and display PDFs, DjVu files, and CBR/CBZ files using plugins. Effectively, I didn't have to _care_ what format a book was in. On the old PDA, I could read a variety of formats too, but each had a dedicated viewer app, and I had to remember which book was in which format displayed by what program. FBReader on Android was a breath of fresh air.

I do _not_ use eInk devices. I understand the advantages - they are battery friendly, and viewable out of doors. But too much of the content I read requires color support. A color LCD screen is a _requirement_.

I also need a device that can do other things besides display eBooks. There are limits to what I want to carry around when traveling. I already take a laptop and a cell phone. A device that displays eBooks, but can do other things in a pinch like check email, Look Stuff Up, or display MS Office files is a major plus. (I do not use a phone for that. The stuff I tend to view needs a larger screen size than a practical phone can have.)

And while I prefer open source, I am not wedded to it. I will cheerfully pay for closed source software if there isn't an open source offering that does whatever I require, or there is, but the closed source version is simply _better_. (And a major part of "better" is UX. Open source software tends to have less than optimal user interfaces. The folks who wrote the programs wrote good code for performing the function, but are not UX designers.) I feel the same about open source hardware.

This is a worthy effort, and I wish it all success, but I think it appeals to a rather small niche market. Amazon, Kobo, and the like are not exactly threatened. ______ Dennis</comment>


Credit Karma announces completely free tax prep product - <AUTHOR> http://www.nytimes.com/2016/12/07/business/dealbook/automated-assistants-will-soon-make-a-bid-for-your-finances.html?ref=business&_r=1 <comment><AUTHOR> I changed the headline because the headline buried the lead. The headline should have read "Credit Karma Takes On TurboTax, H&R Block With Free Tax Filings" as this Forbes article ([http://www.forbes.com/sites/laurengensler/2016/12/07/credit-...](http://www.forbes.com/sites/laurengensler/2016/12/07/credit- karma-free-tax-filings/#14a464893b3d)) did.</comment>


Ireland plans 'startup nirvana' to poach global talent - <AUTHOR> http://www.guardian.co.uk/technology/2010/nov/25/enterprise-ireland-funding <comment><USER2> Good. Along with London's efforts (<http://www.bbc.co.uk/news/uk-england- london-11689437>) we could be seeing even more startups with new and well- executed ideas, which can only be a good thing for the world.

</comment><comment><USER3> One of the most important factor for this type of plan to succeed is to have encouraging Visa process in place so that smart foreigners can come and try the opportunities in a new country... also an option to become a permanent residence / citizenship will be icing on the cake!!</comment>


Encrypted messengers: Riot, not Signal, is the future - <AUTHOR> http://www.titus-stahl.de/blog/2016/12/21/encrypted-messengers-why-riot-and-not-signal-is-the-future/ <comment><USER2> This topic has been beaten to death on HN over the last year (other people can provide links to discussions, with Moxie participating).

I think something worth keeping in mind is that almost everyone who works in secure messaging agrees on one thing: that electronic mail is not the future of secure communication.

There's no fundamental reason why that should be the case. The store-and- forward model used by SMTP could be made to work for asynchronous secure group messaging. You can get forward and future security with it. It can interoperate with existing email addresses. All of that can be made to work.

But it is the case. Email won't be a secure group communication system. The reason for that is that email is _federated_ and thus permanently mired in the lowest common denominator of mainstream email clients.

I think reasonable people can disagree about whether it's tractable to create a federated secure group messaging system with what we know right now. But I do not think it's reasonable to suggest that the concern (federation = lowest common denominator security) is invalid. And that's what this piece does.

<comment><USER3> "non-federated" and "secure" in the same sentence is a joke. Signal's other problem is Google Play Services which has absolutely no place in a supposedly secure system.

<comment><USER4> Federation concerns availability, not security. "unplug the ethernet and write plaintext to /dev/null" is extraordinarily secure and 100% decentralized, though badly unavailable.

<comment><USER5> It can also affect security depending on what jurisdiction the servers fall under. Federation means that while it may be illegal to run the service in, say, China, it can be run elsewhere without those concerns. This is becoming more apparent with the widespread use of National Security Letters.

<comment><USER4> Sorry, am I missing something? It's my understanding that Signal is ETE encrypted. All an NSL would get you is ciphertext and metadata.

<comment><USER5> The scenario I'm imagining is that Google and OWS receive NSLs requiring them to push a modified APK that could do nefarious things.

<comment><USER6> This is a common misconception: NSLs are a legal tool that can be used to extract certain types of information (such as subscriber information and maybe a little bit of transactional information) that a service provider already has stored on their servers [0]. However, they cannot be used to force a service provider to write and deploy code.

[0] NSLs are not magic - [https://www.youtube.com/watch?v=YN_qVqgRlx4&t=20m16s](https://www.youtube.com/watch?v=YN_qVqgRlx4&t=20m16s)

<comment><USER5> He mentions "technical assistance orders" but doesn't really elaborate any more on them. I'm having a difficult time finding any information on these orders, does anyone else have information on the capability of these orders?

<comment><USER5> Replying to my own comment, as I found some more information in a Black Hat talk regarding technical assistance orders:

[https://youtu.be/PX2RjJAfTYg?t=770](https://youtu.be/PX2RjJAfTYg?t=770)

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> Nothing against Signal, But I sure hope matrix-based platforms and clients (like riot.im) keeping growing. The folks who work on both matrix.org and riot.im have done so much work in such a short time...not just in developing the protocol/server/apps...but also in education. They really have helped people like me to setup our own little home servers (i.e. private networks)...which ultimately helps the entire federated network. Signal - while certainly can be setup/hosted by anyone else separate of OpenWhisper - leaves some to be desired in the actual self-implementation details; just not enough tutorials out there. (Or maybe its just me?)

<comment><USER8> > Signal - while certainly can be setup/hosted by anyone else separate of > OpenWhisper - leaves some to be desired in the actual self-implementation > details; just not enough tutorials out there.

That is the problem at hand, that Signal _does_not_federate_. You could modify your Signal app to connect to your own server, but then you would not be able to talk to anybody else.

For the record I prefer usability and walled-garden-security instead of federation, even though it hurts to admit as a long time FOSS user.

<comment><USER9> I think signal made the right decisions raising the bar for encryption while maintaining extreme ease of use. Random Joe can click on it on the app store and chat with anyone in his addressbook that runs signal within a minute or so, with no expertise whatsoever.

However I see no reason why a similar p2p app couldn't manage similar without a central server. Trick is cell phones (at least on WAN) do not accept incoming connection. Additionally apple/android push aren't good for a p2p transport.

However adding supernodes (like the original skype) that could run on raspberry pi's, opensource routers, and similar embedded devices might just bright the gap. After all the cpu, bandwidth, and memory needs for instant messaging are pretty modest, even for many people sharing a raspberry pi.

<comment><USER10> The idea of supernodes is what got everyone paranoid (with reason) that they were now able to be spied upon.

</comment></comment></comment></comment><comment><USER11> It should be noted that Riot is just the first Matrix client to support end- to-end encryption, but there will be more in the future. The thing you want to bet on is the Matrix protocol, not necessarily Riot. (Although both are a safe bet since Riot is developed by the same team that built Matrix.)

I'm not part of the Matrix or Riot teams, but I'm convinced enough that Matrix is a great way forward for modern messaging. I started my own Matrix homeserver (as well as other Matrix libraries, eventually to include a Matrix client) written in Rust. If you're interested in Matrix, Rust, or both, I encourage you to get involved! [https://www.ruma.io/](https://www.ruma.io/)

</comment><comment><USER12> Are there any plans to do a security audit on Riot? The useful report by NCC [1] looks at libolm (which implements the end-to-end encryption) but of course that's only part of the whole product.

[1] [https://matrix.org/blog/2016/11/21/matrixs-olm-end-to-end- en...](https://matrix.org/blog/2016/11/21/matrixs-olm-end-to-end-encryption- security-assessment-released-and-implemented-cross-platform-on-riot-at-last/)

<comment><USER13> Note that that report explains that the Double Ratchet E2E algorithm is used in Matrix, in large part because of the Open Whisper Systems implementation in Signal and subsequent licensing. So we're looking at an apples-to-apples comparison, at least with respect to this one piece.

<comment><USER12> Yes, it seems like a good choice of algorithm. And it seems like the implementation is also decent - they looked at that as well. It's a useful report and kudos to Open Technology Fund for funding it and to Matrix for making it public!

Still, this is only one piece of the overall security of Riot, so I'm still interested in knowing if there's any work going on looking at the bigger picture.

</comment></comment></comment><comment><USER14> > The most important concern is that Signal is a silo [...] you have to > connect to OpenWhisperSystems servers to communicate with other users.

You can run your own private Signal service with OpenWhisperSystems' tools [1].

It's also worth noting that Signal - as a protocol - could easily be federated. (As others have mentioned, Moxie has chimed in on why the _app_ is centralized [2]).

If confederated messaging is important, why not use the existing Signal protocol implementations, (including the X3DH key exchange, ratcheting protocol, etc), which is all F/LOSS, and has already been widely reviewed (as the article mentions)?

[1] [https://github.com/WhisperSystems/libsignal-service- java](https://github.com/WhisperSystems/libsignal-service-java)

[2] [https://whispersystems.org/blog/the-ecosystem-is- moving/](https://whispersystems.org/blog/the-ecosystem-is-moving/)

<comment><USER15> > You can run your own private Signal service

A distinction without a difference. I use Signal because people use Signal. People do not use 'the Signal service'. They use OWS's app and OWS's servers and moxie has explained he will not federate.

The fact that OWS goes to all the effort of creating this excellent protocol, and then insists on only deploying it to insecure devices (with direct-memory- access baseband radios) baffles me, but I hope that things move in a saner direction with time.

The biggest benefit I think OWS has provided is the ability for other platforms (e.g. Whatsapp) to use their protocols. I daydream about a day when all these competing messaging services realize they would stand to gain a lot by federating, but I know it won't happen in my lifetime.

<comment><USER4> I'm not a fan of opaque baseband firmwares either, don't get me wrong, but what's the alternative? Not for the DoD, I mean for union organizers making $50k a year -- people who aren't going to get murdered by Mossad, but still need to authenticate and encrypt their communication channels. What device would you recommend?

<comment><USER16> Who's the likely threat to union organisers? I suspect a pair-locked iPhone with Signal or Whatsapp would be more than secure enough.

<comment><USER4> The most prominent example would be [https://en.wikipedia.org/wiki/Jimmy_Hoffa](https://en.wikipedia.org/wiki/Jimmy_Hoffa)

and then the long, storied history of American strike-breaking &c.

<comment><USER17> Well, either the threat is a private group, then WhatsApp or even Google Hangouts is secure enough.

Or the threat is a government, then Signal is not secure enough either, because the US govt can just force Google and OWS to ship modified APKs.

<comment><USER4> conflating the specific binary instantiation with the general cryptosystem. Regardless, depending on your threat model, you can take increasingly { reasonable | paranoid } precautions like manually compiling and loading Signal, as it's OSS.

edit: "private group" can encompass a lot, especially in other ecosystems like Google and FB. If said "private group" adversary is, say, a prominent and wealthy Silicon Valley businessman and enterprising vampire who collaborates with fascists, then you can see the potential of compromising someone's security by coercing Google or Facebook engineers to run you a Hadoop query or conditionally inject malicious JS.

<comment><USER17> > like manually compiling and loading Signal, as it's OSS.

Except, I'd have to modify the code, as the current version depends on Google's proprietary libs, which I can't inspect. And I lose half of the functionality, as RedPhone is also proprietary.

> by coercing Google or Facebook engineers to run you a Hadoop query or > conditionally inject malicious JS.

The same can be done by coercing OWS engineers to backdoor their services.

And in any case, Signal can start collecting metadata any minute now, and there's nothing we could do against it.

<comment><USER18> > And I lose half of the functionality, as RedPhone is also proprietary.

The source code for the Redphone client is here: [https://github.com/WhisperSystems/Signal- Android/tree/master...](https://github.com/WhisperSystems/Signal- Android/tree/master/src/org/thoughtcrime/redphone)

The source code the redphone-audio library is here: [https://github.com/WhisperSystems/Signal- Android/tree/master...](https://github.com/WhisperSystems/Signal- Android/tree/master/jni/redphone)

Stop spreading misinformation.

<comment><USER17> So it finally got opened? Still doesn't help me, considering that the Firebase Messaging library compiled into the client is still proprietary.

I can not build Signal from source today.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER13> I believe Riot is the future not because of its security(its attention to such is a great, great bonus) but because it's positioned itself so well as a credible successor to IRC.

<comment><USER19> And an open replacement for Slack.

<comment><USER20> Yes. I don't see Signal and Matrix in direct competition, just like WhatsApp and Slack are not in direct competition. The technology is very similar (main difference seems to be the size of chat rooms), but the use case and marketing is very different. Signal/WhatsApp is for casual mobile texting, while Matrix/Slack is for working.

<comment><USER11> I think Riot is a better comparison to Slack than Matrix is. Riot is essentially the Slack experience built on the Matrix protocol, but Matrix can certainly work just as well for clients that present a Signal/WhatsApp/iMessage/SMS-style interface.

</comment></comment></comment></comment><comment><USER21> After a recent discussion of the issues with XMPP on mobile, some obvious questions:

1\. How well does Riot deal with changing network connections? Does it have problems when a mobile device switches between, say, WiFi and 4G? How well does it deal with a complete loss of connectivity?

2\. How well does Riot deal with power management on mobile devices? Can it spend time in the background while getting message alerts while not running down the battery?

<comment><USER22> It's really good. I'll vouch for it as someone who has been using the mobile apps on both platforms, and the web application(s) on the desktop for over a year now. They're great. Battery isn't a problem; messages NEVER get lost.

I actually came to matrix after trying to write an XMPP client, believe it or not. The matrix protocol is WAY better equipped for the future than XMPP is: it simply has the core designs necessary to make it federate _well_ and do message sync _without losses_. (XMPP doesn't. (Unless you count a half-dozen XEPs, none of which are reliably implemented in all clients. But we're getting increasingly parenthetical here; by comparison, matrix Just Works.))

<comment><USER23> I've been using Vector/Riot using the Android version in F-Droid on Blackberry 10 for 6-9 months, connecting to my own server on my DSL. I haven't noticed a single issue with battery or lost messages.

</comment></comment></comment><comment><USER24> The permissions Signal asks for do seem excessive (both on iPhone and even more so on Android).

Can anyone justify why they are necessary?

<comment><USER25> Developers who are unfamiliar with the Intents system? That's a common reason for applications requiring a laundry list of permissions.

[http://stackoverflow.com/questions/6578051/what-is-an- intent...](http://stackoverflow.com/questions/6578051/what-is-an-intent-in- android)

<comment><USER5> The developers have feature justifications for every permission requested: [https://support.whispersystems.org/hc/en- us/articles/2125358...](https://support.whispersystems.org/hc/en- us/articles/212535858-What-are-all-these-permissions-)

Edit: Reading your link now, as I didn't see it before I made my comment. Was that added in as an edit?

<comment><USER25> These are the justifications of developers who are unfamiliar with the Intent system. Were I unaware of Intent, I would make the same design decisions.

<comment><USER26> I agree. Mostly because they're asking for all of those permissions prematurely.

What if I never want to share my location, take pictures, or send files?

And then some things, like calendar access, aren't even used right now.

<comment><USER6> > What if I never want to share my location, take pictures, or send files?

Don't use these features and / or disable the corresponding permissions.

<comment><USER26> I get that. I'm just saying that it wouldn't look as bad if they just didn't ask for the permissions upfront.

If I'm about to take a picture for the first time using it then I'll understand it asking for camera access.

</comment></comment></comment></comment></comment></comment></comment><comment><USER27> > Riot is based on the so-called Matrix protocol which is a federated protocol

> In addition, people are writing alternative clients to access the > Matrix/Riot network, implementing their favorite features and workflows. As > users can vote with their feet for their own interests and choose providers > and apps of their liking

Can I run my own network which is not part of other networks (i.e. not "federated")? Can I tell somebody "call with your Riot client 'acqq at server ip nnnnnn' and we can talk"?

<comment><USER19> I believe so, yes. If not with the standard homeserver (synapse), than with a custom homeserver.

<comment><USER27> Note: my question is, with a plain client, downloadable from the app store, not with some special custom build of the client.

Also, how puringpanda's question fits to your claim?

[https://news.ycombinator.com/item?id=13239925](https://news.ycombinator.com/item?id=13239925)

<comment><USER19> You can connect to any homeserver with the default client; it's not tied to the default homeserver.

If I understand puringpanda's question, the idea is that your domain and your homeserver are seized, but you have contacts on other homeservers. At this point, it's just like losing your email server. You lose your existing ID, and probably your message history, but you can reach your contacts from a new ID you create someplace else.

</comment></comment></comment></comment><comment><USER9> Wow, riot has a ways to go. With signal you install it from the app store, it creates an icon, you click on it. Similar for the desktop client, go to the chrome app store, click on it, and it tells you to use your phone to scan a barcode.

In both cases you can start chatting with any signal user in your address book in a minute or so, no expertise (other than using an app store) needed.

Tracked down the [http://riot.im](http://riot.im), it has a "try now button", that just scrolls you to the top. Didn't see any way to actually try it.

I tried the ubuntu app, they make you manually create your own /etc/apt/sources.list.d, from only the base URL. Then you have to know how to add the pgp key. Then apt-get update, apt-get install riot-web. Then... nothing. Nothing called riot or riot-web in the path. Thought maybe there would be a daemon running (it's called riot-web afterall). Can't find any processes running, nothing listening on a new socket. I track down /var/lib/dpkg/info/riot-web.list, look through the list and find they dropped a dir in /opt. So I run /opt/Riot/riot-web.

It worked, not exactly the kind of thing I'd ask random friends/family/colleagues to do though.

</comment><comment><USER28> Does anyone know if they are planning to add a way to change home server. If they take your domain (With your Matrix server on it), you have no way of communicating with other people over riot anymore.

<comment><USER29> There are plans to support 3rd party identification (such as an E-Mail address or a phone number) and use that as a basis for looking up users across the network, but I don't think it is currently useable. Account migration was brought up recently in the chat room, but it is not defined anywhere in the spec or reference implementations AFAIK. I agree that these are both important features, but I wouldn't worry too much about them unless they are left out of the 1.0 spec.

In the meantime, it's not like you can migrate your Signal, Telegram, iMessage, or even Gmail/Hotmail accounts. I think Matrix needs a few more client/server implementations before the spec can't truly be set in stone.

<comment><USER30> Email identifiers work fine today, actually. They don't solve the problem of migrating accounts, but at least they abstract the discovery process away, as you say.

MSISDN (phone number) identifiers landed on the backend this afternoon; implementation in the Riot clients will be coming very shortly.

</comment></comment></comment><comment><USER31> Hear hear. Down with silos.

I just hope matrix ends up working better than xmpp.

</comment><comment><USER32> A question I've had about Signal is what is stopping Apple from modifying and rebuilding the source with a backdoor in it? Is this technically possible (seems like it would be since they control distribution of the binary to devices)? The article is correct in stating that web based chat is inherently insecure but it seems all iOS apps are also inherently insecure. I'm by no means an expert though so would love to hear from someone with more knowledge.

EDIT: Thank you for the responses! It pretty much confirms what I thought; Apple _could_ access your communication (either through keylogging at the OS level or backdooring Signal) but this solution is better than everyone use plain text communication. I personally would not trust Apple with my life if I needed that level of protection but maybe that's not the main use case for Signal.

<comment><USER33> Technically? There's nothing stopping them. For that matter, there's no stopping Google from doing the same. There's also no stopping Apple from patching LLVM so that only patched versions of OpenSSL are ever compiled against. The question is how paranoid are you and what is your threat model?

We have to trust someone, eventually. This is especially true for the 99% of the population who doesn't have the skill to compile source themselves (nor should they have to).

<comment><USER34> Just in case nobody has gotten to enjoy this gem:

[http://wiki.c2.com/?TheKenThompsonHack](http://wiki.c2.com/?TheKenThompsonHack)

Ken describes how he injected a virus into a compiler. Not only did his compiler know it was compiling the login function and inject a backdoor, but it also knew when it was compiling itself and injected the backdoor generator into the compiler it was creating. The source code for the compiler thereafter contains no evidence of either virus.

<comment><USER35> Which is why standardization is just as important, if not moreso, than openness in making sure things stay secure. Such an attack is made a lot more difficult if you have a second toolchain you can use to verify things, and even moreso if you have a third.

</comment></comment></comment></comment><comment><USER36> Riot? Can we talk about the edgy names? Think about how much differently history might have been if Napster was named Library of Alexandria.

"According to Galen, any books found on ships that came into port were taken to the library, and were listed as 'books of the ships'. Official scribes then copied these writings; the originals were kept in the library, and the copies delivered to the owners."

[https://en.wikipedia.org/wiki/Library_of_Alexandria](https://en.wikipedia.org/wiki/Library_of_Alexandria)

Sounds like Napster, yes? Think about how much harder it would be for Congress to pass laws shutting down the digital equivalent to a library sharing the world's music.

But no. We get names like Riot, and Felony ([https://github.com/henryboldi/felony](https://github.com/henryboldi/felony)). Congress sends you a "Thank you" every time you put an edgy name on something disruptive.

</comment><comment><USER37> > If OpenWhisperSystems adopts any policy that goes against users' interests > in the future, users cannot switch providers without losing all their > contacts.

Is this correct? I've never bothered looking it up, but Signal was connecting me with people in my phone's address-book.

<comment><USER19> It's semi-correct? You don't lose your contacts, as they're still stored in your phone's address book. But all of your contacts will have to jump ship at the same time as you, to the same silo. And your old contacts will only still be usable if the new silo also uses phone numbers as userids.

On Matrix/Riot, userids are federated in the same way as emails. So when you change providers, your userid changes, but your contacts' stay the same, and you can still connect with them from your new provider.

</comment></comment><comment><USER38> I have the impression that Signal by now has such a great brand name that mere technical objections won't affect its growth for a very long time.

<comment><USER39> I wonder if the name of Riot will be a hindrance for widespread adoption. Most people don't like riots.

<comment><USER40> I actually just learned today that Riot (the IM app) is not related to Riot (makers of hugely popular video game League of Legends). I thought the occasional mentions I was seeing of "Riot chat" meant that LoL's mobile chat client was gaining traction among people who don't play the game.

</comment></comment></comment><comment><USER38> The question I would ask is: given the list of capabilities presented in this post, is there even any difference between Riot and e-mail? Or are you reinventing the wheel?

<comment><USER13> Riot is most comparable to Slack or Discord. It has chat rooms. It supports voice, image posts, file transfer, etc. It stores conversation history. You can private message people.

Matrix is a generalized protocol for decentralized and federated communications; it's agnostic to the application layer provided by Riot. Something Matrix doesn't have, but is on the issue backlog, is support for email-esque thread contexts. [0]

[0] [https://github.com/matrix-org/matrix- doc/issues/492](https://github.com/matrix-org/matrix-doc/issues/492)

<comment><USER19> I would love to see an email - like application implemented on top of Matrix.

<comment><USER30> we're working on it :>

</comment></comment></comment></comment><comment><USER41> I support good alternatives to Signal that also have other goals in mind. Signal's goal is to become basically as mainstream as Whatsapp is, and to get there it needs to make a few compromises for usability's sake.

Whatsapp has already backtracked on some major privacy promises, and who's to say it won't backtrack on the end-to-end encryption support eventually, after everyone is baited and switched to it? Or worse, it could start to decrypt E2E communications in secret for governments.

So we need a "mainstream" alternative that's actually trustworthy and can at least protect the security of the communications, if not the relationships between users.

However, I support applications that aim to offer even better privacy and security compared to Signal, that are aimed at more opsec-sensitive targets, such as journalists. Signal may be the best tool journalists have right now, but it's probably not the best one they could have, as it doesn't do a great job at protecting sources. Perhaps Ricochet or the Tor Messenger may be better for that.

What I'm worried about though is that even if these apps offer better security/privacy features, the various federated applications that use an E2EE protocol may not have too much of a security mindset. For instance, sure, Riot may adopt a better protocol, but is Riot itself using all modern security best practices? Can we trust the Riot developers just as much as we do the OWS developers? etc

Finally, I'd much rather see Signal become a P2P application than a federated one, if that would even be possible.

<comment><USER9> Trick to p2p is that generally you have to accept incoming connections for it to work. In signals case that's the signal servers.

Originally skype did this, skype users with a good network connection, good uptime, and who accepted incoming connections could self promote themselves to a supernode. This allowed async messaging for others, helped introduce peers who couldn't talk directly because of IP Masq/NAT etc.

So it's possible that signal could write a small application that could be a supernode. Ideally it could run on a Raspberry Pi, Plug computer, or even any of the numerous opensource routers. What way your battery sensitive phone wouldn't get run down by participating in a DHT or similar, but your raspberry pi could act like your inbox and facilitate incoming and outgoing messages.</comment></comment>


Ask HN: What happened to Steve Yegge after 'quitting' - <AUTHOR>

The recent "I'm coding 180 websites' post inspired me to get a group of friends to commit to set aside some time for study hall to work on things once a week--hopefully more often. I used Steve's OsConn talk (google Steve Yegge Quits)to help show the value of study hall hours. Curious to know if anyone has heard an update on his goal of study hall hours everyday for an hour to learn math. Surprised there isn't a follow up talk, post or rant to that talk. Or have you had any success setting aside set time to work on side projects or just to learn something? <comment><USER2> He didn't quit. See his post:

[http://steve-yegge.blogspot.com/2011/07/hacker-news-fires- st...](http://steve-yegge.blogspot.com/2011/07/hacker-news-fires-steve- yegge.html)

"Hacker News Fires Steve Yegge" which is about how everyone misinterpreted what he said.

<comment><AUTHOR> yea that's why I threw the '' around quit. I don't think there was a misinterpretation at all. He did quit. He just wasn't specific to say that he was only quitting the so called cat projects and I'm just interested in how that's going. Did the study hall pay off and such.

</comment></comment><comment><USER3> _> "Or have you had any success setting aside set time to work on side projects or just to learn something?"_

Yes.

Several months ago I decided to get serious about re-aligning my career and the pursuit of a degree.

Creating a structured plan with a schedule and specific goals has been the most important part. Setting aside time is part of that.

I think treating my development more formally has been a huge help.

<comment><USER4> I recently enrolled in a local Uni as a freshman. You are right about treating development more formally, you just have to switch 'development' brain off. I was curious what kind of structured plan you have, is it just you daily schedule or something more long term?

<comment><USER3> _> "I recently enrolled in a local Uni as a freshman."_

Same here.

 _> "I was curious what kind of structured plan you have, is it just you daily schedule or something more long term?"_

It's mostly longer term on a scale of months to one year or several in the case of the degree.

For example, one goal is working through the entirety of Introduction to Algorithms [0]. I've set out dates by section for reading, completing problem sets and reviews. I've written these dates out along with my reasons for pursuing the goal and how I believe I will benefit from achieving it.

That might sound simple, but taking the time think these things through, and articulate them into something concrete was certainly useful to me.

This isn't the kind of thing I'd have done historically, but I've been trying to stay very open-minded to _anything_ that might help me reach the goals I've set. I follow the same process for any significant new goal.

I make a point to take (hand written) notes on everything I work on. At least once a week, I whiteboard what I've been reading or working on. There are going to gaps or things I completely blank on which become items for further review in the coming week.

I have yet to settle with a calendar or to-do app which I really like, for the moment, all these dates and tasks are either in a notebook I use daily or on my whiteboard for emphasis.

As much as possible, I try to create "artifacts" from the way I'm spending time. This can be notes, a quick summary of what I got from reading a chapter or article or an attempt at implementing something I read about.

I have a solid routine for my days made pretty necessary between my job and small child, but each day isn't entirely planned. I keep a shortlist of things that I work on in the same set of windows (early morning, commute, at work in the gaps, before bed) each day. I've cut out most anything that isn't family, work or study.

One thing I aim to stay strictly consistent about is waking (5:00). This gives me a little "extra" time before I wake my child up.

0: [http://www.amazon.com/dp/0262033844/](http://www.amazon.com/dp/0262033844/)

<comment><USER4> >> I make a point to take (hand written) notes on everything I work on.

I was not doing this intially thinking I dont have write down stuff if I understand it, Only to be completely lost and having to read and understand it all over again. Now I write everything down too.

I wish you all the best.

</comment></comment></comment></comment><comment><AUTHOR> [video] [http://www.youtube.com/watch?v=vKmQW_Nkfk8](http://www.youtube.com/watch?v=vKmQW_Nkfk8) (13:50 is the Study Hall)

</comment><comment><USER5> The next blog post he posted a few months later was all about how he spent the last few months playing this video game. Well, not entirely, there was a dig at google+ in there as well. But I'm guessing the study hall didn't happen...

Too bad too, because I also felt very inspired by his "I quit" speech and was looking forward to a follow up.

</comment><comment><USER6> He did a talk about Project Grok, a piece of internal Google infrastructure he created, back in April at an Emacs conference: [http://www.youtube.com/watch?v=uRO3dNJx5Dw](http://www.youtube.com/watch?v=uRO3dNJx5Dw)

</comment><comment><USER7> So he actually quit his job at Google in that speech, and not just some cat- picture project?

<comment><USER8> He didn't quit his job. He even wrote a follow up about how HN had misinterpreted what he said.

[http://steve-yegge.blogspot.com/2011/07/hacker-news-fires- st...](http://steve-yegge.blogspot.com/2011/07/hacker-news-fires-steve- yegge.html)

Separately, he also wrote a post that was critical of Google+ (he accidentally published publically what was supposed to be an internal post). He wrote a follow-up to that too saying nothing bad happened to him at Google.

</comment></comment><comment><USER9> As soon as his leaked piece on Google+ appeared, it was pretty much to be expected that he will be terminated (use whatever softer sounding euphemism you like). You can't just throw feces at your coworkers in public view and expect to be kept in the company.

<comment><USER10> That may have been some people's expectation, but as his public G+ page says[0], he still works at Google. Sergey called his piece a 'night-time aid'[1]. Also Steve's take on it [2].

That said, the OP was talking about his OSCON talk (check out from ~minute 13 onward): [https://www.youtube.com/watch?v=vKmQW_Nkfk8](https://www.youtube.com/watch?v=vKmQW_Nkfk8)

[0]: [https://plus.google.com/110981030061712822816/posts](https://plus.google.com/110981030061712822816/posts)

[1]: [http://www.nbcsandiego.com/blogs/press-here/Sergey-Brin- Stev...](http://www.nbcsandiego.com/blogs/press-here/Sergey-Brin-Steve-Yegge- Not-Fired-But-Hes-a-Windbag-132256573.html)

[2]: [https://plus.google.com/110981030061712822816/posts/AaygmbzV...](https://plus.google.com/110981030061712822816/posts/AaygmbzVeRq)

</comment></comment><comment><USER11> Steve Yegge is 100% talk and no action. He wants to go cure cancer? Well then dive right in and join the fight! I'm sure he has Google lucky megabucks so what he does with his remaining time on Earth is entirely up to his whims.

Those whims seem to be telling him to stay in his Google glass menagerie and enjoy what his keepers feed him and taking time to play and extensively critique _Borderlands_. And that's a fine and understandable hacker hedonist strategy, but please, STFU about "curing cancer" etc. (unless he's going to get in the ring(tm), which I seriously doubt he ever will).

But to be fair, I've seen this happen to a few of my friends who hit it big, and I think it explains why there are so few Elon Musks and James Camerons among us. Once Maslov's hierarchy has been topped off, it's like the insatiable drive to achieve that made that possible just evaporates.

<comment><USER12> Having just watched the video (YouTube: vKmQW_Nkfk8) I feel nothing you say takes anything away from what he said. Most of us, including Steve, get caught up in short term goals and many of us indulge in some sort of entertaining distraction from thinking about hard problems. That's why we're not the next Elon Musk or Steve Jobs. Even if I take your word for it, that you know Steve Yegge and have many friends who hit it big, how do their failings (which are also most of ours) detract from the ideal?

<comment><USER11> I'm not attacking his words, he's an eloquent guy.

But I'm personally not into motivational speeches, I'm a hard-core believer in follow-through and results (and little else). And while that has problems of its own, they're not the same ones as all talk and no action.

<comment><USER12> He actually has been working on a big data analysis problem for the last four years, which is presumably why he was asked to speak, so your characterization of him as all talk and no action is incorrect

[https://www.youtube.com/watch?v=KTJs-0EInW8](https://www.youtube.com/watch?v=KTJs-0EInW8)</comment></comment></comment></comment>


Mobile Web 2014: No Pinch, No Zoom, Tons of JavaScript - <AUTHOR> http://blog.mobify.me/2009/12/22/mobile-web-2014-no-pinch-no-zoom-tons-of-javascript/

<comment><USER2> "Mobile" sites are, more often than not, more annoying than helpful. If I've got a full browser in my phone, the right thing to do is almost always just to show me the regular site.

If you've got feature parity with your regular site and all those features work as well on my particular phone as they would if I was on the regular site, AND there's a good reason for the site to need to be changed to fit a small screen with a touch interface, then, fine, show me the mobile version.

<comment><AUTHOR> the latter is what we're trying to accomplish. Facebook, Google, YouTube all have great touch versions, why shouldn't everybody else?

<comment><USER2> I'd say the VAST majority of sites just plain don't need it. I say that because I read the web _all the time_ on my iPhone and it works just fine. I hardly ever even think about the fact that I'm viewing it on a mobile device, I'm just reading a web page.

Now, for certain sites where there's a benefit, mobile tweaks can be fantastic. But even among the three you list, I've had annoyances. I wish I could remember what it was I was looking for, but I was on google.com on my iPhone the other day looking for something (an app/service from Google itself, I think), and didn't find it in the spot I was used to. I was stumped for a few moments before realizing that I was on the mobile site. Likewise, I've gone to the Facebook mobile site before, trying to do something that wasn't possible from the Facebook iPhone app, and been confronted with the mobile site, which _also_ didn't have the feature I was looking for.

So I guess my feeling is this: while I was initially excited about the idea of mobile-specific sites, I now feel similarly about them as I do about Flash heavy sites: in theory, if everything is executed perfectly, they're fine. But perfection is very rarely achieved, and so it ends up screwing the user up in some unexpected, user-unfriendly way right when you need it not to. So my initial inclination is very much against more "mobile sites" (hey, if it really needs a touch specific interface, an app from the App Store is preferable -- yes, I know I'm being inappropriately iPhone-specific here!), though in favor of small mobile-specific tweaks to normal sites. Changes in font size or moving one column/sidebar somewhere else? Slight interaction changes to make things more appropriate for a tap interface? Sounds great! [And it strikes me that putting these at the level of CMS templates or design frameworks and the like might be the best route.] But a totally different site? Almost never necessary nor even an improvement when it's being used on a sufficiently sophisticated phone (which, they all will be, very very soon).

I know much of this overlaps with what you're talking about and forgive me if I'm being too kneejerk just to the idea of "more mobile-specific sites". It just always stings doubly bad when somebody has poured a ton of work into something that tries to make your life easier but in practice actually makes it harder.

Thanks!</comment></comment></comment>


Google Translate adds easter egg that recognizes the beatboxing hack - <AUTHOR> http://translate.google.com/#de|en|pv%20zk%20pv%20pv%20zk%20pv%20zk%20kz%20zk%20pv%20pv%20pv%20zk%20pv%20zk%20zk%20pzk%20pzk%20pvzkpkzvpvzk%20kkkkkk%20bsch%0A%0A <comment><USER2> Note: IF you have flash disabled, you will not see it, since the 'listen' feature is a flash applet

The easter egg is a simple 'beat box' icon below the original text much like the 'listen' icon under the translated text.

Edit: somebody in the thread uploaded a screenshot, thx: <http://i.imgur.com/4jd5y.png>

</comment><comment><USER3> If you add a real word in German after the beatbox text, it will read out the individual letters instead, no beatboxing. Example:

[http://translate.google.com/#de|en|pv%20zk%20pv%20pv%20zk%20...](http://translate.google.com/#de|en|pv%20zk%20pv%20pv%20zk%20pv%20zk%20kz%20zk%20pv%20pv%20pv%20zk%20pv%20zk%20zk%20pzk%20pzk%20pvzkpkzvpvzk%20kkkkkk%20bsch%0AAchtung)

</comment><comment><USER4> The conditions are German language and no consonants.

<comment><USER5> I think you mean no _vowels_

</comment></comment><comment><USER6> As some of the comments hint, the link is broken ( _de|en_ should be _de|de_ ); it translates from German to English. (The beatboxing "hack" only works with German-to-German translation.)

<comment><USER7> It did work for me using de|en

</comment></comment><comment><USER8> If you switch the languages, you get an hillarious example of probabilistic spelling suggestion gone too far:

[http://translate.google.com/#de|en|pv%20zk%20pv%20pv%20zk%20...](http://translate.google.com/#de|en|pv%20zk%20pv%20pv%20zk%20pv%20zk%20kz%20zk%20pv%20pv%20pv%20zk%20pv%20zk%20zk%20pzk%20pzk%20pvzkpkzvpvzk%20kkkkkk%20bsch%0A%0A)

<http://i.imgur.com/64eXg.png> <== What I saw.

</comment><comment><USER9> Ok so that's weird. I was just showing this to my sister earlier today and noticed that there was no Listen, just Beatbox.

Naturally I was delighted that they recognised the meme ... but, talk about a race condition. I thought this was nothing new and here were are, a 48 minute old HN submission whereas I was showing my sister probably 50 minutes ago.

Slightly related, the first hit on google for "google beatbox" is translate.google.com

<comment><USER10> Don't worry; it's been there for a few days already ...

<comment><USER11> more than a week, actually...

</comment></comment></comment><comment><USER12> Is it really an easter egg? To me it seems more like they "fixed" it and broke the beatboxing trick in the process.

You can still add dummy vowels to the word to make it sound beatboxy

<comment><USER13> You missed the easter egg. Look harder.

<comment><USER14> I don't see any "Beatbox" button, it says "Listen".

<comment><USER15> On the left, under the text input box.

Screenshot: <http://i.imgur.com/4jd5y.png>

<comment><USER16> The "beatbox" link is absent for me, and the "listen" link is present but doesn't work for me. _shrug_

</comment></comment></comment></comment></comment><comment><USER17> I'm not familiar with whatever the original "beatboxing hack" was. Could someone please provide a little bit of background?

<comment><USER18> Make it translate from german to german and press the 'listen' button. Here's the original 'Google Beatbox' topic: <http://news.ycombinator.com/item?id=1952356>

</comment></comment><comment><USER19> The button is there, but it doesn't work on Linux(Ubuntu 10.04 with Chromium). The regular listen button does work.

<comment><USER7> Worked on both Chromium 8.0.552 and Firefox 3.6.13 on Ubuntu 10.04. Flash issues probably?

</comment></comment><comment><USER20> Ha!

If you edit the beatbox text, Google helpfully asks "did you mean ... ?" and suggests the original text.

</comment><comment><USER21> The "listen" button now just reads the letters, which is still pretty funny.

<comment><USER22> I didn't see the Beatbox button first and thought she now sings the letters, like <http://translate.google.com/#de|en|pvpvpvpvpvpvpvv%0A>

Other languages yield interesting sounds too [http://translate.google.com/#de|es|pvpvpvpvbvbvbvbvpvpvpvpva...](http://translate.google.com/#de|es|pvpvpvpvbvbvbvbvpvpvpvpvatatatat%2C%20pvpvpvpvbvbvbvbvpvpvpvpvudududud)

</comment></comment><comment><USER23> The thing that really surprised me is that at first someone made a beatbox with MISUSING Google Translate! but now google instead of (for example) banning that misusing, has created a tool to help you enjoy Google Translate in any way you like! even if it's not it's original purpose!!</comment>