LinkedIn 'Intro'duces Insecurity - <AUTHOR> http://www.bishopfox.com/blog/2013/10/linkedin-intro/ <comment><USER2> One of the other subtle things they do with metadata is their fascination with IP addresses.

Intro will enable LinkedIn to have the IP address of all of your staff using it, and thus (from corp Wifi, home locations of staff, popular places your staff go) they will know which IP addresses relate to your staff members (or you individually if you are the only person on a given IP).

This means that even without logging onto LinkedIn, if you view a page on their site they can then create that "so and so viewed your profile", which is what they're selling to other users as the upgrade package to LinkedIn.

Worse than that, as a company you can pay to have LinkedIn data available when you process your log files, and from that you know which companies viewed your site. And that isn't based on vague ideas of which IPs belong to a company according to public registrar info, this is quality data as the people who visited from an IP told LinkedIn who they were.

Think of that when you're doing competitor analysis, or involved in any legal case and researching the web site of the other party.

And VPNs won't help you here, as you'd still be strongly identified on your device and leaking your IP address all the time.

There are so many reasons why this LinkedIn feature needs to die a very visible and public death, and very few about why it should survive. It's a neat hack for sure, but then so were most pop-up and pop-under adverts and the neatness of overcoming the "impossible" is no reason this should survive.

<comment><USER3> _Worse than that, as a company you can pay to have LinkedIn data available when you process your log files, and from that you know which companies viewed your site._

To give a real world example of how true this is, I have a friend that owns a service company. He subscribes to Visistat for which he embeds a small snippet of Javascript into every page in his site. He uses a product of theirs called LeadCaster which then identifies the company name and often the contact name of people that visit the site. How does it do this? Look at Visitstat's Learning Center for an explanation:

 _NOTE: Contact information is supplied by the contact databases of Data.com (formerly Jigsaw), NetProspex and LinkedIn. Not all information will be available for every company and listing, however, your reports will show all the data we are able to access for you._

So for a real world example that he told me about a few hours ago, a lady was on his website. She left without doing anything more than viewing a few pages. Through Visistat, he was able to get her company name and contact information from LinkedIn. He looked up the phone number for her company and called her. He then said, "I understand you're interest in ..." She replied, "How did you know I am interested in ...?"

This is spooky as shit and almost made me delete my LinkedIn profile today.

<comment><USER4> Someone told me over the weekend that some companies use your cookies to track down prices and adjust their prices based on your surfing behavior.

These friends of mine discovered it while browsing an airline website, each with his own laptop, only to discover different prices being offered. Which they found very strange, given they were seated next to each other.

After cleaning the browser history and visiting the same web site with anonymous mode on, both got the same prices being offered.

<comment><USER5> I heard that Airlines do not like you shopping around for prices from someone who did this research. They log you when you first come on their site. If you come back 2-3 days later, they will jack up the price, presumably to scare you into buying tickets.

<comment><USER4> Yes, I heard the same story from these friends as they were telling me this.

One of them works for a travel agency.

<comment><USER6> What's the best work-around to avoid this price jack?

<comment><USER7> clearing cookies, or just using incognito mode in whichever browser you are using usually does it. They've been doing this for at least a decade now, IIRC.

<comment><USER8> I'm surprised it's legal. Didn't Amazon have to backtrack on something like this?

<comment><USER9> They did backtrack, but because of PR reasons, not legal ones. Unless there are antitrust issues, it's perfectly legal to offer different prices to different customers.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> Giving away email credentials to a third party service, regardless of reason, should be both covered in your internal training materials, as well as be maintained as a firing offense.

This is really just a case of well-branded spearphishing. You should already be protecting against that.

<comment><USER11> > This is really just a case of well-branded spearphishing.

Spearphishing is distinguished from phishing more generally by having very narrow, specific target selection.

If we are going to look for a analogies to techniques of catching fish, this is more weir phishing than spearphishing.

</comment></comment><comment><USER12> Seems like Linkedin have posted an update on [http://engineering.linkedin.com/mobile/linkedin-intro- doing-...](http://engineering.linkedin.com/mobile/linkedin-intro-doing- impossible-ios):

Update, 10/24/13

We wanted to provide additional information about how LinkedIn Intro works, so that we can address some of the questions that have been raised. There are some points that we want to reinforce in order to make sure members understand how this product works:

\- You have to opt-in and install Intro before you see LinkedIn profiles in any email. \- Usernames, passwords, OAuth tokens, and email contents are not permanently stored anywhere inside LinkedIn data centers. Instead, these are stored on your iPhone. \- Once you install Intro, a new Mail account is created on your iPhone. Only the email in this new Intro Mail account goes via LinkedIn; other Mail accounts are not affected in any way. \- All communication from the Mail app to the LinkedIn Intro servers is fully encrypted. Likewise, all communication from the LinkedIn Intro servers to your email provider (e.g. Gmail or Yahoo! Mail) is fully encrypted. \- Your emails are only accessed when the Mail app is retrieving emails from your email provider. LinkedIn servers automatically look up the "From" email address, so that Intro can then be inserted into the email.

</comment><comment><USER13> Are Linkedin still working out of Mom's garage? Do they not have a single person on staff capable of looking at the current environment regarding internet privacy and say, "Uh, guys...maybe put this one on ice for a year..?"

<comment><USER14> Remember, LinkedIn has grown so much in part because so many people are willing to _hand over their email passwords_ so LinkedIn can take a look at their contacts.

LinkedIn knows exactly how many people will hand over full control of their email if it means that they have a better chance of finding a better job.

<comment><USER13> Think I have to agree with you on that. Despite all the umbrage from HN, etc crowd, they prolly know it isn't really hurting them & the financial rewards are great.

Just doesn't seem like the greatest marketing strategy at the moment :-)

</comment></comment></comment><comment><USER15> What's the difference between this and using an app such as Mailbox?

<comment><USER16> Asked the same question, but nobody answered. [https://news.ycombinator.com/item?id=6601179](https://news.ycombinator.com/item?id=6601179)

<comment><USER15> I mean, Mailbox literally does the same thing (editing your messages on their backend -- [http://www.mailboxapp.com/blog/?p=1#javascript-now- filtered-...](http://www.mailboxapp.com/blog/?p=1#javascript-now-filtered- from-mailbox-messages)) and no one cares. LinkedIn does it and the Internet goes shit crazy.

<comment><USER17> I have never heard of Mailbox before, but I have heard of LinkedIn.

<comment><USER18> Mailbox is part of Dropbox

<comment><USER19> Worth noting is that they originally were not. [http://techcrunch.com/2013/03/15/mailbox-cost-dropbox- around...](http://techcrunch.com/2013/03/15/mailbox-cost-dropbox- around-100-million/)

</comment></comment></comment></comment></comment></comment><comment><USER20> This is ridiculous. LinkedIn is offering a feature, optionally, to users who chose to install it. They have been upfront about how it works. If you don't like how it works, don't use it. Problem solved, myopic holier-than-thou rant avoided.

<comment><USER21> Do you honestly believe that most users who will install this will fully understand the ramifications of that choice? if yes, why do you think that, in spite of all the evidence that most users are clueless about security? If no, then in what sense are they really giving consent, if that consent is not informed?

<comment><USER22> Maybe we should also ban junk food. I mean, I'm sure many people don't "fully understand the ramifications of that choice".

<comment><USER23> Are you really saying people don't understand junk food is unhealthy to the same degree they don't understand IT?

<comment><USER22> The idea is to be consistent, not please the majority.

I can't say if people's understanding of how junk food is bad for them is greater than their understanding of internet security, but I wouldn't say that they're fundamentally different things.

My point is that "what people understand" is not universal, and is highly subjective. We can't assume that everybody understand why alcohol, smoking, junk food, lack of physical activity, medecine, etc. are potentially "bad" for them. Yet, we don't ban most of these things "in case some people don't understand"?

We teach people about health and nutrition, why shouldn't we do the same about IT (I mean, it's such a huge part of our lives now that we can't ignore it)?

Too many people jump on the "prohibition" train, when it's rarely the best solution. Rather than limit what companies can do (it's rarely objectively bad, they're offering users a feature in exchange for a subjective downside. I would focus on teaching people, not limit what can be done.

But maybe that's just me.

</comment></comment></comment></comment></comment><comment><USER24> > 1\. Attorney-client privilege.

Really? I guess you better have your own SMTP server set up then, or hope your email provider is willing to go to bat for your rights...

> 8\. If I were the NSA…

Yeah, it sounds like they definitely have needed it so far...

5 other of the things are basically the same point, remade in 5 different ways. This is a really weak list. There are certainly concerns, but most of these problems are symptomatic of our email system as it is. And have we all forgotten how crazy everyone went when we found out google was going to start advertising in Gmail?

<comment><USER25> Incidentally, many lawyers and law firms run their own mail servers for precisely this reason.

<comment><USER26> I think there's more to it than that. They want audit trails and backups, they don't want you reading email from unapproved devices, etc.

<comment><USER25> Yes, but it's a part. When I was a law student, confidentiality was named as the main reason why we weren't allowed to use Gmail for legal clinic work. If you just want audit trails and backups, there are other ways of accomplishing that don't involve outright banning use of a third party mail service.

<comment><USER27> "why we weren't allowed to use Gmail for legal clinic work."

Since that time (I assume this was a while ago, i can't imagine it was recent since most of these schools now use hosted email providers), almost every single state has issued opinions stating that storing email with a cloud provider does not break privilege.

AFAIK nobody has cared much since New York's ethics opinion in 2008.

<comment><USER25> Nope, this was still the rule for Berkeley as of 2012. Since then though, they've been replacing Berkeley's prior system with a Google apps. I'm not sure if that changed anything.

I should also note that there have been a couple of cases since 2008 where courts ruled that use of an employer's e-mail system broke privilege with respect to that employer. See, e.g., Holmes v. Petrovich, 191 Cal. App. 4th 1047 (Jan. 2011). It might be a stretch, but I could see someone trying to argue that Gmail use voided A/C privilege with respect to a lawsuit against Google.

<comment><USER27> There are also a lot of court cases the other way, and those cases were more about employment agreements, handbooks, and TOU, than they were about by general privilege breaking by using a cloud email provider.

</comment></comment></comment></comment></comment></comment></comment><comment><USER28> LinkedIn just seems overwhelmingly sleezy to me. How do they keep getting away with this stuff?

<comment><USER26> People tell LinkedIn "Please, please, pretty please build something that lets me view LinkedIn contact info while reading email on my phone." LinkedIn builds it.

<comment><USER29> > People tell LinkedIn "Please, please, pretty please build something that > lets me view LinkedIn contact info while reading email on my phone."

Did they? Did they _really_?

<comment><USER26> No. LinkedIn spent considerable effort building something that nobody wants and nobody will opt into.

<comment><USER30> I think you're joking, but we both know this isn't the first time they've done that.

</comment></comment></comment></comment></comment><comment><USER31> I wonder if they called it "intro" to make it impossible to google for so that no one can ever figure out what they're agreeing to when they install it.

What does the sig it appends look like? I will have to make sure to never send email to anyone who has the tell-tale "I opt into spyware" flag.

</comment><comment><USER32> Nicely stated, what I didn't see mentioned was the iframe it introduces into the mail. It can use this iframe to collect all kinds of additional data about you.

In the first instance I thought this was an app that was running in the background on your phone, I would have called that _doing the impossible_. This is just a MITM, and not a very good one at that.

</comment><comment><USER33> I'm not saying 1 bad turn deserves another, but this is no worse than what any company operating at scale does when they serve https through a gateway service (Scrubbers, CDN, whatever).

</comment><comment><USER34> To celebrate this, I removed LinkedIn apps from my devices.

<comment><USER22> Do you expect some kind of reward? Sheep of the year maybe?

<comment><USER35> There's no need to be mean to people doing something you agree with.

<comment><USER22> Whether I agree or not is not the point. It was a "me too" comment, and I made sure to point it out.

Could I have done a better job at it? Probably.

</comment></comment></comment></comment><comment><USER36> This idea is such a disaster I don't even know how it was allowed to see the light of day. The sad fact is that there are untold numbers of people who will install this monstrosity.

Serious questions though, if you are an IT shop - how do you defend against this trojan horse app?

<comment><USER37> Maybe you can scan email coming into your corporate accounts, looking for LinkedIn SMTP servers in the headers? It may then be straightforward to find out (after the fact) if your users are using this service.

Aside: as Raymond Chen often asks, "What if two companies did this?" Can you layer this service with a hypothetical similar one from Facebook? If not, it seems like a huge first-mover advantage.

<comment><USER36> Right, first mover. I'm afraid LinkedIn has selfishly crossed a line that we will all suffer for. Other companies will no doubt try to do similarly idiotic things in the name of "convenience", "features", etc.

</comment></comment></comment><comment><USER38> Related: [https://news.ycombinator.com/item?id=6430893](https://news.ycombinator.com/item?id=6430893)

"LinkedIn Founder says 'all of these privacy concerns tend to be old people issues.'"

The bit about privacy starts at the 13 minute mark.

</comment><comment><USER39> I desperately want to delete LinkedIn, but I am also looking for my first developer jobs in the tech field. In my former field, no one would ever ask for your LI profile. You send a resume, link to a resume, whatever. In the tech field, every single company I've interviewed with so far has looked at my linkedin profile before our interview and specifically requested it. Until the field changes, or I have a stronger status as a developer, I feel I have to be there or get overlooked for someone who is there.

<comment><USER40> Simply tell them you don't use it because of ethical reasons, and explain why if asked. If you would like a replacement then check out [http://careers.stackoverflow.com/](http://careers.stackoverflow.com/) (requires a certain amount of SO rep or an invite, which I would be willing to give but I see no way of doing that with you).

</comment></comment><comment><USER41> In other news, e-mail is an insecure protocol and most people transmit in the clear and don't have their own e-mail infrastructure anyway.

It's interesting this "blog post" came from a professional security company who makes it money from scaring individuals and companies about security threats.

Is it just me, or is this firm even worse than LinkedIn?

</comment><comment><AUTHOR> I wonder how this affect BYOD to work. Corporations would be furious to have their email content scanned by linkedin.

</comment><comment><USER42> Well lets take these one-by-one:

\</comment><comment></comment><comment>-

1\. Attorney-client privilege.

I'm guessing most law firms use third party email servers, anti-virus, anti- spam and archive/audit systems which this would also apply to. It would also apply if you're using Raportive, Xobni or the like (or integrated time- tracking, billing, crm, etc.).

\</comment><comment></comment><comment>-

2\. By default, LinkedIn changes the content of your emails.

Irrelevant. Unless you read your emails in plain text every modern email client changes how email is displayed.

\</comment><comment></comment><comment>-

3\. Intro breaks secure email.

Yes. Except iOS mail doesn't support crypto signatures anyway.

\</comment><comment></comment><comment>-

4\. LinkedIn got owned.

Yes. LinkedIn adds an extra point of vulnerability.

\</comment><comment></comment><comment>-

5\. LinkedIn is storing your email communications.

Well metatdata but yes.

\</comment><comment></comment><comment>-

7\. It's probably a gross violation of your company's security policy.

Yes. As is using Linkedin itself. Or Dropbox. Or Github. Or Evernote. Or Chrome. Or any enterprise software that uses the bottom up approach.

\</comment><comment></comment><comment>-

8\. If I were the NSA…

The NSA has access to your emails if they want them anyway. Email isn't a secure protocol against a well funded adversary.

\</comment><comment></comment><comment>-

9\. It's not what they say, but what they don't say

This looks like a semantic dispute, but it doesn't look any more vague than say Google's privacy policy. Companies in certain circumstances are legally required to provide access to information.

\</comment><comment></comment><comment>-

10\. Too many secrets

These all seem to be questions that can either be answered by testing or ones that LinkedIn would probably be happy to disclose, but unlikely to be major issues to mainstream users.

\</comment><comment></comment><comment>-

So fundamentally it comes down to two points, granting Linkedin access to your email creates a new point of attack and Linkedin themselves might use your email in ways you find undesirable.

So it's essentially a trade-off for the benefits you get from the app versus those risks. For a personal account which you use for private emails, personal banking, etc. the evaluation is obviously going to be very much different from say a salesperson's work account which they use for managing communication with leads.

In the later case they may already be trusting LinkedIn with similar confidential information and already use multiple services (analytics, crm, etc.) that hook into their email so the additional relative risk might be smaller.

As people with technical expertise we shouldn't use scare-mongering to push our personal viewpoints upon those with less expertise, but rather help people understand the security/benefit trade-offs that they're making so they can decide for themselves whether to take those risks.

It's important to treat the wider non-technical community with respect and as adults capable of making their own judgements and not as kids who need to be scared into safety.

<comment><USER31> > 7\. It's probably a gross violation of your company's security policy. > > Yes. As is using Linkedin itself. Or Dropbox. Or Github. Or Evernote. Or > Chrome. Or any enterprise software that uses the bottom up approach.

I doubt I could even find a company that prohibited accessing LinkedIn from a work computer anymore. Many don't disallow installing software either.

If you truly believe what you wrote, you almost certainly believe accessing work email from a personal device is prohibited at typical companies. Maybe this is true at large companies, but not anywhere I've worked.

Your argument has no validity. You claim that it's absurd for IT to differentiate between "sending your email to your phone" and "sending your email through a third party with no connection to email deliverability and no business relationship"

<comment><USER42> Apple prohibits developers from listing details of what they're working on on their linkedin profile for trade secret reasons.

Countless companies prohibit salespeople from connecting to potential leads on linkedin to prevent it leaking to competitors.

I'm guessing you've not worked in enterprise because it's pretty normal to have a company policy on "bring-your-own-device" (typically companies will only allow access from devices that meet security requirements on password, anti-virus, etc. often they'll also require the ability to remotely wipe your device)

<comment><USER43> Every (serious) company prohibits it's employees from disclosing secret information, be it Linkedin or by phone, and even verbally with your friends. That doesn't mean it's forbidden to use Linkedin, make phone calls, or talk to people.

</comment></comment></comment></comment><comment><USER44> The thing that I find interesting is if LinkedIn goes ahead and does this, how many other companies will want to join the bandwagon and then we'll end up with our email being bounced around through a slew of different proxies so everyone can add their spam and ads to it.

<comment><USER40> And with each one trying to remove the content produced by the others in some "clever" way.

</comment></comment><comment><USER45> seriously? this is what Intro is? how is it not a bigger deal?people get upset over the littlest Facebook changes, but something this big barely shows up?

<comment><USER46> Probably because you have to explicitly enable this. With Facebook changes you don't get the choice.

</comment></comment><comment><USER47> I'm still not able to believe if I read that right. Does LinkedIn _really_ re- routes your emails to their servers in their entirety? I looked at their announcement and video at [http://blog.linkedin.com/2013/10/23/announcing- linkedin-intr...](http://blog.linkedin.com/2013/10/23/announcing-linkedin- intro/). There is NOT even a hint of disclosure that they are doing this. I can imagine 10 ways to achieve the similar user experience without re-routing entire emails. So if this is true, LinkedIn really really fundamentally screwed up with customer trust.

</comment><comment><USER48> I just can't fathom how something so ridiculous could pass so many engineers at LinkedIn, without raising flags on how bad this is. The moment I saw the word "proxy" I cringed!

</comment><comment><USER49> I wonder how's Rapportive doing this days. That is, whether this plug-in seats in people's GMail app and sends out data to LinkedIn or not.

After all, we are talking about the same team more or less, and surely the same company who owns Rapportive today.

If my concerns are real. One might find this is ironic that Rapportive was backed by YC and Paul Buchheit, the creator of Gmail, and now this very company violating GMail users' privacy.

<comment><USER50> Yikes. I've still been using Rapportive, but learning that it's being adapted into this monstrosity has instantly dissolved any trust I had for the product. Removing it now.

</comment></comment><comment><USER51> Related: [https://news.ycombinator.com/item?id=6600597](https://news.ycombinator.com/item?id=6600597)

</comment><comment><USER52> > Intro breaks secure mail.

If it's modifying the message, it likely breaks DKIM too. meaning your messages will be more likely to be flagged as spam.

More generally, this is the catalyst for me leaving LinkedIn. They've never generated any new business (not even a single lead), and if I'm honest the only reason I use it is more about my ego than anything useful.

</comment><comment><USER53> The idea itself is not that compelling that I would install it even if it fulfilled all the criteria of security.

</comment><comment><USER54> Good thing I use gmail.

<comment><USER55> Good for you. Google Tells Court You Cannot Expect Privacy When Sending Messages to Gmail [http://www.consumerwatchdog.org/newsrelease/google-tells- cou...](http://www.consumerwatchdog.org/newsrelease/google-tells-court-you- cannot-expect-privacy-when-sending-messages-gmail-people-who-care)

<comment><USER56> This is incorrect. Completely out of context and actually quite the opposite to what happened.

[http://www.techdirt.com/articles/20130814/14262524177/](http://www.techdirt.com/articles/20130814/14262524177/)

</comment></comment></comment><comment><USER57> That shows that no engineer has any say in what linkedin does. I can't imagine any tech security aware individual would take such responsibility upon himself.

How did the C-people even found out such thing is possible? Some intern who just found out how mail works probably was flapping his jaw too much.

</comment><comment><USER58> Is this claim true? I thought the Feds were claiming that using _any_ hosted email (Gmail, Hotmail, etc), is considered a 3rd party subject to subpoena.

> These communications are generally legally privileged and can't be used as > evidence in court – but only if you keep the messages confidential.

</comment><comment><USER52> Opportunity time... are there any more scrupulous alternatives to LinkedIn?

</comment><comment><USER59> So make a plugin for your email client which raises a little Intro flag when you receive an email from an Intro user.

</comment><comment><USER60> Hmm if enough people complain Apple might close this feature. At least it's opt-in. As for me, I would say no.

</comment><comment><USER61> Shocking how something like this came out of Linkedin and Apple has not booted them from the App store yet?</comment>


PHP Function For Dealing With Quotes In Input Fields - <AUTHOR> http://www.breathteching.com/2008/03/24/function-for-dealing-with-quotes-in-input-fields-in-htmlphp

<comment><AUTHOR> I know how simple this function is, but I had an old fashioned PHP function I used that was about 5 or 6 lines long that did this exact same thing so I thought I would post the URL for anyone else that wanted help. I did not include the code in the comment because I do not want to take credit for it... even if it is a simple solution.</comment>


Bcrypt is now obsolete - <AUTHOR> http://www.daemonology.net/blog/2009-05-09-scrypt-key-derivation.html <comment><USER2> If you could come up with a less bait-y title, I'd agree with you. :)

We'd use the term "adaptive hashing" or (less accurately) "key strengthening", but it wouldn't be actionable. Bcrypt is actually still current, since very few stable implementations exist for your algorithm, and you are surely not recommending people implement their own crypto.

It's good work though, and I look forward to recommending it, when it becomes reasonable to do so.

<comment><USER3> I think we should do something about the bait-y titles on HN in general. Titles should be descriptive and succinct.

Maybe a better title here would have been "bcrypt's use of MD5 makes it insecure compared to scrypt". (I don't know how to best word the title; I would have not submitted the article, since I'm not an expert on security.)

<comment><USER4> _I think we should do something about the bait-y titles on HN in general. Titles should be descriptive and succinct._

Sometimes the same story is posted multiple times. One post will have a bait-y title and the other will have a boringly accurate and truthful title. Of those two, one of them always disappears with 3 or 4 votes and the other climbs the front page charts. Exhibit A:

      A Comparison of Approaches to Large-Scale Data Analysis: MapReduce vs. DBMS
      vs.
      Parallel DBMSs faster than MapReduce

Then there are the science articles with accurate titles and hypetastic titles. Exhibit B:

      Long-Distance Teleportation Between Two Atoms Achieved
      vs.
      Scientist Teleport Matter More Than Three Feet

So, it's not like the descriptive titles aren't already there waiting to be promoted, it's just that hyperbole always wins in the marketplace of up-arrow clicks.

</comment></comment></comment><comment><USER5> I don't know this guy. Probably he is really famous (?), but I'd rather wait until his scrypt sees widespread adoption before I follow his lead.

<comment><AUTHOR> _I don't know this guy._

You do now. :-)

<comment><USER6> Has anyone besides yourself yet vetted this 'key derivation function' (and perhaps you wouldn't mind shortly explaining the difference between a KDF and a cryptographic hash function)?

<comment><AUTHOR> _Has anyone besides yourself yet vetted this 'key derivation function'_

Not yet.

 _perhaps you wouldn't mind shortly explaining the difference between a KDF and a cryptographic hash function_

Cryptographic hash functions produce fixed-length collision-resistant output, ideally as fast as possible. KDFs can normally produce arbitrary lengths of output, and don't need to be fast -- in fact, being fast is a disadvantage, since secure KDFs are expensive to compute (because they need to resist brute- force attacks).

</comment></comment></comment></comment><comment><USER7> A side note: The name "scrypt" is no so good in terms of googling. A search for example for "scrypt python" brings up over 7 million hits for Python scr _i_ pt. Maybe once more pages about scrypt exists it will stand up, but anyway the name could be more unique.

<comment><USER8> Try this.. <http://www.google.com/search?q=%22scrypt%22+python>

Search for "scrypt" python

<comment><USER7> I know, but it brings 2710 results, and I am pretty sure the link to my and your comment (number 5 and ~15 in Google) are the only one related to this derivation function.

</comment></comment></comment><comment><USER9> It's stated that scrypt is 4000 times harder to break than Bcrypt (I don't know how this is calculated, so it's probably an estimate). Given that password cracking can be easily parallelized is this enough of an improvement?

<comment><USER10> Did you read the paper? The whole point of the thing is to make it non- parallelizable. That's what makes it hard.

<comment><USER9> I did not read it, but I can't imagine what would prevent an attacker from running a parallel attack on multiple circuits/computers that aren't sharing any resources...

<comment><USER11> The idea is to make the KDF expensive in space as well as time. While bcrypt costs a few seconds of CPU time, it uses only a tiny amount of RAM, thus underutilizing the resources you have available. Thus, you can parallelize an attack using lots of specialized ASICs but only a commodity amount of storage. Scrypt would require you to purchase lots of RAM for every ASIC, making a brute force attack much more costly.

<comment><AUTHOR> _Thus, you can parallelize an attack using lots of specialized ASICs..._

More to the point, you can parallelize attacks on most KDFs by building an ASIC with many copies of a password-cracking circuit. With scrypt, the vast majority of the IC area (and thus cost) is RAM.

</comment></comment></comment></comment></comment><comment><USER12> _this means that a five-character password using scrypt is stronger than a ten-character password using openssl._

Not a crypto expert, but don't most people crack passwords by just running common words or every possible combination of N characters through your encryption system, therefore as long as your encryption mechanism is _good enough_ it doesn't matter what you use?

<comment><USER13> Not a crypto expert either, but I took this to mean that each attempt in a brute force attack is orders-of-magnitude more costly, so that trying all combinations of 5-character scrypt passwords takes as long as trying all 10-character combinations with bcrypt.

<comment><AUTHOR> That's almost correct. Replace "takes as long as" with "costs as much as" and you'd be exactly right.

Basically what it comes down to is that with bcrypt (and all the other widely used KDFs) it's vastly cheaper to attack the KDF with a custom circuit than it is to buy general-purpose computers and run a software key cracker. With scrypt the advantage that TLAs with ASICs have is much smaller.

</comment></comment></comment><comment><USER14> Since you have an implementation I don't have to manually extract from a library deep inside the OpenBSD source tree I think I'm going to take a look at replacing bcrypt in an application I'm working on.

</comment><comment><USER15> I would really like to see Bruce Schneier's opinion on this.

<comment><USER14> He called it pointless 'security theater' and recommended using a faster algorithm like MD5 to reduce delays at security checkpoints since terrorists will just print their own boarding passes anyways.

<comment><USER6> He would call it that _when applying this solution to that specific problem_. In general, I don't think he would say that when the proposal is that people should use scrypt to hash the passwords they store.</comment></comment></comment>


My computer audio setup is better than yours - <AUTHOR> http://kerr.io/just-blew-my-mind-with-this-amazing-audio-upgrade/

<comment><USER2>
      >I was always under the impression that I had an audiophile worthy setup especially considering that I've spent upwards of $300 on headphones like Beats by Dre or Skull Candy.

This actually tells you how much of an 'Audiophile' he is. A true Audiophile will actually see through the marketing crap out of these brands like Beats by Dr.Dre et al, because they aren't really Audiophile grade. Skull Candy is never really Audiophile grade. It's one of the shittiest manufacturer of headphones, which have cheap chinese-designed and chinese-manufactured drivers that distort at high volumes.

Most of these guys who claim themselves as Audiophiles are usually victims of Psychological marketing - I tell you to close your eyes and listen to the sounds you've never heard before and after you hear them by willfully paying much attention to detail than you ever used to, I tell you it's because of the headphones you're wearing right now and it's Audiophile-grade. Bang! My $500 headphone sold! (Bose is very good at this)

A note to my fellow HN'ers - When reading articles like these, please take them with a grain of salt. In the world of audio, brands aren't important at all, it's the product that matters. It's logical to say that product A by Brand A is better than product B by Brand B, rather than simply assuming all products by Brand A are great.

As a headphone collector (I own 40+ models), I can tell you that the popular $450 Sennheiser HD650 Headphones he references are over-priced and you can get a better (excellent, actually) headphones for less than half the price, from a not-so-popular brand. The Pioneer SE-A-1000 (Google it out).

But, it is important to note that the world of Audio is incredibly subjective and what one person likes may be the worst choice for another. Always _listen_ to something before buying them.

Usually the differences in Sound Quality between a $1500 headphone and a $500 headphone are marginally low (unlike what the author claims) and are not worth the price difference, unless you are making a living out of Audio monitoring, etc.

>you'll hear things you've never heard before. It's like these new details were added to the music and it just blows you away.

Stay away from such ambiguous claims. a)It's highly subjective, b)It's the after-effect of Psychological marketing.

>I listen to Apple Lossless music files and watch a lot of movies on my notebook and I wanted superb audio.

From the excerpt that the author provides, it is clearly evident that he is just getting started (it's not a bad thing at all). But what is not right here is _misleading_ people into believing something that is not true, especially when you are just getting started yourself.

[Edit] The author is trying to flaunt that he listens to _only_ lossless music, but fails to tell you how even Lossless music can suck at times. As daeken and greyfade point out, It depends on the input content while the audio was recorded. Simply by listening to lossless music you won't discover 'sounds you've never heard before' as the author claims. You need to listen to good versions of these lossless audio files.

Ok, enough bashing...as for a simple in-expensive set-up, yet incredibly clear Audio, here's a combo for all you fellow HN'ers -

The Sony MDR V6 (Legendry Monitoring headphones, actually) + a Fiio E11 headphone amplifier.

It's inexpensive and it's amazing for its price. Try it out and let me know.

Thanks for reading.

<comment><USER3> > A 1500kbps FLAC will definitely sound multitude levels better than an > 800kbps FLAC. The same is the case for any other lossless container. The > bitrate matters.

This is completely, objectively false. The bitrate of a lossless file depends 100% on the compressibility of the file. By definition, if you take a piece of data and pass it into a lossless encoder (FLAC, ALAC, ZIP, ...) and then pass that to the respective decoder, you get out the original piece of data; that's what lossless _means_.

The only time quality comes into play is when considering the input quality, not the compression.

<comment><USER2> Thanks, updated

</comment></comment></comment><comment><USER4> An interesting thing to note: Some audiophiles enjoy features that stray from perfect reproduction of music. Music can feel/sound better on a sound-system that introduces slight overdrive, saturation, warmth. Audiophiles will go for tube amps and vinyls, because they subjectively sound better.

However, it is possible to get a more accurate reproduction of sound at a lower price with an external audio interface, a pair of studio monitors and a sub. Here's a bargain list:

      2 x Yamaha HS50M Speaker (2 x $200)
      1 x Yamaha HS10W Sub ($400)
      1 x MOTU MicroBook II Audio Interface ($250)
      4 x TRS/XLR Cable (4 x $20)

So to hear every detail in a track costs about $1200, less than the Sennheiser headphones on their own. A computer audio setup for $3000 could be way better.

</comment><comment><USER5> Musician and audio engineer here...

Skull Candy? Hahahaha! Get a pair of Audio Technica, Grado or AKG K-series headphones and get back to me. After seeing all the snake oil that is sold as audiophile equipment, I immediately stopped trusting that group of people.

If you want a pair of speakers that reproduce what the engineer heard in the studio, get a pair of near-field monitors. They're much cheaper than audiophile speakers. If you want to go over the top, get acoustic tiles for your listening room or just use some heavy curtains and wall carpets. If you're still not happy, get a room correction system and a measuring microphone. As a bonus, this will correct your speakers too.

Some engineer will now tell me that I should not use electronic room correction. I don't care. My mixes sound more balanced when I use it, even after I turn off the correction.

</comment><comment><USER6> $400 for a set of cables???

</comment><comment><USER7> This guy should come to the audiophile subreddit…will probably get torn apart for his hardware choices (esp. the expensive cable)

<comment><USER8> Great advice - to anyone who feels that audiophiles tend to be unwelcoming, /r/audiophile is a great great place, with lots of knowledgeable people eager to share (although there are also plenty of people who don't really know what they're talking about so it might take a little while to separate the signal from the noise). There is almost never a point at which you need to pay more than $100 for audio interconnects of almost any kind - for headphone cables, even that would be a pretty big stretch. I'm also wary of any company that even offers to sell 6 foot copper cables for more than $100 (such as the ALO ones mentioned in the article).

Best advice in the article is avoid Beats audio and SkullCandy, and get an external DAC.

<comment><USER7> for Beats there's always /r/audiojerk lol</comment></comment></comment>


Dell reveals it has made $6.5m out of Twitter - <AUTHOR> http://community.brandrepublic.com/blogs/gordons_republic/archive/2009/12/08/dell-has-made-6-5m-out-twitter.aspx

<comment><USER2> The article seems to suggest that twitter makes up a sales channel that generated M$6.5 in revenues. That isn't M$6.5 in profits for a margin- challenged business. Also, there is no indication this is incremental revenue. For all we know, Twitter simply displaced existing email newsletter revenue or RSS feed revenue.

It could still be a very good thing, for example if it lowers costs. But I would like to understand whether this is incremental business or simply replacing another mechanism.

I'd like to think that the retweeting phenomenon really could lead to Dell getting entirely new business from people who follow people who follow Dell. But I don't know.

<comment><USER3> I agree with you. Nothing indicates that it's business it wouldn't have had otherwise. Yes, their Twitter account is where the traffic and sales came from, but what part of it wouldn't have resulted in a sale without Twitter is the key element.

One thing is sure though: it costs a lot less for them to send tweets than to send emails.

</comment></comment><comment><USER4> And Twitter has made $0 from Dell.

<comment><USER5> They still have intentions on making money, though I think it will come from their recent partnerships with search engines google and bing.

</comment></comment><comment><USER6> Is this a lot? Dell has a $25B market cap.

The brand relationship management on twitter is a bit overhyped, in my opinion. CRM tools don't scale well. This becomes (as others here have mentioned) just another channel. Facebook pages are another. Email is another. The company blog is another.

<comment><USER7> This is one of the first hard data 7 figure sales number from a zero cost channel I've seen. That makes it important I think:)

<comment><USER6> This is not a zero cost channel. The companies very active on Twitter have full time people dedicated to it.</comment></comment></comment>


'Shocking' Fake Takeaway Sold on Uber Eats - <AUTHOR> https://www.bbc.co.uk/news/av/uk-48762211/shocking-fake-takeaway-sold-on-uber-eats <comment><USER2> To be fair, I think I trust a New-Balance-wearing dad manning a grill on his patio (seen in the video) than I do the average restaurant kitchen. I think I should be able to opt-in to it too, just show me some sort of badge that indicates the presence of health inspection.

I lived in a nice area of a Mexican city that used a sudden requirement for health inspections to eradicate the entire culture of pop-up food carts and people bringing a large pot of tamales from their home to sell. It was a heavy loss. Health inspections are so infrequent that it verges on "health theater" anyways. Once again, I simply think it's best to show people when the last health inspection was done (if at all) and let them decide.

Aside: I often don't notice that the image in BBC articles is a video. It looks like the whole article is two short paragraphs next to an image. The page is so busy that it's hard to see: [https://i.imgur.com/R4PywAR.png](https://i.imgur.com/R4PywAR.png) and the play button only shows up after the video loads.

<comment><USER3> The design is atrocious and took seconds to load completely, even with adblockers.

</comment></comment><comment><USER4> My friend always orders from this wing place via the app and one night he confessed that he doesn't know if the restaurant actually exists (the address didn't seem to suggest it did). All he knew was the wings were pretty good and they were a reliable late night food option. I tried the wings once, they were pretty good.

</comment><comment><USER5> Uber Eats is a car service, not a food service, isn't it?

Do Yellow Pages and Google also check the hygiene rating of restaurants that they list?

<comment><USER6> If you placed your order with Yellow Pages or with Google, then yes, definitely.

</comment></comment><comment><USER7> if they demand hygeine records or whatever then outside the US they'll just lose to domicilios.com, rapipedi, etc. several people i know have "restaurants" that are just their kitchens; people ordering don't know or care, they just want e.g. authentic venezuelan food.</comment>


Peer-to-Peer Communications with WebRTC - <AUTHOR> https://developer.mozilla.org/en-US/docs/Web/Guide/API/WebRTC/Peer-to-peer_communications_with_WebRTC <comment><USER2> I have been working on a large WebRTC project, and it's a great technology but it's just so fragmented right now it's hard.

For iOS

1\. Safari has a high pass filter or something on the incoming audio. Send in some music on opus/48000 with the proper maxbitrate and listen. Now download chrome for iOS and listen. Chrome has MUCH more low end. Running the audio before and after into a spectrum analyzer chrome is much closer to the original sound.

2\. If you make the video full screen then exit full screen if pauses.

3\. I couldn't get incoming RTP that is opus/48000/2 to be played in stereo. But as number 1 playing it in chrome does play in stereo.

Android isn't much better.

1.The fragmentation is such a HUGE pain. The manufacturer browsers on the phones seem to be very hit or miss. How many browsers come by default on android phones now days?

2\. The latest Samsung phones cameras can't do resolution 640x360 for whatever reason. Previous generations could and other android phones can as well.

Even desktop isn't all there.

1\. If you want to webrtc screen share there is no way to automatically select a screen or tab, not even CLI flags. So you can't automate testing it. And you can't even click the dialog in the chrome remote debugger.

2\. FireFox has nothing like chromes chrome://webrtc-internals

A few other things

1\. Simulcasting is ghetto

2\. I wish server CPUs would support h264/vp8/vp9 hardware encoding and decoding on the CPUs

3\. Want to collect metrics with getStats? Well there is no easy way to record all of them and the one SaaS is super super expensive

<comment><USER3> This is one of the reasons we've had to go the dreaded electron route and really push the desktop app: it's just not feasible to deliver the same UX across browsers/OS. Really frustrating. I'll add one to your list:

4\. I wish RTCRtpTransceiver would allow reusing encoded MediaStreams instead of re-encoding. For video, dropped frames are acceptable without needing to renegotiate bandwidth.

<comment><USER4> Video codecs doesn't work like that, most frames only encode the difference from the previous frame, meaning that if you drop one frame, all frames after that will be impossible to decode correctly.

A technique that's used to get around this is to use special frame reference pattern so some frames depend on a frame two or four frames before, allowing the intermediate frame to be dropped. This comes at a significant cost to the encoding efficiency though. tT use it with a pre-encoded video, it would require you to specifically encode it for this purpose, making the usefulness of such a feature in a client questionable.

Nothing stops you from building a server that does this though, for instance if you want to build a scalable streaming service based on WebRTC.

<comment><USER3> What you describe are called key frames. Nearly all video uses them. Recorded video for seeking, and steaming for well, steaming.

You missed the entire point of the comment.

</comment></comment></comment></comment><comment><USER5> I was pretty unimpressed by Zoom as I used to think along the lines of "bro just open up a WebRTC connection. You can use socket.io it's super simple"

Then... I attended a "Zoom Nightclub" and saw over 200 attendees streaming video to one another. All encryption, routed through China, etc. issues aside; I was very very impressed.

<comment><USER6> I don't think zoom is p2p. It just routes through a media server. So the media server merges all streams and distributes it.

<comment><USER7> That's their point. P2P doesn't scale to 100s of people. For even more than 10 you need a server. One service I've used forever is whereby.com (used to be appear.in) but even they acquiesced with their professional option for more than 4 people to ditching pure P2P using WebRTC.

<comment><USER8> Naive P2P doesn't scale like that. You'd have to do something much more advanced like a tree based multicast algorithm. That's hard to get right. Seems like the engineering there is more expensive than just paying for a ton of bandwidth and doing a simple centralized aggregator.

Of course there could also be a surveillance motive.

<comment><USER3> We have experimented with a P2P multicast setup and WebRTC makes this very difficult to do. Ultimately what we're rolling out soon, and what others like Zoom have done, is to send media over WebRTC data channels. The media channels are amazing if you're building a demo project, but for anything serious the spec does not allow enough low level control.

Also latency in P2P multicast starts to become a real problem.

<comment><USER9> How do you decode video from a data channel?

Getting encoded video bytes from a buffer onto the screen while using hardware video decoding and without a multi-second lag I haven't been able to do in either safari or chrome - any tips?

<comment><USER3> wasm ffmpeg -> canvas

Granted, not tested on Safari

<comment><USER9> Can you do 1080p60 video on mobile with wasm ffmpeg? I'd imagine it to have severe performance issues, since WASM is pretty bad for vector and bit twiddling operations heavily used in video codecs, and writing to a canvas on every frame requires the javascript (main) thread rather than being possible to do on the compositor thread (where videos normally decode and run) which means it'll end up janky if any other javascript runs at all.

Even basic canvas animations on the main thread like the dinosaur game (chrome offline page) are pretty janky, and they aren't doing much per frame at all.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER3> Another nitpick: WebRTC connections are extremely fragile and a pain to herd. We've had to build both data and audio keepalives into Squawk[1] to ensure that we can hold connections for long durations (running in the background 24/7). And if the connection encounters a problem, often the only recourse is to renegotiate or recycle.

[1] [https://www.squawk.to](https://www.squawk.to)

EDIT: For anyone curious, we swap out the track from the RTCRtpSender so we're not transmitting any data when we're muted (muting the track locally means you're still sending frames of silence every 20ms which eats up cpu and bandwidth). And every 15 seconds we send a 60ms blast of silence, and verify on the receiver every minute.

<comment><AUTHOR> This seems like an issue with residential network infrastructure more than webRTC. Do other peer-to-peer technologies work better than webRTC?

<comment><USER3> I can't speak to other P2P tech, but I presume so. As far as I know, no other P2P tech runs at a big level, sandboxed abstraction of what's really going on. And therein lies the rub of WebRTC. It was supposed to be a portable high level standard, but it isn't portable so we're just left with the costs of being high level.

</comment></comment></comment><comment><USER10> I'm using webRTC for a video chat project that I'm developing now. I had a hard time making it work on iOS browsers and ended up supporting iOS Safari alone. Though all iOS browsers use the same WebKit, Apple still reserves a few things only for Safari I guess (maybe H264/VP8 video codec related stuff?!).

It may take some time for webRTC (or Apple) to get there, to webRTC become a solid option for p2p video communications.

If anyone wants to quickly try webRTC, check this demo [https://appr.tc/](https://appr.tc/) out, you know, with multiple browsers/tabs.

ps: I used "simple-peer" library and it's quite good for beginners.

<comment><USER11> getUserMedia isn't supported by third-party browsers on iOS yet, see note 3:

[https://caniuse.com/#feat=stream](https://caniuse.com/#feat=stream)

The Judiciary Committee asked Apple about this last summer, see question 6:

[https://docs.house.gov/meetings/JU/JU05/20190716/109793/HHRG...](https://docs.house.gov/meetings/JU/JU05/20190716/109793/HHRG-116-JU05-20190716-SD036.pdf)

I think it's close to landing though, need to revisit.

<comment><USER12> Sort of a tangent, but the committee asking Apple why they don't support a specific web API is such a stark contrast from that senate panel with Zuckerberg. The Judiciary Committee seems so much more technically informed.

</comment></comment></comment><comment><USER13> Webtorrent.io is probably the best thing I've come to so far with p2p webrtc. Really amazing what came out of PeerCDN.

<comment> Sean-Der I think WebRTC is still getting started also :) I love the space, here are some of my favorites.

* Open Source classic game streaming - [https://github.com/giongto35/cloud-game](https://github.com/giongto35/cloud-game)

* Controlling industrial construction equipment - [https://twitter.com/shirokunet/status/1268011883816054784](https://twitter.com/shirokunet/status/1268011883816054784)

* Run a web browser remotely, great for low spec computers - [https://github.com/nurdism/neko](https://github.com/nurdism/neko)

* Use NAT Traversal to access hosts. No more bastion hosts/3rd party services - [https://github.com/mxseba/rtc-ssh](https://github.com/mxseba/rtc-ssh)

* Use Tor via WebRTC DataChannels - [https://snowflake.torproject.org/](https://snowflake.torproject.org/)

* Fly a drone via WASD in the browser - [https://github.com/oliverpool/tello-webrtc-fpv](https://github.com/oliverpool/tello-webrtc-fpv)

* Share files P2P in a cross-platform way. I HATE paying to transfer files, seems so basic - [https://github.com/saljam/webwormhole](https://github.com/saljam/webwormhole)

* Access a friends terminal from your browser via P2P - [https://github.com/maxmcd/webtty](https://github.com/maxmcd/webtty)

<comment><AUTHOR> These are great references. Thanks for the list.

<comment> Sean-Der Thanks :) I am really passionate about this stuff. WebRTC is really great, but the community is kind of anemic. I am involved with a project Pion that is trying to bring more community ownership (instead of commercial) to the WebRTC space.

If you are interested for more check out [https://github.com/pion/webrtc](https://github.com/pion/webrtc), [https://twitter.com/_pion](https://twitter.com/_pion) and [https://pion.ly/slack](https://pion.ly/slack)

<comment><AUTHOR> Ya it seems like good technology. I was trying to think of ways to use it in a peer-to-peer knowledge base sharing mechanism where users could decide which nodes in their personal knowledge graph would be public and figured webRTC might be a good starting point so that's how I stumbled on that page.

I've shelved that aspect at the moment but your link will help me with code samples I can re-use when I revisit the sharing aspect of the project.

</comment></comment></comment></comment></comment><comment><USER14> Author of Peer Calls here, an open source, anonymous WebRTC multi-user conferencing solution. I recently ported the app that Go and added an SFU (thanks to pion/webrtc) to make support for 3+ users better. Works on all recent major browsers (including Safari on iOS).

See [https://github.com/peer-calls/peer-calls](https://github.com/peer- calls/peer-calls) for more information.

You can host it yourself or use peercalls.com

Happy to answer any questions in this thread.

<comment><USER15> Local audio is replayed locally it seems. So I hear myself with a delay which disconcerting.

</comment></comment><comment><USER16> In the past there was no encryption for communications then sRTP with DTLS became the way of doing it (secure signalling and media) when you negotiate sRTP material between parties you can intercept the keys and inject some pretending to be the remote caller and viceversa. [https://bloggeek.me/is- webrtc-safe/](https://bloggeek.me/is-webrtc-safe/) a good read

</comment><comment><USER17> A bit off topic: recently multi monitor screen sharing based on WebRTC was fixed in Chromium/Linux/x11 (landed in Chrome 83) making my Google Meet/ Jitsi screen sharing support sessions much easier...

<comment><USER18> Yesterday Vivaldi & Brave screensharing on Fedora were dismal with Whereby (which uses WebRTC assumingely) while Chrome 83 worked great. Why would that be? Because Whereby doesn't test Chromium browsers on Linux?

<comment><USER19> Hi, one Whereby-developer here. I use Vivaldi and Firefox on Linux mostly. So you could rather say we over-test Chromium-based browsers on Linux. Also test in "real" Chrome and open up Opera now and then, and Brave quite infrequently.

But the API we get from the browser is basically just `navigator.mediaDevices.getDisplayMedia()`, so what we do to screenshare is actually not much code at all. If we do something bad for Vivaldi/Brave though, we'll be quick to fix it, but this is likely their bugs, not ours :) Vivaldi screensharing on Linux broke half a year or so ago, but we're in the same town and know them, so they quickly fixed whatever bug it must have been after we pinged them.

But the most likely thing here is just that they might not have updated to newest Chromium with all these fixes. Or maybe not done the necessary platform-integrations or UI for it. Having worked on Opera previously I know anything involving chrome (UI) will often take a lot longer to do because you actually have to write a lot of custom code for it (in contrast to pure web- platform features and improvements, which basically will be free).

</comment></comment></comment><comment><USER20> Why is `RTCPeerConnection.setLocalDescription()` an independent method? I've always wondered what use case might exist that would not set the local description right after calling `pc.createOffer()` or `pc.createAnswer()`. Similarly with `pc.setRemoteDescription()`.

Wouldn't have been clearer to have createOffer + processAnswer (for a negotiation started locally), and processOffer + createAnswer (to respond to remote offers), and set the local/remote descriptions implicitly as part of these methods?

<comment> Sean-Der `setLocalDescription` is where all the logic happens! `createOffer`/`createAnswer` just creates an easy config to pass.

You can change lots of undocumented stuff in the SDP! This list isn't exhaustive, but I have seen production apps do these.

* Change ice ufrag/upwd

* Enable simulcast

* Change code preferences

* Change codec specific behavior (Opus ptime)

My guess is that it works this way so browser vendors don't have to actually standardize behavior. They don't need to go through the W3C every time they want add something new. ORTC was released to try and fix this though. `SDP Munging` is a terrible idea and has caused me so many headaches :/

</comment></comment><comment><USER21> I needed a very low traffic chat feature for a website built on Django so i went looking too what existing code there was.

1 was based on simple Ajax to server and a server backed message store.

About a dozen used WebRTC or other advanced techniques.

I wonder how many people who could quite easily cope with the expected traffic using brain-dead simple techniques end up going the complex route because they assume that's how you do chat?

<comment> Sean-Der Is your chat text only? I think for media WebRTC is going to always win in the browser (unless you have the developers who can implement custom congestion control etc..)

For text only I still see a couple advantages

* E2E Security. With WebRTC I don't have to worry about snooping. Why should I upload my messages to a server?

* Scaling/Bandwidth/Ops Burden. Massively reduced if all my clients are directly connected to each other

* Ajax (TCP) can't do as much. DataChannels give me lossy/out-of-order messaging. Not useful for chat, but really great if building anything gaming/real-time

<comment><USER21> Yeah - I think all of that supports my point. Aside from security (which most users wouldn't be able to verify in any case) none of those things are relevant to low-traffic chat. i.e. "talk to our live advisors" or "collaborate with another user". The bandwidth and load is tiny and I can imagine handling hundreds or thousands of concurrent users with a traditional architecture and commodity hosting.

</comment></comment></comment><comment><USER22> Before that, a webserver was still required to initiate the connection between 2 user-peers, which of course made little sense. I once asked about it and got an answer about "DDOS risks", and it made sense, because if you let people visit some webpage, it would be an easy way to DDOS.

</comment><comment><USER23> Hi all,

I built a simple messenger using WebRTC. You can check at [http://sambhashana.com/](http://sambhashana.com/).

Please use it and share your feedback

<comment><AUTHOR> You need to provide more details. How does it compare to other chat applications? What improvements and features does it have that other chat applications don't have.

<comment><USER23> Hi,

Except for room members online information nothing goes to the server. Every message goes peer to peer and nothing is stored so the moment user closes or refreshes browser everything gone.

<comment><AUTHOR> That's a good description. It should have been included with your original pitch.

</comment></comment></comment></comment><comment><USER24> Question to front end folks:

How hard is it to add real-time voice communication to a web page using this?

Can it be done without using third party libraries and frameworks?

<comment><USER10> its pretty much easy and it doesnt require any third party libs. check the demo

[https://webrtc.github.io/samples/src/content/peerconnection/...](https://webrtc.github.io/samples/src/content/peerconnection/audio/)

code: [https://github.com/webrtc/samples/tree/gh- pages/src/content/...](https://github.com/webrtc/samples/tree/gh- pages/src/content/peerconnection/audio)</comment></comment>


Private companies protect US access to cables' data for surveillance - <AUTHOR> http://www.washingtonpost.com/business/technology/agreements-with-private-companies-protect-us-access-to-cables-data-for-surveillance/2013/07/06/aa5d017a-df77-11e2-b2d4-ea6d8f477a01_story.html?Post+generic=%3Ftid%3Dsm_twitter_washingtonpost

<comment><USER2> > _" Negotiating leverage has come from a seemingly mundane government power: > the authority of the Federal Communications Commission to approve cable > licenses. In deals involving a foreign company, say people familiar with the > process, the FCC has held up approval for many months while the squadron of > lawyers dubbed Team Telecom developed security agreements that went beyond > what's required by the laws governing electronic eavesdropping."_

This is disgusting.

<comment><USER3> I would certainly hope that these companies can now sue the FCC in light of these new facts.

</comment></comment><comment><USER4> Fuck it. Pull the wire to mexico or canada and leave the US without Access. Sooner or later, the big services will be moved away, and there is enough users in the rest of the world to not have to worry. Make Mexico the connection hub between North / south america as well as east <> west. Also make a huge deal that this traffic will be protected 100% without any interuptions from the US. If the US wants to connect to the rest of the world, you can do it at our terms, not the terms that they thing everyone should follow. Especially since they still seam to believe that they can presure people.

I dont know what the US said to the other countries but all of a sudden a bunch of countries, including Russia seams to be scared shitless. I dont know, its just a feeling. Time to ripoff all american buisiness ideas and put them up on servers in better parts of the world (island? no other places left, correct?). Then lets see what the fuck they will do!

<comment><USER5> Because the Internet controlled by Los Zetas is a better world....

<comment><USER6> They have a lot of experience with both packets and denial-of-service attacks?

</comment></comment></comment><comment><USER3> Looks like a great time to start investing in undersea cabling between Europe and Latin America and between Latin America and Asia.

<comment><USER7> It might help some influential people to get off their asses if it were announced that new fiber is planned to be laid on routes which bypassed the US.

<comment><USER8> They would just tap it underwater as they have done in the past (and probably present).

"We can do this the easy way, or we can do this the hard way."

<comment><USER3> Is tapping underwater cabling still a viable option with encrypted packeted communication where where equipment at both ends of the cable have performed a DH key exchange?

</comment></comment></comment></comment><comment><USER9> Single-page, print version: [http://www.washingtonpost.com/business/technology/agreements...](http://www.washingtonpost.com/business/technology/agreements- with-private-companies-protect-us-access-to-cables-data-for- surveillance/2013/07/06/aa5d017a-df77-11e2-b2d4-ea6d8f477a01_print.html)</comment>


Play Store forbids apps from making reference to Covid-19 - <AUTHOR> https://android-developers.googleblog.com/2020/04/google-play-updates-and-information.html <comment><AUTHOR> > ...we are currently only approving apps that reference COVID-19 or related > terms in their store listing if the app is published, commissioned, or > authorized by an official government entity or public health organization, > and the app does not contain any monetization mechanisms such as ads, in-app > products, or in-app donations. This includes references in places such as > the app title, description, release notes, or screenshots.</comment>


This is Strictly a Violation of the TCP Specification - <AUTHOR> https://blog.cloudflare.com/this-is-strictly-a-violation-of-the-tcp-specification/ <comment><USER2> should get a (2016) tag. widely discussed those times.</comment>


Show HN: Destructive Commons : Voice / Instrumental automatic separation - <AUTHOR> http://www.destructivecommons.org/ What is Destructive Commons? Demixing and sampling. You send the mix as mp3 file, we run a complicated algorithm, and you get separated background and lead tracks as mp3 files. With those, you can do sampling or automatic karaoke.<p>? Destructive Commons is a wonderful piece of signal processing technology which automatically unmixes an mp3 music file into its vocal and instrumental parts. You upload a mp3 file, you leave your email, and a few minutes later, you get a link for your separated tracks, which is up for a few hours.<p>Does it work? Depends. Basically, the algorithm separates stuff that is repetitive from stuff that is not. Usually, you get vocals and instrumentals as separated tracks. You may end up with some guitar solo or such stuff. Indeed, those are not repetitive neither. Furthermore, separation is not perfect at all and you usually end up with sound artifacts. However, with sufficiently noisy covers or hardcore drums over them, that should be nice. Results depend of the original song, the weather and your cat. <comment><USER2> Cool, this looks like a lot of fun! I'm preparing my youtube->mp4->mp3 chain right now so I can try it out on Jets to Brazil's "Chinatown." (It goes youtube-dl.exe then ffmpeg, but I hated the shifty windows 7zip program b/c it tried to install a new browser, so I'm using Cygwin's 7zip to decompress windows ffmpeg and cygwin is updating everything under the sun, including emacs...).

BTW, the reason I want to do this is to transcribe the vocal part of the song into sheet music. This will work way better when the vocals are separated. I'll let you know how it goes, thank you.

</comment><comment><AUTHOR> We hope you enjoy it (we're terribly proud of the design....)

<comment><USER2> OK! I got my results back! That was fun!

On the rock song I sent it, it kind of worked! In general, it separated the higher frequencies of the vocals better than the lower.

And in general, the instrumental track is higher quality than the vocal-only track!

Also, in the quieter parts of the song - no guitar, just drums and vocals, the hi-hats came through on the vocal side.

The separation worked best when there was singing and guitars and drums.

It's a bizarre, fun effect to play both tracks back, vocals panned left, instruments panned right. Some of the singing pans from left to right as it slips in and out of the classification :)

Thanks for this! If you ever felt like describing how it works more, it would be fascinating to hear!

<comment><AUTHOR> Hi.

Glad you enjoyed it. We use some advanced signal processing algorithms. Basically, the algorithm separates stuff that is repetitive from stuff that is not, which explains the erratic result. For example, if the instrumental is very repetitive, you'll have quite good results, as with some commercial stuff. But you can get sometimes easily a solo with this...

We'll be releasing a new version in two monthes which will give users access to other parameters, like the period used to define the "repetitive" part.</comment></comment></comment>


TikTok and Microsoft's Clock - <AUTHOR> https://500ish.com/tiktok-and-microsofts-clock-c4c9fd082b89 <comment><USER2> Where is EU in this embarrassment?

Suppose Margrethe Vestager called and said TikTok, you are banned unless you let a "very european" company take over your business? And by the way. We would like a cut.

And would the US still being able to say "national security" if it was fully owned by German business running on servers in some Swiss mountain?

<comment><USER3> Because the Chinese cyber threat is incredibly real. The United States should be playing hard ball. The US TikTok systems are compromised by Chinese spammers already.

<comment><USER4> If the threat of Tiktok gathering data is so real, then isn't a much better solution, to pressure Google and Apple into improving their security models? That way, _nobody_ can spy on your phone anymore. Or do you think Tiktok is the only and last threat there will ever exist?

But nobody's talking about actual solutions. All this looks more like a witch hunt to me.

<comment><USER5> I don't think the key data that TikTok is gathering is anything you can really block on your phone. It doesn't ask for your phone number, it doesn't ask contacts, it doesn't ask for access to your messages. Instead, it looks for trends, it looks at who you are.

I (18 years old) have used TikTok for about 2 months, before deleting it because it simply got too addictive. In that time it learned what my favourite games are, what shows I watched as a child, my political views, my eating preferences, my technology preferences. The list goes on. While I'm not sure how much of this is saved in a black box and only known by the algorithm and how much they can extract, I'd argue that this is many times more valuable for China that my personal phone.

Furthermore the power to influence the algorithm, subtle and slightly of course, may slowly change the minds of literal millions of teens.

<comment><USER4> There is a solution even to that. That's what the Microsoft sale is all about. That's why Bytedance proposed to sell ALL shares of their US branch. Replace the entire US branch staff with US employees. Vet every line of code. Don't send any data to China. This is the ultimate solution.

And yet nobody seems to be interested in this solution. People are still cooking up new reasons to ban Tiktok. Or ignoring the existence of this solution altogether.

Why do you think that might be? I suspect it's because the issue is more emotional and fear-based than rational. People are falling for the propaganda.

<comment><USER6> That does not actually solve the problem.

Yes, maybe I find it a little easier to trust Microsoft than Bytedance. But the problem is not who holds the data that I generate about myself.

The problem is that I have zero (or very little) agency to view or manage this data. That lack of agency is important because this data will have a tangible impact on my life.

<comment><USER4> But I thought we were talking about national security? Why did it suddenly turn into privacy and data control?

Privacy is a legit angle, but why focus on Tiktok alone? Talk about privacy law reforms so that Twitter and Facebook are also included.

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> Beside all the political issues, what is Microsoft actually supposedly buying here? The data centre, data and access to it? Because it does not seem to me that they are buying any of the developers, am I right? At least there is no talk about that. How well can you run a platform by buying its software without any of the people that run it, at least from my developer point of view that seems a very strange idea. Basically, they will have to understand and rewrite the entire thing within a few months with whatever own developers they can provide. Without any major hickups, or users will leave the platform in seconds, its not like there are no competitors or the underlying technology is complicated. Its just that everyone is used to the platforms but if that changes ...

Anyways, an insteresting case study for platform theory ...

<comment><USER8> TikTok users. Microsoft is bidding to purchase Tiktok's user base.

Data centers, even engineering talent, is fungible. They are replaceable and therefore have no special value worth haggling over. But attractive young people wanting to dump their lives into a video app for pennies? _That_ is the real asset in this deal.

<comment><USER7> That part is obvious. Still, you have to be able to run it. If you have hourly outages weeks into taking over because you cannot fix this or that glitch, the nicest user database isn't worth much if users are switching to the next platform.

I do not expect much technical depth in an app such as TikTok, nevertheless you will need dozens (and more) of engineers to run it and how do you organize those to a previously unknown structure. In theory that is simple but anyone with who manages code for someone no longer in the company knows otherwise. And the engineers that wrote the code weren't native in english either ...

<comment><USER9> But code in any language can be read by any engineer in the world that is proficient in it. I do not speak or read Chinese but when I pull an interesting looking repo from Github that is Chinese I only have to stroke 3 keys to translate all python comments in the file to English. Works great!

You don't need really need another language when you have a common one in place. Even without code comments you should be able to sniff out the crackpots.

Chinese repos are trending on Github everyday. They do really cool things beyond the cutting edge on every side of our business. From frontend react and vue to shiny ML and backend golang.

<comment><USER10> This is not as much as cultural "translation" of code, it's about handing over years of knowledge of running a platform. Even if Microsoft was buying some US-based social media company, they would at least want to have access to several engineers to handle the transition and transfer knowledge.

It will be interesting to see how Microsoft handles this, but I can't believe it will be without access to some TikTok engineers for an extended period of time.

<comment><USER9> Isn't Github basically the blueprint for running an infrastructure to manage a full remote coding workspace?

I'm actually surprised the mature way Microsoft handles the Github acquisition. It's not anything like that of what they did with Skype. What you are referring to a managerial nuances on a blueprint like this.

And it is not like Microsoft would have any problem to multiply these engineers salary by 10X because they still would not pay software engineering market rate in Seattle or another hub.

</comment></comment></comment></comment></comment></comment><comment><USER11> It continues to be damning that the leadership of Microsoft did not buy Vine [1] from Twitter in 2017 for pennies on the dollar before Vine was shutdown. Vine was _very_ popular, and a lot of people were very disappointed when it was shutdown back when Twitter was bleeding a lot cash.

[1] [https://en.wikipedia.org/wiki/Vine_(service)](https://en.wikipedia.org/wiki/Vine_\(service\))

<comment><USER12> Honestly hard to tell if this is satire. TikTok is way more compelling than Vine was, even at its peak. The idea that Microsoft not buying a dying Vine from Twitter is indicative of its poor leadership is hard to wrap my head around.

<comment><USER11> People are talking about Microsoft paying more than $30 billion for TikTok's operations in just four countries. Vine was losing Twitter 10 million dollars a month at a time when Twitter was desperate for cash.

Microsoft (or Google, or Facebook, or any similar cash rich company) could have bought Vine for tens of millions.

The product and algorithm could have been tweaked to be more compelling. Even if the new owner wasn't able to do that, using an existing established platform/audience then cloning the features of upcoming competitors is very powerful.

<comment><USER13> Easy to say in hindsight. At the time it wasn't so obvious that the problem with vine was algorithmic. They wouldn't have known which direction to tweak in; I don't even think Vine had much of an algorithm. It was mostly news feed no?

</comment></comment></comment></comment><comment><USER14> The United States loses the moral high ground moving forward and Microsoft gets a blemished gem. The machinations of this deal are unsightly. Just because this is how the game is played in China doesn't mean we have to do it too.

<comment><USER15> "Nice rapidly-growing foreign service you have there. It would be a _shame_ if we called it a 'national security risk' and made you sell it to us for pennies on the dime!"

<comment><USER16> The irony, of course, is that the US is pulling these heavy handed maneuvers at a time when the rest of the world would have gladly done it for the US for free.

Half the world is currently pissed with China. India already banned Tik Tok. The US could have used what is left of its diplomatic corps (devastated in the past few years) to encourage other countries such as the NATO nations, 5 eyes countries and other allies to threaten to ban Tik Tok and the likes of China didn't resolve their security concerns. And the vast majority of them would have agreed, essentially forcing China to do this or something similar without the US losing its moral high ground, and gaining strength and respect amongst its allies instead of looking like a street level rent a mob type.

The same with the TPP. The US under this administration and tried hard to punish China, and basically, over the past few years has managed to slightly alter the fortunes of 2 individual companies, at a huge cost to its local farm sales, and hasn't gained much in return at all, while hurting China only marginally.

If they had remained in the TPP, they would have had a much greater effect across Chinese companies (since it wouldn't require cherry picking individual companies and acting specially for each of them) and the influence would have been levered since it would have come from pretty much every neighbor of China, and further, would have come at little cost to the US.

What's most disturbing about these actions isn't so much the actions themselves, but the fact that they have traded away so much of the US's reputation built over generations, cost the US so much in rep and straight up cash, and has barely got it anything in return. And all this while much more effective alternatives which would have cost the US nothing but instead would have helped it strengthen its position in the world, existed by acting through its alliances.

<comment><USER17> This is similar to what I was going to post too. Unless there's some kind of 4d chess power games happening behind the scenes, it looks a real gross amount of incompetence in lack of planning, diplomacy, and leadership at all levels of international relationships. More realistically- seems like a meltdown of alliances towards standalone empire-style thinking once again.

</comment></comment></comment></comment><comment><USER18> US, Canada, New Zealand and Australia are four of the "Five Eyes" surveillance community (the fifth is the UK) [https://en.m.wikipedia.org/wiki/Five_Eyes](https://en.m.wikipedia.org/wiki/Five_Eyes)

<comment><USER19> Yes. Given that it's very surprising to see the UK not mentioned.

<comment><USER20> I had the same reaction, until I learned that the ByteDance founders are working to relocate[1] outside of China, probably to London.

1\. [https://www.reuters.com/article/us-china-bytedance- britain/t...](https://www.reuters.com/article/us-china-bytedance- britain/tiktok-owners-will-relocate-to-london-from-beijing-sun-newspaper-says- idUSKBN24Z0IE)

</comment></comment></comment><comment><USER21> Didn't Microsoft become _significantly_ more involved in donating to US politicians after they got hit with that anti-trust case? It'd be very interesting to follow the money here, not sure if there's enough publicly available data to DIY the digging though.

<comment><USER22> What are you supposed to do with an influence peddling racket? Microsoft is playing the same game as everyone else.

</comment></comment><comment><USER23> "Microsoft fully appreciates the importance of addressing the President's concerns. It is committed to acquiring TikTok subject to a complete security review and providing proper economic benefits to the United States, including the United States Treasury." => So US Treasury will give MS money to buy TikTok (US market only)? And they have limited time to make this deal? So US Treasury will effectivelly own the US TikTok... and NSA will record every move on it and process it with BigData...

<comment><USER24> I read "providing proper economic benefits to the United States, including the United States Treasury" as just meaning Microsoft will make money (and hence pay tax) on this. Am I being naive?

<comment><USER25> Apparently yes:

A transaction of the type the president envisions could also prove more expensive than the one Microsoft described on Sunday. Trump said Monday that part of the amount paid to buy TikTok would have to come to the U.S. Treasury Department because it would be making the deal possible.

"It's a little bit like the landlord/tenant; without a lease the tenant has nothing, so they pay what's called 'key money,' or they pay something," Trump said. "But the United States should be reimbursed or should be paid a substantial amount of money, because without the United States they don't have anything, at least having to do with the 30%."

[https://www.cnbc.com/2020/08/03/president-trump-might-be- eas...](https://www.cnbc.com/2020/08/03/president-trump-might-be-easier-if- microsoft-buys-all-of-tiktok.html)

So, to summarise: the president of the United States is openly advocating applying illegal real estate extortion/bribery practices to major M&A deals with geopolitical implications.

<comment><USER26> > So, to summarise: the president of the United States is openly advocating > applying illegal real estate extortion/bribery practices to major M&A deals > with geopolitical implications

Well, yes, because he's spent his entire career doing that and now he's President. See the case the NY AG is building against him.

<comment><USER27> Is it any different than just having a tax on purchasing foreign companies?

It's the same as a tax on purchasing foreign goods, which is already in place for goods from China in the form of tariffs.

<comment><USER28> Tariffs aren't a tax on _purchasing_ foreign goods. I can buy as many tons of steel as I'd like in China while paying no money to the US Government (as long as I can export the money, which is a different issue). Tariffs are taxes on _importing_ foreign goods. That would only even conceivably be comparable if Microsoft were planning to relocate TikTok to the US; as it sounds like they're planning to relocate it to London, that wouldn't apply.

</comment></comment></comment></comment></comment></comment><comment><USER29> If this is a national security risk, having Microsoft purchase it is a terrible idea. Will Microsoft install this app next to Xbox Live and Candy Crush on your start menus? Is it going to end up in your startup-apps, launching every time you load your PC, added back to your startup-apps after every update regardless of how many times you remove it from the list?

<comment><USER30> I imagine Microsoft would also be tasked with tying up the security risks before publishing it anywhere near the Windows start menu

<comment><USER4> In fact, that is the whole point of the purchase. Microsoft would replace the entire US operations team with US employees, and vet all the code. There would be zero reasons left to ban Tiktok on the grounds of national security.

For some reason, I'm not seeing many people talking about this at all. Everybody is still talking about justifications about why Tiktok should be banned. I therefore suspect that the issue is more emotional than rational in nature.

</comment></comment></comment><comment><USER31> Can someone explain me, if TikTok does not want to sell then what? Americans will need to use VPN for TikTok?! And why would they sell they have 800 million users? Instagram revenue jumped from close to 7 billion in 2018 to 14 billion in 2019, why would they sell how big is USA market?

</comment><comment><USER32> > who saw value in an American company getting access to sophisticated TikTok > algorithms

Caused me to spit-take.

<comment><USER33> Why?

<comment><USER34> I'm guessing they believe it suggests a reason the current administration is pushing for the sale is to have some control over said algorithms and thus what videos are served, possibly to the benefit of the current administration and their interests.

"The proposed transaction gained the blessing of senior Trump officials, including Treasury Secretary Steven Mnuchin, who saw value in an American company getting access to sophisticated TikTok algorithms that decide what videos users are served."

<comment><USER35> That's not how I interpreted it. Pretty sure they were referring to the "sophisticated" part as unlikely. Not saying I agree though. No clue how their algorithms work.

</comment></comment></comment></comment><comment><USER11> Prior TikTok/Microsoft discussion: [https://news.ycombinator.com/item?id=24032667](https://news.ycombinator.com/item?id=24032667)

</comment><comment><USER36> I'm no fan of TikTok, but in general the US president doesn't get to tell US companies what to buy, and he doesn't get to tell US persons what internet sites they can or cannot visit. (Yes, I realize it does happen e.g. for gambling sites, but it's generally a game of whack-a-mole for the government because there is no Great Firewall of the US.) If ByteDance just told Trump to go to hell, what specific legal and technical actions could he take to stop Americans from using TikTok?

I'm worried about precedent here, and whether this is just a pretext for creating a GFoUS.

<comment><USER37> The US president can probably compel Apple and Google to remove Tiktok from their app stores. Tiktok can appeal that action to the US court system and the US legislature, but those appeals would probably go nowhere.

So a technically inclined Android user or a user of a jailbroken iOS device can probably continue to use Tiktok, with effort, but will have much fewer people to interact with using the service.

<comment><USER38> If the president can't compel Apple/Google to install backdoors, he can't compel them to remove TikTok.

<comment><USER39> He could have the commerce department put TikTok on the Entity List, which would prohibit all US companies from doing business with them. It would be unprecedented though because putting a company on the Entity List is almost always tied to some actual criminal activity like trade violations or espionage (see HuaWei).

So there is away for him to do it, but TikTok could challenge it legally.

</comment></comment></comment></comment><comment><USER40> There is also something fishy about all the "algorithm" talk.

Are we supposed to believe that the algorithms that a bunch of Chinese blokes came up with for a viral video platform are so complex that the US Govt. wants to intervene and help Microsoft buy it?

</comment><comment><USER41> Wonder if the Chinese government will retaliate and ban US companies like Tesla or Apple from selling goods there unless they fork over ownership to Alibaba, haha.

<comment><USER42> Haha. Nah. They still need them to run the factories that employ millions of people and show aspects of cutting edge manufacturing.

They probably will retaliate on American entertainment/content, considering those are more replaceable.

</comment></comment><comment><USER43> Intellectual property robbery

</comment><comment><USER44> If Microsoft doesn't buy TT, it's going to be banned by Trump. Great deal for Microsoft.

</comment><comment><USER45> TikTok is designed to be a separate firm somehow. Quite different from the arms of wechat, ... partially due to the censorship of china. But it also showed the fundamental problem. None of the media social or not get into china. Not even diplomat. But China earn the other way round. The unbalance is unimportant when USA feel safe. But when USA not the one way street is a bit of shock. How to handle this ...

For this case more important is us investor. Hence the strange deal. Otherwise it would outright blocked like india.

The missng of Uk or non-chinese world is strange though.</comment>


The Worst Way You Could Ever Fire Your Employee - <AUTHOR> https://medium.com/swlh/the-worst-way-you-could-ever-fire-your-employee-8a58f221525b <comment><USER2> It's also a bad omen and a faux-pas to be fired on CNY.

It's a bit like seeing a doctor on the first day. My sister was hanging out with the little cousins at the skating rink, fell, and twisted her knee pretty bad. Given we were going to visit the aunts, and it's a faux-pas to see a doctor on the day of CNY, she irrationally toughed it out.

Turns out she tore like 70% of the ACL.

</comment><comment><USER3> Non-paywalled version: [https://outline.com/m3tqTp](https://outline.com/m3tqTp)</comment>


The Long, Dismal History of Software Project Failure (2006) - <AUTHOR> http://blog.codinghorror.com/the-long-dismal-history-of-software-project-failure/

<comment><USER2> The surprising thing about software projects is not that so many fail but that at least some succeed. That is my experience with corporate.</comment>


Interview with guy arrested at airport for wearing an elaborate wristwatch  - <AUTHOR> http://boingboing.net/2012/11/20/interview-with-guy-arrested-at.html

<comment><AUTHOR> Intermediate source submitted because apparently patch.com is autobanned here</comment>