Here's What Everybody Made From The Slide Sale - <AUTHOR> http://techcrunch.com/2010/08/05/heres-what-everybody-made-from-the-slide-sale/

<comment><USER2> As an employee, you definitely wanted to be at the company when it was purchased since 48 million was earmarked for the soon to be google employees.

It sucks if you're someone who had left the company recently (especially if you paid money to secure your options)... there is something rather backhanded about this kind of dealing. Arrington alluded to it during YC's angel conf, but from an investor's perspective. In this case it can affect employees as well.

I suppose this is the nature of private companies. The controlling parties can really do whatever they want, including diluting you out of the picture or (in this case) laundering value into employee retention plans.

<comment><USER3> Repeat after me,

"I will never make any money beyond a salary working for somebody else. My only chance at striking it rich is by being a founder in my own company, or getting lucky in the lottery (or (casino, inheritance, getting run over by Jason Calcanis' Tesla, etc)."

Every once and a while there's a statistical outlier like Youtube where employees actually cash out with enough money to feel like they're not poor in San Francisco. I think Youtube was the last one, in what, 2005?

<comment><USER4> There are a lot of people in finance making millions outside of their salary working for other people.

<comment><USER3> A lot of meaning what .. 250,000 globally? Maybe 500,000? I doubt many of those people are hacker news readers.

<comment><USER4> Compared to how many people are making millions founding technology companies.

</comment></comment></comment></comment></comment><comment><USER5> Google agreed to dish 48m, in retention bonuses. There about 100 employees, so that averages about 480,000 per employee. Not sure what the vesting period is, but assuming it is at least 2 years.

Not bad, but not life changing either. After taxes, you can afford the downpayment of a Condo in SOMA + a bit more, or buy a small one bedroom in Mountain View.

Moral of the story, if you want to be rich, start your own startup.

<comment><USER6> > _After taxes, you can afford the downpayment of a Condo in SOMA + a bit > more, or buy a small one bedroom in Mountain View._

There has to be some other measuring stick to money than real estate...

<comment><USER7> It's better than what USA Today would use. They'd tell you that if you converted it into pennies and stacked it straight up it would be the third largest building in the world.

</comment></comment></comment><comment> brown9-2 I still don't understand what Slide does or makes or why a company would be interested in acquiring them.

Can someone explain this to me in non-hype terms?

What is Google paying for here exactly?

<comment><USER8> Google is getting a bunch of people who get social games (and social software in general) -- something they've historically been pretty bad at. Of course, they are buying the (distant) 2nd horse behind Zynga, aren't they?

<comment><USER3> I think Playdom is probably a lot larger than Slide... oh hrm and Playdom was just acquired by Disney for $763M. Slide is definitely small fries in comparison to Playdom or Zynga.

</comment></comment></comment><comment><AUTHOR> Max actually did quite well.

<comment><USER9> True, but I'm guessing the lower-level employees not so much after you take out all the money for the preferred shareholders, even the ones who invested at crazy valuations.

Edit: Maybe they arent so screwed after all, depending on how the retention bonuses are dished out.

</comment></comment><comment><USER10> "...founder Max Levchin did the best out of the sale, making a comparable sum to the one he made from PayPal...[for] a total of $39m."

Given that PayPal sold to eBay for $1.5b, doesn't $39m sound too low? Does anyone know how much he made from PayPal's sale?

<comment><USER11> I think it was about the same, 30-something million. Peter Theil made about twice as much from the PayPal sale though.

</comment></comment><comment><USER7> Isn't this highly unusual? Don't preferences usually give later investors the profits first? Did Fidelity and T Rowe Price really want into Slide so badly that they were willing to let the earlier investors receive a preference over them?

It doesn't really make sense to me the way this is broken down. I would have expected basically everyone to make about 2x their money.

<comment><USER12> Earliest investors get priority since they took the most risk.

<comment><USER7> While that sounds logical, it typically works the opposite way. In a big cashout early investors often get the highest ROI because they got in at the lowest price, but they usually get paid last.

</comment></comment></comment><comment><USER3> Sometime in the future I expect to see this same type of posting about Twitter and Digg.</comment>


Internet in All Languages: Internationalized Domain Names - <AUTHOR> https://blog.dofo.com/internationalized-domain-names/ <comment><AUTHOR> When the DNS (Domain Name System) first entered into operation in 1983, only the characters in the Latin alphabet were allowed to be used. With this system, although the characters of different alphabets could have a place in the DNS, web browsers and e-mail clients were not supporting such usage. By way of IDN (Internationalized Domain Name), that was first introduced in 2000, characters in non-Latin alphabets began to be available to use. Thereby, domains in almost all languages started to be registered. Until today 4 million IDNs were registered.

Read More: [https://blog.dofo.com/internationalized-domain- names/](https://blog.dofo.com/internationalized-domain-names/)</comment>


The general public has no idea what "statistically significant" means - <AUTHOR> http://alexanderetz.com/2015/08/03/the-general-public-has-no-idea-what-statistically-significant-means/ <comment><AUTHOR> tl;dr: assuming the null hypothesis is true (usually defined as no effect), discrepancies as large or larger than this result would be so rare that we should act as if the null hypothesis isn't true and we won't often be wrong</comment>


Startup co-founder survival tips - <AUTHOR> http://blog.stereotypes.fm/startup-co-founder-survival-tips/

<comment><USER2> Great post! I agree with all the points made in the post and I'd like to emphasize the point about "Don't be scared to fire." Team chemistry is so important in an early stage company that you have to be comfortable with making subtractions. The word "chemistry" in "team chemistry" is perfect because building a small team is exactly like chemistry where adding or removing one substance can be the difference between two substantially different compounds. And in startups, that's the difference between a successful and a, well, not so successful startup.

Long story short, don't let a bad apple linger; even if it's a rockstar apple. It will set the tone of your startup you may not recover.</comment>


Sam Altman's 36 life lessons before age 30 (2015) - <AUTHOR> http://www.businessinsider.com/36-life-lessons-from-the-head-of-silicon-valleys-most-important-startup-factory-2015-4 <comment><USER2> It's an excellent list, other than 14).

> 7) Don't waste time. Most people waste most of their time, especially in > business.

The difficult part of this one is that many businesses employ very intelligent and motivated people to make their products into addictive time sinks. There's a reason so many websites start playing videos immediately upon loading and then automatically load more until you stop them. It has nothing to do with concern for what's best for you as a user or as a human. It takes more determination not to waste time on the internet every year. It's an arms race that Facebook, Netflix, Reddit, Medium, etc are winning.

While sama is doing what he does, most people spend hours tapping and stroking their phones and hours more watching video _on a daily basis_.

</comment><comment><USER3> I agree with many of the points but he has somewhat of an age obsession. As someone who probably (statistically) will reach the age of 100, it does not sound very enlightened when only 30. This is not the only article he has lamenting the passing of time.

Also point 6, mostly a good point, reads like it was written for 12 year old; 'internet' is the best thing if not used frivolously, which is what that sentence, imho, is supposed to mean.

</comment><comment><AUTHOR> One of the better single lists of advice I've read. Thanks Sam

</comment><comment><USER4> Was #4 a secret?

<comment><AUTHOR> Which part?

It's no secret _" it's hard to be totally happy/fulfilled in life if you don't like what you do for your work."_ The point is _" most people pick their career fairly randomly"_; to those people, the rest of the advice he gives in #4 is very helpful.

Napoleon Hill would certainly approve of the suggestion to _" aim to be the best in the world at whatever you do professionally"_\- similar to the philosophy Hill promotes: _" Whatever the mind can conceive and believe, it can achieve regardless of how many times you may have failed in the past"_. Unless you were born into a billionaire family and never had to consider goals of the people around you, I'm sure you're aware that most people, even in America, unfortunately, don't believe in themselves very much. [https://www.forbes.com/sites/niallmccarthy/2016/09/23/survey...](https://www.forbes.com/sites/niallmccarthy/2016/09/23/survey-69-of- americans-have-less-than-1000-in-savings-infographic/)

Even ambitious people tend to set goals way lower than they are capable. A person working all day every day to make a million dollars by retirement could probably make a billion in 10 years if they believed it.</comment></comment>


Ask HN: Where do young working professionals hang out? - <AUTHOR>

As a young working professional I'd like to meet others who are in the same boat. But I find it difficult because it's not like in college, where everyone on campus are the same age as you with similar goals. Where can I meet other young working professionals? <comment><USER2> Are you in a major city? Reddit.com usually has meetups going on, with atleast a few regulars.

Meetup.com is also a great option, especially in larger cities.

</comment><comment><USER3> The same place you meet other regular people: bars, clubs, bookstores, grocery stores, classes, gyms, etc.</comment>


Hacker School: Summer 2012 Applications Open + Etsy Scholarships - <AUTHOR> https://www.hackerschool.com/blog/1-summer-2012-applications-open

<comment><USER2> Awesome. No more words to describe.

I thought that Hacker School is an amazing idea since the first time I read about it. Now, it became something much more bigger, a response to the sexism that spread in software development (it's not an exclusive problem from U.S., but it's a start to inspire everyone else).

My congratulations to Hacker School team and to Etsy initiative.

I hope someday I can attend to some batch :)

<comment><USER3> Thanks! It means a lot to hear such kind words. We'd love to have you apply :).

</comment></comment><comment><USER4> Disclosure: former Hacker Schooler.

Great experience. If I were asked to name one criticism off the top of my head, though, it would be "gender gap." It was my first foray into tech, and I was a bit taken aback. Now I'm acclimated, but it's great to see they've got the resources to try and tackle the gap head on. The school always draws quite a few tech-experienced people who were in nontechnical (and not male- dominated) fields. This means they can bypass the whole four-years-of-classes- with-only-dudes problem that comes with expecting any shift from academia.

<comment><USER5> That is sort of the point of the Etsy sponsorship!

See [http://www.etsy.com/blog/news/2012/etsy-hacker-grants- suppor...](http://www.etsy.com/blog/news/2012/etsy-hacker-grants-supporting- women-in-technology/)

</comment></comment><comment><USER6> Want to know what Hacker Schoolers work on? I made a visualization of hacker schoolers github projects: <http://hs.bn.ee>

<comment><USER7> Really cool visualization, and a well made UI to boot. Good work. Was that one of your HS projects, or did it come afterwards?

<comment><USER6> Its one of the first HS projects I did, I really wanted to get a handle on what everyone else was working on, and what they had done pre/post hacker school.

<comment><USER7> Neat. Any chance you're looking for a job?

</comment></comment></comment></comment><comment><USER8> I think that this is a good program with an undoubtedly noble cause. However, I don't really like the idea of calling this need based aid. Need based aid should be given regardless of gender. If someone wants to do Hacker School and is unable to afford it, they should get aid regardless of what gender they are.

So this comes off not as giving aid to those who need it, but as incentivizing women to join Hacker School, which is something entirely different. It's not a bad thing, but it's not need based aid.

And, although this program is going to be effective, I'm not sure that it is going to create true equality. It's going to artificially inflate the number of women applying to hacker school, but I'm not sure that that is the right way to go about encouraging women to join Hacker School, and I'm not sure that this is going to result in true equality. The real goal should be to encourage the community of women programmers to apply to Hacker School on their own, and get it to a point where they can organically be half of the enrolled people. All this program does is compensate for the problem, not truly trying to fix it.

So, although I like this initiative and think that it definitely will help equalize Hacker School, I think that there are a few issues with it.

<comment><USER9> I don't think it's a stretch though to call this "need-based aid for women" as Nick does in the post. The term is often used in this way by traditional educational institutions.

I felt very fortunate to have the money lying around to take three months off of work to attend Hacker School, and I imagine there is a large pool of entirely qualified candidates who are financially unable to make this work (several of them posted on HN last time around). If we assume happening to have the money socked away and being a passionate hacker are a bit independent, then this need-based aid for women will increase the number of entirely qualified women who are able to attend. This is the right, least- artificial way to "[encourage] the community of women programmers to apply to Hacker School on their own," as is possible for an organization that doesn't happen to run a k-12 educational program or other major institutional social change agent.

Although 5k for three months will modify the incentive structure, it's less than the average American income for that period, and your living expenses are going to increase if you're moving to NYC unless you're coming from Paris or similar. The only expected changes in the applicant pool are qualities I don't give a lick about, having to do with educational loans, having a job that can be done remotely for a few days a week, having money saved up, or personal financial conservatism (willingness to spend money on an unknown 3-month commitment). From what I've observed, Nick, Dave and Sonali are 100% about maintaining the excellent quality of people in their program, and I trust they will ensure that financial aid for women in no way undermines that.

This hopefully will "artificially inflate" (what wouldn't be artificial? just waiting until the problem is solved by someone else?) the number of women applying, some of whom will be accepted and hopefully become better hackers, contributing in a small way to fixing the problem. Should more drastic steps be taken at a primary / secondary / college education level to attempt to "organically" grow the community of women programmers? Sure, and I'll continue to vote for elected officials who say they'll try to fix this as I always have, but in the meantime the Etsy scholarships are trying to make concrete progress growing that community right now.

</comment></comment><comment><USER10> This is a pretty awesome move by Etsy. I'll be graduating soon and have been giving strong consideration to moving to New York. All my research indicated that Etsy would be a great place to work. This reinforces my feelings!

<comment><USER11> My accounting professor is the head of accounting at Etsy. He definitely enjoys the culture.

</comment></comment><comment><USER12> This is an interesting program ... wish there was a weekend bootcamp organized in a similar way. I know people do things like ROTC on weekends ... why not us hackers? :)

<comment><USER3> We haven't done this primarily because we think you'll improve the most when becoming a better hacker is the top idea on your mind (<http://www.paulgraham.com/top.html>). Doesn't mean it wouldn't work though. Just maybe not as well. I'd love to see what would happen if someone organized it.

</comment></comment><comment><USER13> This is great guys, glad to see you're going to grow HS and bring in more guys/gals. I myself applied as it is very close to my core values I _know_ there is value in alternative forms of education (in my case Home School > College) which I can directly atribute to my rapid success once I joined the job market.

Keep up the great work!

</comment><comment><USER14> I was in batch[0] and have spent a lot of time with the people who run this group. I think they're wonderful.

I stand by what I have written in the past: <http://news.ycombinator.com/item?id=3436007>

<comment><USER9> Thanks James - I remember reading that comment three months ago and being encouraged by it to apply, and it's been a stupendous experience so far.

I was one of the lonely programmers Nick describes in the post - it's been fantastic to spend so much time with so many people I now hold in such high esteem.

</comment></comment><comment><USER15> As someone who has been contemplating quitting my job and moving to a more programming centric job (oracle consultant now) this is something that would be a huge boost both personally and professionally (my github profile is sadly pretty bare).

I'm just wondering what the success rate is when helping people apply for jobs at the startups that I see at hackruiter. I would love to do this but am still uncertain about taking 3 months with no pay _before_ I start applying for jobs. The alternative being apply while still working.

I am on the fence about applying. Anything anyone could say to sway me one way or the other is much appreciated. :D

<comment><USER3> Unfortunately, there's no real answer to this. If you're good, you won't have trouble finding a job, but that's a question only you can answer. I plan on writing a longer post about this later, but the best way to answer this for yourself is to ask "do I really love programming?" People who love programming and have gone through Hacker School have had no trouble getting a job afterwards.

If you do love programming, you should apply!

</comment></comment><comment><USER16> As much as I would love to apply, I am going to be in Japan through most of July and August. If anyone would like to sublet (1-2 people) my fiancée and I have 1000sqft in Brooklyn, but since we'll both be gone most of the summer I'd be happy to give a good deal to a fellow hacker! Email from my page if you need more details since I'm not offering on craigslist or anywhere else.

It's technically a 3BR, but currently one bedroom is a study (library and desk) and another is our drawing + modelmaking studio (you can use my soldering station if you'd like).

<comment><AUTHOR> Thanks! That's a really helpful offer. My cofounder just emailed you about it.

Also: If you can't make it this summer, our fall batch will start in September :)

<comment><USER16> Just sent a reply!

</comment></comment></comment><comment><USER17> Lovely. I know plenty of men who don't have the financial ability to do something like move to NYC for a summer, but to hell with them. Let's try to find those rare women who code and throw money at them.

Listen, I'm all for supporting women in engineering. There are many female engineers in my family. I just find it appalling that Etsy is willing to just throw money at one gender and not another. It's sexist garbage.

I see their motive, and i wholly support it. They could have taken a better line of play though; Rather than straight up gender segregating, why not organically filter the scholarship candidates based on female-oriented areas of study? Etsy is largely creative and industrious and driven women, so why not just sponsor projects that will naturally be female-led?

No offense to the hacker school guys and etsy guys, but this is straight up amateurish.

<comment><USER18> I'm reading a negative tone to your comment (ie "to hell with them", "throw money at them", "sexist garbage").

Do you think it's possible that rather than having negative, sexist motives for offering scholarships, they are simply going out of their way to be _supportive_ to minorities in the field?

<comment><USER19> There's also a lot of evidence that bringing in more women into any group increases its performance [for example: [http://hbr.org/2011/06/defend-your- research-what-makes-a-tea...](http://hbr.org/2011/06/defend-your-research- what-makes-a-team-smarter-more-women/ar/1)].

EDIT: MaxGabriel pointed out this article claims more women in a group improves performance [not equal numbers]. Thanks for the correction.

<comment><USER17> Yes, I'm quite negative on this because I feel that their methods are very poorly thought out. Good on them, as I said, I support their effort and their basic mission. That's not in question. You don't have to appeal to affirmative action or research; the concern is not their motive but their method.

Let me make sure I'm clear: I love the idea of female engineers being given incentives to enter a male-dominated field. There are a myriad of great benefits to everyone involved. The trouble is, the methods they are using are previous-level.

Seriously, a group of hackers can't figure out a more elegant process? They are literally saying "If you are a girl and ask us for money we will give it to you". That's absurd. Lets see them set up a special fund or something for female-friendly fields rather than just throwing money at women outright.

I stand by my assertion that their methods are amateurish but their intents are good. I'd like to see the people who designed this program at least speak to the topic; what else they tried, why it didn't get approved, why it didn't work, et cetera. I just want to hold other engineers to rigor and examine their methods, especially when I find the goal noble but the methods sophomoric.

<comment><AUTHOR> _They are literally saying "If you are a girl and ask us for money we will give it to you"_

We never said that. This is what we said:

 _We're not going to lower the bar for female applicants. It frustrates us a little that we feel the need to say that, and we think it underlines the sexism (intentional and not) that so pervades the programming world._

 _But we want to say that now, so people don't have to waste time asking or debating the point. Women will be judged on the exact same scale as men. We think to do otherwise would be insulting and counterproductive. We care a lot about getting more women into Hacker School, but we won't do it at the expense of the quality of the batch._

<comment><USER20> That's great that you won't lower the bar for female applicants. Does that mean you will remove gender-identifying information from applications before evaluation/processing? that could be a cool way to do things and a great experiment...

<comment><AUTHOR> I agree it would be a fascinating experiment, but I don't think this would be possible, since interviews are an essential part of our process.

</comment></comment></comment></comment></comment></comment></comment><comment><USER21> Do you have a HS yearbook of sorts, why dont you feature the alumni more prominantly?

</comment><comment><USER22> do you need a special visa to attend if you are non-US resident?

<comment><AUTHOR> You should be fine assuming you can legally be in New York for the entirety of the batch (12 weeks). We've had several non-US citizens. We're not an official school, so we can't sponsor student visas.

<comment><USER22> Awesome. I will definitely be applying for the etsy scholarship, sounds like a great opportunity.

</comment></comment></comment><comment><USER20> I think it is a positive thing to discuss the structure of the scholarships, whether one agrees with it or not. Let's have an open discussion of it.

I would love to see alternative methods to involve women more in coding rather than just paying them.

The current method just 'feels wrong' to me.

I've also seen programming competitions with a 'top female programmer' award but no 'top male programmer' award, which also feels wrong, even if the intent comes from a very positive place.

I've spoken w/ several female developers/engineers and they were not excited about that kind of structure.

<comment><USER23> Yes; as a female programmer I find both of these kinds of things offputting, not encouraging.

Of course, if I were a female programmer who needed $5k and a kick in the pants to level up (e.g. if this had been around 2 years ago) I would probably jump at the chance, it's all a matter of perspective.

One of the issues is simply lack of good alternatives. How else would we encourage other female programmers to come out of the woodwork? Strong female leadership of the program would be a great start in my opinion. Women Who Code in San Francisco has a great, active, healthy Ruby study group going on which is arguably a mini-Hacker School. It's run by and for women, and there's been (as far as I know) zero issues getting enough people together for lively discussion. Plus, some of the newbies have explicitly said they preferred this all-women environment as they could ask the sort of questions they may self- censor elsewhere. Although that's hardly realistic of the real software engineering world - any full-time programmer has probably got to get used to working with men as well as women. :)

</comment></comment><comment><USER24> So will people learn things like SQL injections and XSS attacks there?

If so, would have applied a longtime ago. Too late for me now, now i just follow the latest vulnerabilities people post on twitter.

<comment><USER3> We mean hacker in the pg (<http://www.paulgraham.com/gba.html>) esr (<http://www.catb.org/~esr/faqs/hacker-howto.html>) sense of the word, namely an awesome programmer who loves learning, groks hacker culture, and self identifies as a hacker. Not a cracker. Certainly learning about computer security is part of being a good hacker, but it's not primarily what Hacker School is about.

Incidentally, have you ever read Hacking: The Art of Exploitation ([http://www.amazon.com/Hacking-The-Art-Exploitation- Edition/d...](http://www.amazon.com/Hacking-The-Art-Exploitation- Edition/dp/1593271441))? It's my favorite book on the subject.

<comment><USER24> No i haven't but ill definitely look into it since it sounds pretty cool ha</comment></comment></comment>


Building products that grow on people - <AUTHOR> https://uxdesign.cc/building-products-that-grow-on-people-8fb87d331d59?source=friends_link&sk=3525eae307354fcc09cf85128cc35f15 <comment><USER2> Thanks for the new perspective on digital products that keep changing. The best ones remain the same adding layers. Amazon?</comment>


What Spotify learnt when it quietly changed colors - <AUTHOR> http://thenextweb.com/dd/2015/07/20/wow-thats-green/

<comment><USER2> The new green, especially the white on green version of the logo looks a lot like the chat app Line, which is big in Japan, and as far as I know also growing quite a bit in the U.S.

More over Line just released a music streaming application, with essentially the same color scheme.</comment>


The Desolate Visions of Andy Warhol - <AUTHOR> https://newrepublic.com/article/158587/desolate-visions-andy-warhol <comment><USER2> Nothing I've read about Warhol's interior life has ever suggested that he was some kind of subversive Diogenestic visionary - peering into the cold dead abyss of Anerican capitalism. This reputation has come from subsequent readings of his work, which have been cheered on by the opportunists of his estate. Nothing more Warholian than that, I suppose.

</comment><comment><USER3> Banksy riffed on simlar themes with "I can't believe you morons actually buy this shit." ([https://www.wikiart.org/en/banksy/i-can-t-believe-you- morons...](https://www.wikiart.org/en/banksy/i-can-t-believe-you-morons- actually-buy-this-shit-2007)), but even then, I think he was just knocking the ladder away behind him using the ultra-expensive counter signal of insulting his patrons.</comment>


DIY Smart Cleaning Robot - <AUTHOR> https://thestempedia.com/project/diy-smart-cleaning-robot/ <comment><USER2> With holidays and festive season around the corner, everybody wants their house to be as shiny as a mirror's back. But that can be quite a task! Not anymore, fellas, not anymore! With this easy to build Smart Cleaning Robot, you can now easily clean the floor and the walls of your entire house with a few clicks of the button on your Smartphone! Sit down, grab a cuppa, a plate of your favourite, and clean away!

Want to make one for yourself? Then why are you still here?

Ready. Set. Clean!

[https://www.youtube.com/watch?v=kFR5s2ZLiNw](https://www.youtube.com/watch?v=kFR5s2ZLiNw)</comment>


The Arab Polymath who set the foundations of "modern optics" - <AUTHOR> https://en.wikipedia.org/wiki/Ibn_al-Haytham <comment><USER2> Anybody interested in astronomy will be familiar with Arabic science and mathematics during what in Europe was the Dark Ages, for example many star names are Arabic, but for most people in the west it is completely unknown.

<comment><AUTHOR> It's strange how most schools and universities teach students that "the scientific method" was applied since the 17th century and the majority of scientific discoveries were made in the last 500 years, while it seems, after investigation, that all the major scientific methodologies and discoveries were figured out and used by Greeks and Muslims before even the west was a thing.</comment></comment>


Nobody Knows What They're Doing - <AUTHOR> https://medium.com/dev-color/nobody-knows-what-they-re-doing-42b5c3ee487d <comment><USER2> Beating the impostor syndrome been most of my struggle professionally. It's like a daily struggle, you fight and move on. Like you shit everyday, you just do it whether you like it or not.</comment>


Aether – Free, privacy-sensitive public communities - <AUTHOR> https://getaether.net <comment><USER2> Hey guys - Burak here. Ouch, this was supposed to be a 'soft' launch.

I'm here to answer any questions as usual. I'll pick the best and try to add it to the FAQ on the site.

<comment><USER3> You state that one of the purposes of this platform is to allow you the freedom to be wrong, but if people can save something before 6 months, how would you prevent someone from saving an embarrassing comment for future use against you? Or are you the only one capable of saving your own comments?

<comment><USER2> They can definitely save yours - and if you're someone whose comments should be saved, be pseudonymous. What they can't do is they can't go back 14 years of history like they can on Twitter, after the fact, and find something out of context there.

Pseudonymity and ephemerality are the two sides of the same coin. One doesn't protect without the other.

<comment><USER4> Have you considered the inequities that such a retention policy introduces into HOW history can be used?

The entrepreneurial (and governments) will archive everything to serve the wealthy (including governments), who will be able to use history to their ends. Those without resources will live in an eternal present, except where history is used against them.

To sell this kind of retention policy as a user-protecting feature is (in my view) at best naive, and at worst, disingenuous. This model increases the economic cost of mining history, but in doing so, entrenches existing wealth and power structures.

Thanks to the ever-decreasing cost-per-bit of storage, the internet is forever. The only hope for redemption lies in this permanence affecting everyone equally; otherwise we're doomed to (continue to) live in a world where only the wealthy and politically connected have read and write access to history.

<comment><USER2> There is an argument to be made there, but you're off on the difficulty of storing data. Reddit, even with its 250M+ users, generates only 8.5Gb per month of data. A $100 Western Digital hard drive could hold the entirety of Reddit's comment history. In other words, if you want to collect data, you can do it just as well if you're just a random guy on the street just as well as any government can. Aether can't prevent anyone from collecting data, just like Snapchat also cannot. But what it can do is that it can reduce the availability of historic data as much as possible, so the data is at least not _accidentally_ collected.

> ... but in doing so, entrenches existing wealth and power structures.

What entrenches existing wealth and power structures is wealth and power. That's why it's valuable to have wealth and power. In other words, you could prefix that sentence with almost anything, and you'd still be right.

</comment></comment></comment></comment></comment><comment><USER5> Nice! I remember hearing about Aether some time ago, and I'm glad to see development is continuing; I think the world needs more decentralized social networks. I plan to try it out and maybe post more in-depth feedback.

For now, though, since nobody else in this thread has mentioned it, I'm going to be that guy – sorry:

I wish it weren't Electron. I don't really expect it not to be; I realize your development resources are limited, and that it's the easiest way to make a cross-platform application, which is a must for a social network. Still, having to deal with a non-native UI makes it harder to truly enjoy using the app. Also, if it uses as much memory as Electron apps typically do, I'm going to want to quit it when it's not actively in use – but apparently Aether really wants to stay running in the background so it can continue to synchronize posts. (Is there a way to close the client but keep the backend running?)

<comment><USER2> I know - given enough time and money, I'd make a CLI app using something like ncurses. Unfortunately though, the reality is that I just don't have the resources.

The backend is its own process, you could definitely find the binary in the application package and run it on its own — it's not bound to Electron in any other way. Electron is just the client, the frontend graph compiler, and the backend are two separate binaries that communicate with each other over gRPC. That means you could run any of these independently, as well. [0] The client is Electron, but nothing except the UI happens in JS, everything happens in the frontend and the backend, and they're both tiny, fast, native-compiled Go apps. My backend, for example, is 4.8mb, frontend I think is 6mb. The rest of the size of the app (70mb) is just Electron, its dependencies, and the whole enchilada that comes with it. I'm not happy about it either.

For better or worse, though, since the JS part of the app is nothing but its 'skin', it's as memory efficient as Electron apps get. No real processing happens in JS, it's all Go.

[0] That said, it's not something I support right now, because if you ran the backend separately and then started the app, you'd effectively be running two backends. There is not yet a way to tell the app package that it should connect to an existing backend running locally instead of starting one.

<comment><USER6> How about providing a WebExtension that exposes the bits that require a binary (e.g. P2P and possibly proof-of-work part if WASM does not work for you) or are provided by the platform, then you can waive the Electron requirement for those who do not want it, plus your web interface potentially works the same for read-only visitors and users (who have the web extension installed). You can also include the frontend bits in the WebExtension so no one relies on the website working anymore.

</comment></comment></comment><comment><USER7> FYI, there doesn't appear to be any cryptocurrency involved, which is a plus for me.

</comment><comment><USER8> > Communities can elect and impeach their own mods by voting.

If these are public communities that anyone can join pseudonymously (are they?) how does Aether prevent Sybil attacks, where a malicious actor joins a community using multiple identities and votes themselves into power?

Also, spam?

<comment><USER9> Does any existing kind of social network prevent that kind of attack? I don't believe so, and I'd think that's pretty difficult to accomplish. Aether does attempt to make this nontrivial, I believe, by requiring proof-of-work before posting things. I don't know, but possibly that proof-of-work also applies for impeachment votes (I hope it does!). Then depending on how hard that proof-of- work requirement is and how many people are already in the community, performing such an attack would become harder.

<comment><USER10> Reddit is experimenting with sybil-resistent voting on a sub I moderate (r/ethtrader). In fact there is a vote[0] going on to retain me as the first moderator. The sybil-resistence comes from weighting polls with community points (on our sub we call them donuts - don't ask). Donuts are intended to represent contribution to the community so derive from sub specific karma, being a mod, etc. It's still an experiment but I think it's going well so far.

[0] [https://www.reddit.com/r/ethtrader/comments/9tm60s/governanc...](https://www.reddit.com/r/ethtrader/comments/9tm60s/governance_poll_i_am_first_moderator_at_your/)

</comment></comment></comment><comment><USER11> > What Aether does is, you can actually disable the mods that you don't > approve just for yourself, and those disables count as an impeach vote. If > majority of the community agrees, the mod loses mod rights for a while for > everyone. That makes it so that Aether communities are places where the > content is what the current users of the communities want, not those who > were there first by chance.

Even if "impeaching mods through votes" is unpractical, subscribing to an unmoderated view of the forum on your own accord is brilliant!

<comment><USER12> I like the way you sum this up Ixe. Your comment illicits a mental model like a manual transmission where the terrain (dynamics of the conversation) sets the context for what gear to select (which mods to have in place) , based on how much gas you are giving the engine, which is a personal choice of the driver. One driver may choose a very low gear to go down a hill (a conservative moderator that controls the decent of the vehicle) and another driver may wish to just coast down at high speed (very litte moderation). Same car, same terrain, different driver, different choice for what gear to keep it in. The mental model gets a little loose goosy when you consider that this is not a single person making the decision but rather a group, but oh well. Thanks Burak for making this platform. I'm really enjoying the ride so far!

<comment><USER12> I completed the mental model... It's. Like one of those 12 passenger 4x4 off road tour vans, or even a 100 passenger hydrofoil boat, where the driver has a reputation score, as do the passengers, and you can pick which boat you want to go on based on the expected conditions of the drive. If the boat ride is billed as a leisurely jaunt for calm bird watching, and the driver knows this is what the passengers want, and he decides to push the pedal to the metal and everyone is thrown about, the passengers can suspend the driver and pick one who understands the consensus of the what the groups specifications are. This has amazing potential as a platform for civil engagement and public works management and other areas of social coordination. I can't wait to get into this further.

</comment></comment></comment><comment><USER13> For anybody who is curious as me:

> Aether is a product of Burak Nehbit (@nehbit). You can reach out at burak at > getaether dot net.

> Burak Nehbit

> Burak is an ex-Google, ex-Facebook product designer and engineer. He > specialises in end-to-end product experience, from product, UX, to API > (developer) experience. He is an expert in the fields of distributed > networks and monetisation (e.g: prior jobs at YouTube and Facebook).

> He was also the part of the team that built the next generation, material > design AdWords at Google. (e.g: complex data visualisation, dashboards).

> He is available for consulting as a full-stack designer and engineer in > distributed networks space. He lives in San Francisco.

[https://getaether.net/about-contact/](https://getaether.net/about-contact/)

<comment><USER14> So, Burak, care to share the thought behind your username? :)

<comment><USER2> Which username? I use @b on Aether.

<comment><USER14> I was teasing the parent- not being serious.

<comment><USER2> Ah okay, sorry! I'm the Burak mentioned above and I'm as puzzled as anyone else on why this was posted, and why this is the highest upvoted comment, to be honest. Make a thing for privacy and the next thing people do is post your info online - Satoshi had a point. :)

<comment><USER15> People got trust issues. They want to know if they can trust the maker. If not, privacy, schmivacy.

</comment></comment></comment></comment></comment></comment><comment><USER9> From the FAQ:

> How long does it take for a post to reach the most of the network?

> [...] Long answer [...]

> [...] In fact, it's a little larger than one request in a minute, because > some nodes are behind restrictive firewalls and NATs, and they cannot be > reached, they can only make requests out.

Regardless of the actual FAQ discussed here, the statement is made that "some" nodes are behind NAT's, implying that most will _not_ be behind NAT's. Living in the Netherlands, I'm not sure about countries overseas in the Americas, but here I'd wager >99% of normal household PC's will be behind a router implementing NAT. This makes actual peer-to-peer communication nigh impossible here, and I'm always doubtful about nice peer-to-peer solutions that claim to be cool and such but sneakily have the ever-present requirement that you have a public IP address. I don't. Nobody I know does, except for VPS's and so forth. But I generally don't run a graphical client on my VPS.

Of course, theoretically, this should be solved by IPv6. But really I wouldn't know how to start using that, and whether my provider has all the hardware and software in place to actually have this work. (And whether my provider-issued router supports it, as well.)

Can anyone chime in on how the situation regarding NAT's is in the Americas? And does anyone have a good source on how to get started with IPv6 communication between peers, when I don't even know the stuff I mentioned above?

EDIT: I see that Aether has/seems to have the option to work around this problem by allowing one to run the backend (the thing that actually connects to the peer-to-peer network) on a different machine than the client. That would enable using a VPS to run the backend.

<comment><USER2> > because some nodes are behind restrictive firewalls and NATs

That is just a weird turn of phrase on my part, will fix it. What I mean is:

because some nodes are behind restrictive firewalls and [restrictive] NATs.

In other words, most NATs work fine. Even if they don't work fine, it has a process called a 'reverse open' where the inbound connection is requested by the receiving remote and the remote 'captures' and uses the same TCP socket.

Even if that doesn't work, as you've discovered, you can run the backend Ona VPS.

<comment><USER9> Thanks for replying -- the client seems to work beautifully on osx here. It took some time to start showing post content, and I even restarted it once because it didn't seem to do that after a few minutes, but now it does, so that's good.

My NAT is apparently a restrictive one, since I've got "Mapping failed, no router, or router uncooperative" as my port mapping status. But as you predicted, I've indeed got some inbound connections, so yay.

<comment><USER16> I unfortunately am getting the same error however I'm not getting any inbound connections either

[https://i.imgur.com/49VaP62.png](https://i.imgur.com/49VaP62.png)

</comment></comment></comment></comment><comment><USER17> Moderation seems like a view layer on top of the content graph, right?

I feel like a feature to blacklist actual storage and distribution of a particular post by fingerprint is going to be needed, because I'm not cool with simply not rendering child porn or someone's banking details if I'm still storing it for 6 months, and transmitting that info for two weeks.

<comment><USER2> The payload is just text. You're not carrying anything else.

But yes - for the very small, but not nonexistent case where a text itself can be not kosher, this is something that needs to be built in. It's on my list.

</comment></comment><comment><USER18> The idea of impeaching mods sounds interesting, but unworkable. How do you stop hostile communities from brigading and removing each other's mods?

<comment><USER19> I wonder why can't one just pick mods for themselves. E.g. "subscribe" to a mod, meaning whatever that mod hides, you don't see. It could even be mutual.

<comment><USER2> That's exactly how it works. Default mods are just that, default.

</comment></comment></comment><comment><USER20> It'd be nice if I didn't have to download an application to use it. Open to a reddit alternative, but I care more about convenience than any sort of encryption a client would offer.

<comment><USER21> I dunno - when I saw 'decentralised' I assumed I'd have to download something. Isn't that how decentralised applications work?

<comment><USER22> It is theoretically possible to serve a web app from github pages and let the decentralized peer-to-peer application run in the user's web browser.

There are limitations and this approach might not be feasible for this application.

<comment><USER23> The web doesn't have to eat everything.

</comment></comment></comment></comment><comment><USER24> >Aether is a peer-to-peer app, and it has no servers. A result of this is that source IP of any specific public post cannot (easily) be determined.

Not possible. Either source IP's are in communication, meaning you know the active posters IP, or the content is being proxied from a centralized server.

I hate Discords lies in saying they won't sell user data, but at the least they know the real danger of how IP's are infact all that's needed to call a swatt team down to kill someone in the U.S.

If you want to build an actual private conscious platform you will have to do something like FreeNode where people can make their own 'servers' for free, but also make their own actual servers if they want to.

<comment><USER2> The posts are echoed across the network. You know where you got the post, you don't know whether that post was created by that specific IP. Because you could have gotten the same post from all other nodes in the network as well.

Delivery IP is not the creation IP.

<comment><USER24> The IP by definition of a P2P network must be the creation IP at some point.

IP's delivering the content are liable for what they spread. Using client IP's to distribute data like a proxy only shifts the burden onto the clients themselves.

These are all problems that should be gone over in detail on Aethers site, and should have been the main problem to tackle in its protocol.

</comment></comment></comment><comment><USER25> How does it compare to RetroShare [1] ? RetroShare has been around for years and works quite well. It seems like Aether attempts to provide quite similar features.

[0] [http://retroshare.net/](http://retroshare.net/)

</comment><comment><USER26> For linux users who don't want to install the snap, just try it out:

$ sudo mkdir /mnt/aether

$ sudo mount -t squashfs <downloaded.snap> /mnt/aether

$ /mnt/aether/aether

</comment><comment><USER27> If you advertise a "privacy-sensitive" product, please don't load css from googleapis.com and JS from googletagmanager.com on your website.

Actually don't load anything from third parties. It's a complete turn off.

<comment><USER2> I agree - but anybody who ever built anything would tell you it's a tradeoff. Yes, I could get metrics through the server logs. But I'm just one single guy that built this thing. I don't have the resources to build a privacy sensitive tool _and_ a privacy sensitive page view reporter that tells me how many people visited a page, so I can improve it. One challenge at a time.

<comment><USER6> Why not use Piwik/Matomo?

</comment></comment></comment><comment><USER28> Downloaded and installed, but no content has loaded in last 30min.

<comment><USER29> Same here. At first I thought it was the hug of death, but I feel like with p2p it should only get faster as more people join?

Inbounds conns. in last 15m 0

Last inbound Unknown

Outbound conns. in last 15m 0

Last outbound Unknown

Last outbound duration Unknown

</comment></comment><comment><USER30> How come this is called a privacy sensitive aplication while this is happening "and it has anonymous metrics in. Stable versions are going to ask in the onboarding if you want to join the anonymous metrics program (like Firefox)." ?

The dev should be upfront about it even when the prerelease versions are being used.

Tell us what those "anonymous metrics" are for instance.

Is the communication between nodes encrypted or transported over SSL?

</comment><comment><USER31> Sounds good to me as it sounds like the individual is the ultimate end moderator allowing community moderators to try remove stuff but it is ultimately up to the individual if he wishes to see that content. I have to say I extremely dislike moderation. But this moderation it seems like I can choose. I am not a kid I want to choose. This seems like a good in between where offensive stuff may be stopped but no one will prevent you from removing the veil of secrecy should you curious mind want to see more.

</comment><comment><USER32> To state the obvious, I can't download—"You caught it before the launch. :)"

That said, I really, really appreciate the native client here and I'm excited to try it out.

<comment><AUTHOR> Maybe you should refresh your browser cache.

<comment><USER33> I am also unable to download and I doubt _my_ cache is the issue as I've never visited this site before. Is anyone able to download the Windows client (or any other)?

<comment><USER34> > Is anyone able to download the Windows client

Yeah, but with the same result as what another poster said

> Downloaded and installed, but no content has loaded in last 30min.

As of yet, the github page says

> Aether 2 last version: 2.0.0 (currently non-functional, in development) [..] > (Not yet working, 80% complete)

and the last commit was 2 months ago :(

edit: this is how the page looks to me: [https://i.imgur.com/2tsW5zv.png](https://i.imgur.com/2tsW5zv.png)

<comment><AUTHOR> The github isn't updated currently, I've also asked the dev about the update of the source code

Maybe there is an issue with the dns.

Those are the current links to download

[https://static.getaether.net/Releases/Aether-2.0.0-dev.5/181...](https://static.getaether.net/Releases/Aether-2.0.0-dev.5/1811030036.53a6bb49/win/Aether- Setup-2.0.0-dev.5%2B1811030036.53a6bb49.exe)

[https://static.getaether.net/Releases/Aether-2.0.0-dev.5/181...](https://static.getaether.net/Releases/Aether-2.0.0-dev.5/1811030036.53a6bb49/mac/Aether-2.0.0-dev.5%2B1811030036.53a6bb49.dmg)

[https://static.getaether.net/Releases/Aether-2.0.0-dev.5/181...](https://static.getaether.net/Releases/Aether-2.0.0-dev.5/1811030036.53a6bb49/linux/Aether-2.0.0-dev.5%2B1811030036.53a6bb49.snap)

<comment><USER34> Just as I was going to say "maybe it's my router", I checked the app again and saw it has loaded content, yay :)

</comment></comment></comment></comment></comment></comment><comment><USER35> >Communities can elect and impeach their own mods by voting.

This invites tyranny of the majority. Which will mean for certain topics where the community dislikes open discussion and questioning of ideas, divisiveness will grow because bad ideas can not be effectively challenged.

<comment><USER36> I've never seen a community that was completely open to discussion and where bad ideas disappeared because they were effectively challenged.

On the other hand, I've been in several communities where the mods had a clear agenda and the participants were helpless to change it.

I'd personally rather the people who are hostile to new ideas or critical thinking have their own communities and that their ability to harm other communities can be mitigated by a moderation system accountable to the users.

I do think there needs to be serious discussion about how to make communities that are good for people. The echo chamber and polarization effects tend to contract people into a smaller worldview. How to have a cohesive community that doesn't do that is essentially an unsolved problem in the social sciences.

<comment><USER35> I agree with most of what you said, but we might be looking at it from different angles.

Especially want to zero in on this:

>I'd personally rather the people who are hostile to new ideas or critical thinking have their own communities

A fact that you don't seem to have in your mind here is that often those people _are_ the majority.

So you'll have majorities voting in mods who are hostile to new ideas and critical thinking.

With this platform we still get lock-in of polarized thinking and echo chambers.

<comment><USER36> I think your view here may be a little more pessimistic than mine.

I don't think the majority is opposed to critical thinking, although I think most people are bad at it. I also think most people are bad at civil and effective communication, so you may get toxic communities even from well- meaning people.

I'll be interested to see what happens. You may be right that communities will select mods that create echo chambers.

I'm a little more optimistic. Whichever way it goes, I think the ability to experiment (e.g. with weighted or modified voting schemes) with this sort of mechanic is definitely worth pursuing.

<comment><USER35> Yes you are optimistic.

</comment></comment></comment></comment></comment><comment><USER37> Trying to install using snap, keep getting the following errors, any advice? Never stops retrying.

bee@blackandyellow:~/Downloads$ snap install --dangerous --devmode Aether-2.0.0-dev.5+1811030036.53a6bb49.snap

2018-11-03T11:59:53-04:00 INFO Waiting for restart...

2018-11-03T12:00:01-04:00 INFO auto-connect of snap "aether" will be retried because of "aether" \- "core" conflict

EDIT: Snap files are an archive of sorts. I was able to extract it into a folder and run the file named "aether" to get it to work.

EDIT2: This gets the frontend working but I don't think it gets the backend working entirely.

<comment><USER2> @b here. Seems the snap isn't able to boot because of a similarly named package? Linux isn't officially supported right now, but there was somebody downthread that managed to get it to work with the —dangerous flag.

</comment></comment><comment><AUTHOR> You can use with Tor:

[https://meta.getaether.net/t/how-to-use-aether-behind- tor/53](https://meta.getaether.net/t/how-to-use-aether-behind-tor/53)

</comment><comment><USER38> I created Rust sub. Feel free to join. Also, I don't see how to find or share link to a community. Is there a way to find community by a fingerprint?

</comment><comment><USER39> Its getting blocked by AVAST and MALWAREBYTES (not surprising since I don't usually run random Internet supplied executables).

</comment><comment><USER40> > Aether is a peer-to-peer app, and it has no servers. A result of this is > that source IP of any specific public post cannot (easily) be determined.

Really? Doesn't p2p model actually expose your IP address to everybody you communicate to?

<comment><USER2> It is a flood network.

> A result of this is that ___source_ __IP of any __ _specific_ __public __ > _post_ __cannot (easily) be determined.

</comment></comment><comment><USER41> > "Communities can elect and impeach their own mods by voting. If a mod > behaves inappropriately, users can disable that mod locally as well."

This sounds like it's definitely vulnerable to abuse. Democracy is nice, but I'm not sure it's a great idea in a situation like this where it's online with total anonymity and easy to vote fraudulently.

> "Aether keeps a 6 months of content by default. It's gone after."

I often want to search for stuff that seemed unimportant at the time a year or more later. We should focus on changing society so it's not so critical of statements people made years ago when they changed as a person, this is a better solution.

Skeptical of the value of community-building that Aether can provide, it seems like a novelty product to me. What is wrong with pseudononymous communities like Reddit & HN?

<comment><USER36> > We should focus on changing society so it's not so critical of statements > people made years ago when they changed as a person

I'm a believer in progress long term, but I seriously doubt humanity is really capable of what you're describing in a way that's applied equally to all groups of people.

It seems several orders of magnitude much easier for people to develop the habit of recording information they might need later.

<comment><USER42> _> It seems several orders of magnitude much easier for people to develop the habit of recording information they might need later._

6 months is fine for just social commentary and such, but it seems to me that a design like that effectively _forces_ the community to be banal, because the community will not remember anything for any longer than that time.

Better if there was some mechanism by which the most-saved (upvoted?) posts are retained by the network as a whole for longer.

On, for example, Stackoverflow, most of the posts I've found useful have been more than 6 months old. 6 months is not such a long time unless we're talking about the latest pop culture hotness.

We are lucky Shakespeare didn't use a platform that forgets everything after 6 months.

</comment></comment></comment><comment><USER43> Anything to worry about as far as attack vectors when running something like this? eg, could someone hack my computer more easily than they could from just running Facebook in a browser, etc?

</comment><comment><USER40> Please add a way to copy a link to clipboard instead of opening it in the default browser.

Viewing/saving/url-copying a picture without opening the source in the default browser would also be great.

</comment><comment><USER40> Why does it enforce CC-BY-SA? I never care about what are people going to do with comments I post, can't I choose WTFPL / CC0 / Unlicense instead?

</comment><comment><USER44> Could you make the life span settable by the speaker? That is, the default is 6 months, but perhaps I want less? Or more (to be archived locally some way)?

<comment><USER2> Yup - check LocalMemoryDays key on your backend config. That controls the archival. That should be the largest value, and the network head and network memory should be smaller than that.

</comment></comment><comment><USER45> Maybe they can get Gab to adopt this.[1] Gab is having trouble finding hosting. This could go mainstream fast if it picked up the Gab crowd.

[1] gab.ai

<comment><USER46> >This could go mainstream fast if it picked up the Gab crowd

The "Gab crowd" doesn't have the cultural pull or influence that this would require.

<comment><USER45> They're loud and have reasonable numbers. Get some gun forums on there and there will be traffic.

<comment><USER46> Yeah, but the mainstream still wants nothing to do with them, although I suppose it depends on how you define mainstream.

</comment></comment></comment></comment><comment><USER47> Privacy-sensitive communication MUST be transport encrypted, if not end-to- end. What are the plans here and how soon will it be implemented?

</comment><comment><USER40> WTF is is this "Minting proof-of-work for the entity..." thing when submitting comments? Does it mine BitCoins or something?

<comment><USER48> There is no mining of cryptocurrencies. You are spending CPU cycles to compute a proof so spamming the network with user actions is non-zero cost.

</comment></comment><comment><USER42> Are there any limitations on how large a post can be? Could a malicious user just post giant posts to make the network suffer?

</comment><comment><USER49> I tried it, it didn't work. Sorry

</comment><comment><USER50> > Communities can elect and impeach their own mods by voting.

Fyi, impeach means to hold a trial not to kick them out.

On this point I have to disagree. Democracy does not work well in foss communities and can easily be hijacked and makes it to easy to foster strife and divisions. I like the traditional foss way of being led by a BDFL where if you disagree with leadership you can "Just fork it".

<comment><USER51> Impeach: call into question the integrity or validity

Seems perfectly appropriate usage to me.

<comment><USER50> You're right,I was correcting a common misunderstanding.

</comment></comment></comment><comment><USER40> Is Aether actually going to be hard for privacy-hostile governments to block or compromise?

<comment><USER48> I think the _scope_ of privacy here should be clarified. Content on Aether is public. There is no concept of private encrypted messaging. The privacy guarantee is that what content you view within the network, your navigation path, cannot be tracked by a server. This is because your node syncs _all_ the data, including the content that you don't navigate to. This is in contrast to the way many services track user behaviour by their username.

As discussed in other posts, it is difficult to discover origin IP of pseudonymous users, because in a flood network, when my node gets some information it is usually not from the IP where that information was generated. That is another privacy feature due to the way Aether distributes data.

Aether is more difficult to block than centralized services, since you will have to catch all the nodes instead of just one set of known IPs / domains. With great effort it is probably possible to DPI at ISPs to identify Aether traffic and drop? But being a peer-to-peer protocol, Aether can easily sync across VPN tunnels, run within private networks, or physical meshnet infrastructure independent of ISPs.

<comment><USER40> > This is because your node syncs _all_ the data, including the content that > you don't navigate to.

All the data? Isn't it going to take a huge lot when the network grows popular?

</comment></comment></comment><comment><USER52> So how does peer discovery work? How to find initial nodes to connect?

<comment><USER9> It seems there is some kind of bootstrap node running somewhere that clients connect to when they haven't got anything. The upside is that this bootstrap node isn't special, and anyone should (I believe?) be able to set up new bootstrap nodes. But I'm not sure on that part.

<comment><USER2> Yes, a bootstrap node is just a regular node with a bootstrap config flag. It doesn't do anything special. You could make your own node a bootstrap node if you want. (Which is, by the way, is a bad idea - it changes how often other people connect to you in a way that makes bootstrapping easier but posting content harder).

</comment></comment></comment><comment><USER53> I can't figure out how to use the snap.

<comment><USER54> I downloaded the snap and installed it from the command line with `snap install --dangerous Aether.snap`. Dangerous sounds dangerous... I'm not sure if it was a good idea, but it works and my system found the app when I searched for it. I clicked the "cat's bum icon" and we're away!

<comment><USER55> You are installing a program you downloaded off the internet.

The --dangerous is there to make you think about that for a moment as(or if you're lucky, before) you install.

</comment></comment></comment><comment><USER56> Is the linux tarball on the website updated to the most recent version? It runs under Arch, but just syncs endlessly. It's also a light client, where the Windows version is dark theme. I don't like using snaps, so this is preferred.

<comment><USER2> @b here. Snap version is untested - it compiles but no guarantees. I think some people got it to work downthread, you might want to check which flags they used.

<comment><USER56> Thanks for the reply. I'm talking about the tarball on [https://www.getaether.net/linux_download.html](https://www.getaether.net/linux_download.html)

Link Location: [https://github.com/nehbit/aether- public/releases/download/v1...](https://github.com/nehbit/aether- public/releases/download/v1.2.3-LNX-TAR/aether_1.2.3.tar.bz2)

Looks like it's v1.2.3, released in 2014, so I'm guessing this client won't work? Might want to remove that link! :)

<comment><USER2> Oh wow - you got the old, old version from the prior site, v1.x. The new version is 2.0.0, it's a completely different app. Clear your cache and go to getaeether.net again, that should give you the new site and new version.

<comment><USER56> It actually takes me to that old website when I use 'click here for other options' on Windows and my Arch machine, in incognito mode.

</comment></comment></comment></comment></comment><comment><USER56> How do you get this to not turn into a fascist/racist trash bin worse than 4chan/b/ as other Reddit clones have seemingly fallen into?

<comment><USER57> The same way you prevent them from becoming progressice/racist trash bin worse than reddit.

You let them speak and prove them idiots. It's really not hard. Unless you're constantly on the side that's losing, then it's pretty miserable.

But know that even though you're losing now you can reformulated your arguments and try again because no ones going to censor you. You have all the same rights because you, like they, are people deserving respect, no matter how much you look down on them or hate them. And that's what I tell them about you.

Less hate more love.

<comment><USER14> The problem, however, is that people are unresponsive to arguments. We are not reasonable, unfortunately. People aren't coming to these places to learn. They don't _want_ to learn.

I'm very curious as to how we can get out of this, because I really have a hard time understanding people and this is an enormous laboratory.

<comment><USER58> > unresponsive to arguments

Not just unresponsive to arguments, but will argue in bad faith, and it takes 10x as much effort to disprove someone's bad contentions than it does to produce them.

<comment><USER12> I agree with this position and wonder if there is any supporting evidence that speaks to this point that you know of?

</comment></comment></comment></comment></comment><comment><USER59> >Introduction: What's Aether?

>Aether gives you fresh, new content about the things you're interested in.

>You can create a community for your friends, or for strangers that are interested in similar things. All communities are public, and everyone can write to any community. (There'll be communities restricted to certain people, but we're still working on that for now.)

>If you're familiar with Reddit, Slashdot, or Usenet, it's pretty similar. Aether does a two main things differently though. The first is that it's ephemeral. The content disappears after a while. The other is, the communities are democratic, they elect their own leadership.

I hate these non-definitions. You've told me a lot of things, but I still don't know _what is aether_. Is it a website? a service? a protocol? an API?.</comment>


RTFM 0day in iOS apps - <AUTHOR> http://algorithm.dk/posts/rtfm-0day-in-ios-apps-g-gmail-fb-messenger-etc <comment><USER2> This is _not_ the default behavior for a UIWebView. It relies on a practice that is very common among developers of iOS apps with web content.

Specifically: every click/interaction that loads content in your custom web view sends the webView:shouldStartLoadWithRequest:navigationType: message to your web view delegate. Without implementing that method, clicking a tel: link _will_ prompt first. However, many apps throw some logic in there to detect any URI schemes that don't match the standard HTTP/HTTPS schemes used in normal websites, and trying to do something "nice" for the user, they handle requests for those URIs by calling:

[[UIApplication sharedApplication] openURL:request.URL];

This is a reasonable thing to do (outside the context of tel: links) because it allows the app to spawn an external app for custom URIs.

Therein lies the problem: not that UIWebView opens tel: links without prompting (it doesn't), but that many app developers are just trying to improve the inter-app experience, and unknowingly open tel: links directly with that openURL: method.

EDIT: Just my opinion, but I think it's actually pretty cool that Apple gives developers the ability to dial phone numbers without an extra prompt. It makes third-party contact/phone apps much more useful (imagine having to confirm every phone number to dial after tapping the contact in the built-in phone app). In a way, this is the kind of trust / freedom that iOS developers rarely enjoy without a fight. It's just unfortunate that in this instance, it also happens to be very easy to overlook this pitfall when implementing web view logic that handles non-http links.

<comment><USER3> While tel:// URLs open the Phone app without any prompt, there's also a telprompt:// scheme which opens the Phone app with a prompt. As an app developer, would you ever want to use the latter scheme instead of the former? Turns out, yes, you would.

The advantage that you get with telprompt:// is that, once the call finishes, the user comes right back into the app that initiated the call. With tel:// that is not the case.

<comment><USER4> Indeed I almost always use telprompt:// over tel:// for exactly that reason. It's usually better to bring them back into the app when the call finishes.

</comment></comment></comment><comment><USER5> Seems infinitely more reasonable to have the default be a prompt, and to have to explicitly enable "auto calling". People making a contacts app for example would immediately notice the prompt and rectify it. Meanwhile everyone else can remain blissfully ignorant of the tel: scheme.

On the other hand, with this system, every single app that ever uses a web view has to somehow magically divine that this could be an issue. The UIWebView docs certainly don't warn you about this. So what, is the expected behavior is that if you ever use a WebView in your app you should read every RFC on the planet in case there's some weird edge case like this? Maybe instead of creating systems that require careful developers we could try creating systems that work well by default and need you to explicitly turn on dangerous features like this.

<comment><USER6> Well, yes the prompt should be default. However, when I use a WebView in my apps I always consider the URIs in links to be potentially malicious.

</comment></comment><comment><USER7> Strange design choice on Apple's part. Having not read the documentation, my expectation would be that native buttons don't require a confirmation, but links coming from a webview do. It would have to provide an option to suppress the popups in use-cases where the developer is building their app in a webview, but if you're already jumping through all of the hoops for that sort of cross platform development, one more configuration to set isn't a big deal.

I'd blame Apple just as much as the devs. They made a choice to be insecure by default in a situation when a majority of developers are going to assume it functions like the rest of the OS does. Web views in any app ought to behave like Safari by default.

<comment><AUTHOR> This is true, both bad defaults and people not reading documentation. It's just like mongo that start by default with remote access enabled and no password - Shodan "mongo" and you will find thousands of live, not protected databases.

</comment></comment><comment><USER8> I would think a more likely to be exploited use case would be to find the telephone number of celebs. Send the celebrity some specially crafted message on FB or twitter with a good mix of social engineering and you should be good to go (provided they are on their phone when they view your message)

<comment><AUTHOR> Absolutely an exploitation technique. Or you can facetime them instantly and catch a photo of them in pijamas!

</comment></comment><comment><USER9> Hi guys,

I just did a talk during BSidesLV on the subject of URL Schemes and dangerous implementations.

For those who want all the details:

[http://youtu.be/rJroherlZVo?t=1m33s](http://youtu.be/rJroherlZVo?t=1m33s)

For those who want to skip explanations on how they work and see the bad examples, auto skipping about 10min:

[http://youtu.be/rJroherlZVo?t=10m24s](http://youtu.be/rJroherlZVo?t=10m24s)

One example that I have in there is Yo. Yo will automatically Yo someone on your behalf. So if an inline frame has yo://gepeto42 (basically), and you have Yo installed, I have just "de-anonymized" your Yo account as you browsed my website (or any page where I could inject that iframe). A good tip on where to find out about those is to buy Launch Center Pro and to extract the plist it has. This has info about hundreds of iOS apps and how their URL Schemes work.

Happy hunting.

<comment><AUTHOR> Great work man! I'm glad we can bring attention to security issues. Maybe we could work together.

</comment></comment><comment><USER10> > When a user opens a URL with the tel scheme in a native app, iOS does not > display an alert and initiates dialing without further prompting the user.

What is the justification for this behavior? Why should the web browser open a prompt but not other apps?

<comment><AUTHOR> Because the apps can initiate a call by just pointing a webview at tel:0000. Another reason is hybrid apps, imagine a contact hybrid app running in something like PhoneGap. You want to click a button and call right away without the phone asking you to confirm your action.

I'm not saying that Apple's design is good, but it is documented.

<comment><USER11> That was my thought as well. I'm sure the decision was made to connect as seamlessly as possible, without the user having to stop and click a dial confirmation.

</comment></comment></comment><comment><USER12> Why was this information immediately released/zero-day'ed? Is this method ignoring responsible disclosure or am I missing something?

FB, Google, and others all pay for bugs such as these, so even monetarily, it doesn't make sense to just release it to the public immediately. Again, this is assuming these bugs were not disclosed previously to companies affected.

edit: clarification

<comment><AUTHOR> It is not a 0day in the traditional meaning, it's a simple <did not read the manual> and <bad defaults> case. On the other hand I've been waiting to get on Apple's HoF for two years now, reporting cross-site scripting bugs and even a sqli - yet I'm not there. Apple is not getting any responsible disclosure from me.

<comment><USER12> I understand not reporting it to Apple, in their case they have basically disclosed the issue to anybody that read the manual (and they don't have the bug in their apps). I was primarily referring to the major players who do have the bug and whose primary responsibility the bug is.

<comment><AUTHOR> I can't do responsible disclosure when there are tens of thousands of apps using webView. The number of vulnerable apps is way too high for any kind of responsible disclosure.

<comment><USER13> You could have told Apple. They could fix this in iOS, blocking the apps via a software update.

If it was me, I would have notified Apple and all of the companies who have bug bounty programs.

<comment><USER9> Apple knows. Look at the security content of iOS 7.1.

[http://support.apple.com/kb/HT6162](http://support.apple.com/kb/HT6162)

I reported CVE-2013-6835. They fixed Facetime-Audio from Safari, but not from other browsers (yet?). This is quite a wide issue. I do not think letting every individual developer know is feasible. I did it for a few bad issues, but there's a limit to what can be done.

And a lot of these can be found in a matter of minutes anyways.

<comment><USER13> It might not be feasible, but why not if they might pay you money for it?

</comment></comment></comment></comment></comment></comment></comment><comment><USER14> You're saying that it's the app developer's fault that they haven't read all of the iOS developer documentation before opening webpages in a web view (rather than just the web view documentation)? That seems ludicrous.

</comment><comment><USER15> Well done I myself enjoy reading RFC's, but have yet to create something as crafty as this. Good work! Does not work on Android 4.4.2 requires application selection and then brings you to dialpad.

<comment><AUTHOR> Thanks a lot! I asked a friend to test it for me on android (wondering if it works) and I was glad that it doesn't. On Android it fills the phone number for you and lets you push the call button, which seems to me a much saner design.

<comment><USER15> Forgot to mention: Tested via google+ and hangouts with above mentioned android version. No FB acccount or messenger on mine to test that app so cannot speak to it but it seems the method of mitigating this attack is built in to Android.

<comment><USER16> It is. There's a separate permission for being able to initiate calls without prompting, and a separate intent -- most apps should use ACTION_DIAL[0] (which prompts), while apps with the right permissions may use ACTION_CALL[1], which doesn't.

There's yet another intent for dialling emergency numbers without prompt, which is reserved for system use -- non-system apps can only dial emergency numbers indirectly using ACTION_DIAL.

[0]: [https://developer.android.com/reference/android/content/Inte...](https://developer.android.com/reference/android/content/Intent.html#ACTION_DIAL) [1]: [https://developer.android.com/reference/android/content/Inte...](https://developer.android.com/reference/android/content/Intent.html#ACTION_CALL)

</comment></comment></comment></comment><comment><USER17> I disagree that it's not Apple's fault. This is a violation of the "principle of least surprise." When I drop a web view into my app I am not expecting web pages to be able to do much other than just be web pages. I'm certainly not expecting them to be able to dial the phone without prompting.

<comment><USER18> The article is misleading, if you do nothing your webview won't open any phone call. You have to implement a specific method to intercept links and explicitly open them in the device.

see `- (BOOL)webView:(UIWebView _)webView shouldStartLoadWithRequest:(NSURLRequest_ )request navigationType:(UIWebViewNavigationType)navigationType` method in official UIWebViewDelegate reference[0]

[0][https://developer.apple.com/library/ios/documentation/uikit/...](https://developer.apple.com/library/ios/documentation/uikit/reference/UIWebViewDelegate_Protocol/Reference/Reference.html)

</comment></comment><comment><USER19> Reminds me of the auto-reset Android bug that utilized a tel: URI that auto- dialed: [http://gizmodo.com/5946334/samsung-security-bug-can-wipe- out...](http://gizmodo.com/5946334/samsung-security-bug-can-wipe-out-your- galaxy-phone-updating)

<comment><USER20> Regarding your link, I'm currently on a computer without AdBlock for the first time in a while, and when I went to the gizmodo link it popped up a video ad I could skip in 5 seconds to continue reading.

Is this a standard thing? Are there really sites, especially one as big as gizmodo, that think it's a great idea to not let people view a few kilobytes of text before burning through any data limit they have with some mandatory video I don't care about?

Now I remember why I installed AdBlock.

<comment><USER21> Yes, it is standard practice now for Web designers to completely disregard more correct practices for their websites. Welcome to the twenty-first century...

</comment></comment></comment><comment><USER22> I'd call this bad design on Apple's part -- they should require the application to explicitly define a custom handler or fall back to default (secure) behavior. Yes, it's documented, but I'd call it a design flaw.

</comment><comment><USER23> Undoubtedly a poor design choice, I appreciate that you bring some attention to it.

      Facetime calls are instant. Imagine you clicking a link, your phone calls my (attacker) account, I instantly pick it up and (yes) save all the frames. Now I know how your face looks like and maybe where you are. Hello pretty!

      Yes, it works. I tried.

Can you please provide some evidence that this is practically possible? Last time I used Facetime it took quite some time before the connection was established.

<comment><AUTHOR> I did my test on WiFi which results in almost instant calls for me. Set your computer to catch the facetime call and answer it automatically (check this: [https://github.com/PaperCutSoftware/teleportme/blob/master/t...](https://github.com/PaperCutSoftware/teleportme/blob/master/teleportme.command)). Capture your screen continuously and if you might get the first frames of the call. It's all about what people do when their phone starts calling by itself. Most people freeze which results in a successful attack.

</comment></comment><comment> adam-f Being a bit pedantic here, but shouldn't it be specified as a URI, "tel:0000" not a URL-ish "tel://0000" with 0000 as the authority?

</comment><comment><USER24> There was a talk at BSidesLV called IOS URL Schemes omg:// [http://bsideslv2014.sched.org/event/21c84fe90196be5a475f6b33...](http://bsideslv2014.sched.org/event/21c84fe90196be5a475f6b33ba922628#.U_ZzFvldXf0) You'll probably want to watch this on Youtube: [https://www.youtube.com/watch?v=rJroherlZVo](https://www.youtube.com/watch?v=rJroherlZVo)

</comment><comment><USER25> There are a lot more security threats. My startup's URL reputation lookup service is being integrated with one of the biggest app platforms to help developers build security into apps. There are so many security threats that come with the standard WebView - mostly because I'm confident Apple and Google didn't think about how they could be used today.

</comment><comment><USER9> Chromium Bug Thread about this: [https://code.google.com/p/chromium/issues/detail?id=329259](https://code.google.com/p/chromium/issues/detail?id=329259)

"In practice, the closest to 'malicious' use I've seen the redict-to-app- store-from-ad case"

</comment><comment><USER26> I completely disagree that Apple is not at fault here. It should always prompt, end of story. More importantly though is that the devs at FB, Google, etc, likely saw how it worked in mobile Safari and, wrongly, assumed it would work the same in a webview. Why have the inconsistency in an a tag?

<comment><USER27> There are legit reasons to want to dial without a dialog. Apps like launch center pro, or a 3rd party contacts app. I agree the default should be prompt, but an option to disable that is definitely beneficial to users most of the time.

</comment></comment><comment><USER28> well Apple did not learn from their previous mistakes and from the Android related Tel+USSD issues - [http://www.securityfocus.com/archive/1/504414/30/0/threaded](http://www.securityfocus.com/archive/1/504414/30/0/threaded) [http://www.osvdb.org/show/osvdb/85806](http://www.osvdb.org/show/osvdb/85806) . But I did follow responsible disclosure procedure before going to public and informed Google, Samsung. I hope he did the same :/

</comment><comment><USER29> this may be off topic, but I don't recognize some of the UI elements(battery life, signal strengh, etc) in his screen shots, and I can only assume that is an iOS8 beta. Isn't he breaking his NDA by showing off an unreleased OS? Security hole or not?

<comment><USER30> It looks like a jailbroken iPhone, but also Apple have relaxed their NDAs regarding beta versions.

</comment></comment><comment><USER31> exist any solution to send URL with command "Send iMessage "text" to "user" ?! automaticly without tap to "send" ???

</comment><comment><USER32> I tried this but was unable to reproduce it.</comment>


Vocabul Jumble Free for Windows 8 - <AUTHOR> http://blogs.jkltech.in/2013/07/04/vocabul-jumble-free-for-windows8/

<comment><AUTHOR> Hi Guys,

We have presented our first Mobile/Tablet Game for the community to try and present their unique insight. We appreciate any honest feedback which can take our endeavor forward,

Windows 8 - [http://apps.microsoft.com/windows/en-us/app/vocabul- jumble-f...](http://apps.microsoft.com/windows/en-us/app/vocabul-jumble- free/81827e1a-7192-4120-a9f5-556b84412d34)

Android - [https://play.google.com/store/apps/details?id=com.jkl.games....](https://play.google.com/store/apps/details?id=com.jkl.games.vocabul.jumble)

Thanks in advance, Jay</comment>


Notes On "An Insurgence of Quality" - <AUTHOR> http://timoni.org/?p=30

<comment><USER2> "Programmers do not respect authority, only ability."

A minor mischaracterization. Programmers respect authority that is derived from ability and historic record of ability to execute/produce. Authority is something you earn and must maintain. For many people, "authority" is merely asserted by someone in a position of power, with little to back it up other than their own claims of control.

<comment><USER3> I would characterize that as 'acceding to authority out of respect.' Respect, or course, must be earned and can so easily be lost when those in authority start to demand it.

</comment></comment><comment><USER4> _"Conventional methods of business accounting aren't applicable to software. The days of quantifiable accounting are over."_

Mmmhm. Next thing you know, we'll all be talking about the New Economy....

<comment><USER5> Hey, man.. I can't disagree with you that some pundits are inflating these ideas a bit, but you can't deny we're in the middle of something big for humanity, and we're still trying to figure it out.</comment></comment>


Brad Feld: When Washing Potatoes Got Me Fired - <AUTHOR> http://www.linkedin.com/today/post/article/20131105122428-6332-my-first-job-when-washing-potatoes-got-me-fired

<comment><USER2> Well, that's 3 minutes of my life I'll never get back. TL;DR he was not fired for washing potatoes, he was fired for calling his manager a bitch when she denigrated his potato washing skills.

Apparently he's still not over it.</comment>


Database builder faces web-scraping lawsuit - <AUTHOR> http://www.out-law.com//default.aspx?page=10975&utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+out-law-NewsRoundUP+%28OUT-LAW+News-RoundUP%29 <comment><USER2> I thought it was going to be something like or about this: <http://news.ycombinator.com/item?id=1243159>, but rather it seems that the "scraping" was much more malicious and underhanded when you look at the details such as multiple logins to avoid detection and so much load was put on the server[s] that the website went down.

This is a hell of a lot more than just scraping a website like a search engine.

<comment><USER3> I don't think that proves maliciousness. There's no reason to believe M. intended to crash the web server.

</comment></comment><comment><USER4> Mitsubishi = Client || Snap-on = Original Contractor || O'Neil = New Contractor ||

A database was made by Snap-on for Mitsubishi. Mitsubishi moved the work to O'Neil. Snap-on did not want to give up their work [data]. A log in was required to access the data. Mitsubishi and O'Neil discussed ways to get the data. O'Neil tried to covertly get the data and hide what they were doing, according to 'testimony'. O'Neil caused damage. Snap-on sued O'Neil.

I think this is a better summary than the linked site. Plus I did not have 500 paragraphs with 2 sentences per section. No information was given on the contract terms. It is not mentioned how accounts are created to access the data. It is also not mentioned who should or should not have access. The method of gathering the data was not discussed at all; no mentioned of an automated process, no mention of a script, no mention of using interns with a Firefox plugin.

</comment><comment><USER5> What is bizarre/stupid of Mitsubishi that they did not own the database in the first place. When you hire/contract a developer, it would reasonable that their fruits of labor transfer to the one paying the bills.

Whoever wrote up the original contract at Mitsubishi screwed up, or alternatively Snap-on was smart/devious.

Reminds a little bit of the Skype fiasco, with eBay not buying exactly everything...

</comment><comment><USER6> The title is a little misleading IMHO. From reading the article it sounds like the term 'scraping' has been misused.

Rather it seems like a static web catalogue was downloaded and cloned once off using a website downloader.

.

The way we use web-scraping here on HN tends to be::

* frequently downloading

* structural changes can be as important as data changes

* often scraped on demand from a client request

</comment><comment><USER7> This is really a war between Robots and people. Would there be a case if someone had flipped every page of the paper catalog and entered the information into a database? I doubt it.

<comment><USER8> I don't know the laws in other countries, but where I live there is a database-law that explicitly gives the owner of a database rights. For example: you cannot simply copy the phonebook and put it on the web, it doesn't matter if you use ocr-technology or hire typists to type it all in manually.

<comment><USER9> Where I live (the United States), there is case law that found that where neither the individual pieces of data nor the selection criterion contain or are products of originality (read, "require editorial control" in the selection criterion aspect), the owner of a database has no such rights. For example: you can simply copy the phonebook and put it on the Web. It doesn't matter if you hire typists who type it all in manually after you've told them "Copy this." or if you use OCR technology.

The phonebook example was exactly the subject of Supreme Court case Feist v. Rural.

It seems like the only way Snap-on could win this one is if they demonstrate that their selection criterion met the standards for originality, which, though incredibly low, don't permit "Mitsubishi parts" to pass for originality.

Edit: This deals only with the copyright aspect of the suit. This doesn't cover the trespass and trade secrets aspects, which O'Neill might be found guilty of if there were terms and conditions they violated. But I don't know—I don't know much about business/contract law.

</comment></comment></comment><comment><USER10> What did the robots.txt file say? Was that violated? Is robots.txt a legal enough statement?

Interesting case.

<comment><USER11> As robots.txt is entirely optional (there's not even an RFC governing it), what it says or doesn't say isn't even technically violated in any way here, let alone legally.

(I apologize, I don't know how to do proper citations on here but <http://en.wikipedia.org/wiki/Robots.txt> provides more details.)

<comment><USER10> But it is the convention that is widely accepted.

<comment><USER11> Yep, most services or search engines choose to respect the convention, but if the article indicates properly, it doesn't sound like the robot in question here was trying to be particularly kind or gentle in its work.</comment></comment></comment></comment>


Burning Platforms Memo Damaged Nokia: Wiped out $13B revenues - <AUTHOR> http://communities-dominate.blogs.com/brands/2012/06/the-final-reckoning-of-burning-platforms-memo-damaged-nokia-by-wiping-out-13b-in-revenues-and-destro.html

<comment><USER2> What a ridiculous, sensationalist, witch-hunting article.

Elop's memo has about as much to do with Nokia's problems as the weather on the day it was leaked.

If Elop didn't write that memo or it didn't leak, Nokia would have been in about the same about trouble today, because their problems are not caused by Elop's wordsmanship but by Apple and Google re-defining the smartphone business in an astonishingly short time and Nokia (and RIM and Microsoft and Palm) not having a response.

<comment><USER3> The author might as well argue that Elop's memo is what sank Palm and RIM too. Would make about as much sense.

<comment><USER4> Tomi's blog is weird though, I'll give you that, blinded by nationalism. I can almost picture a pro-Canadian super-partisan RIM ex-exec writing the same sort of "mobile industry analysis" blog for RIM in parallel universe.

</comment></comment></comment><comment><USER4> It should be noted that the author of this blog (Tomi Ahonen)is an ex-Nokia executive with fierce, irrational support for Finnish (mis)management of Nokia and a strident detractor of Elop.

</comment><comment><USER5> JCPenney is going through a similar problem now in which the incoming CEO make huge changes very quickly seemingly without understand the market or the customer[1].

It seems like new CEOs often like to try to make a name for themselves and jump in head first and try to turn a very large boat quickly without a complete understanding of the consequences.

In JCPenney's case, the CEO believed that people would prefer to know they are always getting the best price, but he didn't understand that customers actually get a rush/high from finding great "sale" deals (even if they only look like sales because regular prices are jacked up).[1]

Perhaps Elop sould have taken some time to get into the company, and understand its customers (including carriers as well as phone users) before deciding on a course correction. Once a new direction was found, keeping it internal and shocking customers will new tech _when it was ready_ would have probably done much more for than company that telling everyone a year in advance, "Don't buy our stuff until we come out with our new Windows phone because we're not going to support it and we think it sucks".

[1] [http://www.mediabistro.com/prnewser/jcpenney-discovers- the-i...](http://www.mediabistro.com/prnewser/jcpenney-discovers-the- importance-of-research-the-hard-way_b39061)

</comment><comment><USER6> I think he overestimates how much life was left in Symbian. A better baseline might be RIM's performance over the last year (as another manufacturer that hadn't really figured out touchscreen smartphones), maybe plus a bit of upside for better Meego execution, but still... the carnage has been amazing.

It will be interesting to find out what today's "big announcement" in Finland will be. Probably more layoffs, but there were sale rumors recently...

</comment><comment><USER7> The memo, for those who don't know it off the top of their head: [http://www.engadget.com/2011/02/08/nokia-ceo-stephen-elop- ra...](http://www.engadget.com/2011/02/08/nokia-ceo-stephen-elop-rallies- troops-in-brutally-honest-burnin/) (just the first result I googled, feel free to suggest a better one)

</comment><comment><USER8> This guy definitely seems to have an axe to grind, this decline was going to happen regardless of the memo.

</comment><comment><USER4> Judging from the article's comments, Tomi and his fans somehow believe in their hearts that Meego and the N9 would have saved Nokia.

</comment><comment><USER3> Couldn't hardly get any more ridiculous or sensationalistic than this: "which was the first in a long series of managment blunders by Nokia's new CEO, Stephen Elop, the most incompetent and damaging CEO of any Fortune 500 sized company in corporate history"

You'd have to be pretty ignorant to have never heard of Enron or Worldcom, both of which were radically more destructive (in every possible sense). If we're talking about value destruction, Long Term Capital Management completely rattled the entire US economy, causing perhaps hundreds of billions in spill over damage. Bank of America and Citi both vaporized a trillion dollars with toxic mortgages, and more than take the cake in destruction. Lehman, Countrywide, and Bear Stearns also exceed anything that has happened at Nokia. The value plunge in Lucent and Nortel after the dotcom bubble (due in part to dangerous customer leveraging), was nearly half a trillion combined, with massive sales and profit drops. Bernie Madoff didn't run a Fortune 500 size company, but the $65x billion he 'managed' might as well have qualified him.

And on and on it goes.

Keeping with the style of the article, I'll just go ahead and declare that since the author was extraordinarily wrong about that one thing, therefore the entire article is pure trash.</comment>


7 New Year's Resolution Ideas for Open Source Project Developers - <AUTHOR> https://sourceforge.net/blog/7-new-years-resolution-ideas-for-open-source-project-developers/ <comment><USER2> 8\. move your project from the malware loving sourceforge to a more reputable place

<comment><AUTHOR> Sourceforge got bought out and the new owners eliminated that practice:

[https://sourceforge.net/blog/sourceforge-acquisition-and- fut...](https://sourceforge.net/blog/sourceforge-acquisition-and-future- plans/) [https://www.reddit.com/r/sysadmin/comments/4n3e1s/the_state_...](https://www.reddit.com/r/sysadmin/comments/4n3e1s/the_state_of_sourceforge_since_its_acquisition_in/)</comment></comment>