C and C++ Aren't Future Proof - <AUTHOR> http://blog.regehr.org/archives/880 <comment><USER3> > This propensity for today's working programs to be broken tomorrow is what I > mean when I say these languages are not future proof.

It doesn't matter. This is not how programming works in the real world. In the real world, you write the most correct program you can under time pressure. A new compiler, operating system, or platform arrives that exposes a bug. You fix it and you move on. It doesn't matter if the language is future proof or not. The process is similar for any complex program.

The blog's name is "Embedded in Academia" and this is perfectly valid viewpoint for someone in academia to take. And people in academia should research towards building more robust tools and languages. But it really is not going to matter in the real world. Languages and platforms will always not be future proof because computing is complex.

<comment><USER4> The particular kind of not-future-proofness he has in mind seems pretty practically important: code that relies on this undefined behavior often suffers from exploitable security holes. Just because computing is complex doesn't mean you have a free pass if you shoot yourself (or your customers) in the foot the _same_ way the previous 100 folks did. If it happens enough, it becomes prudent to do something about it, like people finally did about unsanitized format strings, or the use of unbounded sprintf().

His suggestion #3, that the standards should define more of the commonly used behavior and leave less of it undefined, wouldn't even require C programmers to do anything about it themselves.

<comment><USER3> > His suggestion #3, that the standards should define more of the commonly > used behavior and leave less of it undefined, wouldn't even require C > programmers to do anything about it themselves.

I've written Windows, Mac, Linux, Xbox, PlayStation, PSP, iOS, and Android code. The memory model is subtly different for each platform. I just don't think you can define certain behaviour and have that work across disparate platforms.

I haven't really written any device drivers or kernel space code but I would imagine it would make the job even more difficult.

<comment><USER5> Ostensibly, a platform like Java or Rust is supposed to abstract stuff like the memory model. I haven't written a lot of Java code, especially not Java code that runs on many different native system / VMs, but from my perspective of blissful ignorance, it seems to have done the job?

Same with other high-level VM based languages like Python...

<comment><USER6> Python is not future proof.

There are undefined sequences even in Python, where Jython and CPython output different programs.

<comment><USER7> Small amounts of undefined behaviour are normal in most language specs though to give implementations flexibility. Tests to make sure you do not rely on them would be useful though.

</comment></comment></comment></comment></comment></comment><comment><USER8> I think there is an important point here, which is that C and C++ compilers have let us get away with a lot of undefined behavior for a long time, and that there hasn't been a lot of tooling to help avoid it nor a culture that stresses the long-term danger of depending on it.

I can speak as someone who has been programming in C and C++ for over ten years, but only in the last few years became aware of this issue and started taking it seriously. Five years ago I would do things like cast function pointers to void-pointer and back, or calculate addresses that were outside the bounds of any allocated object and compare against them, all without really even realizing I was doing something wrong.

I don't think this will spell doom-and-gloom for C and C++ though. I think a few things will happen.

First of all, the compiler people are walking a fine line; yes, they are breaking code that relies on undefined behavior, but they often avoid breaking too much. For example, I've had it explained to me that at least for the time being, gcc's LTO avoids breaking any programs that would work when compiled with a traditional linker. In addition, they often provide switches that preserve traditional semantics for non-compliant code that needs it (like -fno-strict-aliasing and -fwrapv).

Secondly, I believe that tooling will get better, and rather than ignoring the warnings I believe that people's general awareness of this issue will raise, as well as knowledge of standard-compliant ways of working around common patterns of undefined behavior. For example, it's often easy to avoid aliasing problems by using memcpy(), and this can usually be optimized away.

Thirdly, I expect that the standard may begin to define some of this behavior. For example, I think that non-twos-complement systems are exceedingly rare these days; I wouldn't be surprised if a future version of the standard defines unsigned->signed conversions accordingly.

<comment><USER9> I agree with all your arguments. The function pointer <-> void pointer conversion in particular is an excellent example. But the very last example, unsigned -> signed conversion, is not a good illustration of the point you are making then.

unsigned -> signed conversion is already "implementation-defined behavior" (as opposed to "undefined behavior"). The standard does not guarantee how it behaves but forces compilers to make a choice and to stick to it.

A different example, of a behavior that is really undefined, would be signed arithmetic overflow:

int detect_max(int x) { return x+1 < x; }

The function above branchlessly detects that its argument is INT_MAX, and returns 1 in this case thanks to 2's complement representation.

Except that it doesn't. The command "gcc -O2" compiles it into "return 0;". GCC can do this, because signed arithmetic overflow is undefined behavior. The compiler is only taking advantage of undefined behavior in a way locally convenient.

Now that two's complement is (almost) everywhere, making it the standard for signed arithmetic overflows is the sort of bold choice I would like to see, but it won't happen (it would break GCC's existing optimization).

<comment><USER8> Good point about undefined vs. implementation-defined, though even implementation-defined behavior could break programs that switch to a different implementation that makes a different choice.

</comment></comment></comment><comment><USER10> This caught my eye "Program analyzers that warn about these problems are likely to lose users."

For me, this is perhaps the biggest issue raised in this article, as static and dynamic analysis tools become more ubiquitous we should be learning to fix the issues that they raise, not ignore them.

I remember a while ago (2004 or 5) interviewing a college-hire candidate, I had asked about working with others and we had gotten to talking about code review - the candidate was passionate about how code review had helped with a group project he worked on, but every single example he gave of a a bug found by code review was something that -Wall would have found...

The same applies to static analysis - let the machines do the work that they can do, that leaves the humans to get on with the work that the machines can't do (yet!)

</comment><comment><USER11> The problem with smart compilers is indeed how they break existing (naive) code, optimizing away things like "assert(len + 100 > len)" [1]

Making a correct overflow check in C/C++ is not just not straightforward, it is overy complicated even for experienced developers [2]. This is IMHO inacceptable for a thing that is required often in a security context.

Therefore, I hope that option 3 proposed by the author (change of the C/C++ standard to define the correct behavior at for least integer overflows) will be adopted. However, this probably will not happen for a long time, leaving us with security holes all over the net.

[1] <http://gcc.gnu.org/bugzilla/show_bug.cgi?id=30475>

[2] [http://stackoverflow.com/questions/3944505/detecting- signed-...](http://stackoverflow.com/questions/3944505/detecting-signed- overflow-in-c-c)

<comment><USER12> I don't really see how that's a problem with the compilers instead of with the language.

</comment></comment><comment><USER13> C and C++ indeed aren't future-proof, but it's not juste because of undefined behavior, it's by remaining stuck firmly in the 1960's in terms of programming style.

C++11 added many changes intended for "do-it-yourself" crowd, like auto, new function syntax, lambdas. It didn't add much in terms of "let the compiler do the work for me" crowd (one notable exception being variadic templates, something that was in my own XL programming language since 2000). In C++, you are still supposed to do the boring work yourself.

For example, C++11 still lack anything that would let you build solid reflexion and introspection, or write a good garbage collector that doesn't need to scan tons of non-pointers.

If you want to extend C++, it's just too hard. C++11 managed to add complexity to the most inanely complex syntax of all modern programming languages. Building any useful extension on top of C++, like Qt's slots and signals, is exceedingly difficult. By contrast, Lisp has practically no syntactic construct and is future proof. My own XL has exactly 8 syntactic elements in the parse tree.

So in my opinion, C and C++ are already left behind for a lot of application development these days because they lack a built-in way to evolve. If you are curious, this is a topic I explore more in depth under the "Concept programming" moniker, e.g. [http://xlr.sourceforge.net/Concept%20Programming%20Presentat...](http://xlr.sourceforge.net/Concept%20Programming%20Presentation.pdf).

</comment><comment><USER4> A side note I took away from this post is the existence of Frama-C, which appears to be a quite nice, open-source analyzer: <http://frama-c.com/>

</comment><comment><USER14> So far I doubt C++ is going anywhere - it's here to stay. When the usage of such languages as Rust will gain more traction up to the point that high performance games engines will be written in it, one could start saying that C++ is being pushed out. But it's really somewhere in the future.

</comment><comment><USER15> Hey, don't lump C++ in with this. If you write code in the STL weenie style or the Pretend It's Java style there aren't any idioms I know of that would ever violate the rules he mentions (out-of-range pointers, signed overflow, invalid aliasing). I don't do those things and the C++ programmers I work with don't do those things, at least not habitually. I don't see violations of undefined behavior rules, or the use of idioms that come close to it, very often in our code. Not nearly as often as the sort of mundane errors that no language can prevent.

These are not problems of a language per se, but the original sins of neo- vaxocentrism and confusing "I understand how this might work, at some random abstraction layer" and "I can depend on what happens when I do something stupid". Free your mind of these and the rest will follow.

These low-level bit banging errors are vastly less common than shared-memory concurrency issues, which as far as I can tell are endemic to all code that attempts shared-memory concurrency, in any language. If you want to have an axe to grind about languages that aren't future proof, look there.

<comment><USER16> "If you write code in the STL weenie style or the Pretend It's Java style there aren't any idioms I know of that would ever violate the rules he mentions (out-of-range pointers, signed overflow, invalid aliasing)."

What does the STL do about signed overflow? As for out of range pointers, that is an easy one to get with the STL:

      vector<int> somevector(100);
      somevector[200] = 5;

"These are not problems of a language per se"

Yes they are: the default numeric type is fixed-width, pointers pop up all over the place and pointer dereferences are unchecked by default. Personally, though, I would have chosen (as the article's author did) the more severe deficiencies in the standard, like the lack of any requirement that a function with a non-void return type have a return statement along every control path or the fact that there is no reliable way to signal errors that occur in destructors.

"These low-level bit banging errors are vastly less common"

Not in my experience, and not judging by the number of bug reports and vulnerabilities I have seen that stem from low-level mechanics.

<comment><USER15> I'm not saying the language is some sort of security barrier that prevents any error, I'm saying sanely styled code does not have these issues in practice. The solution is "don't do that, and cultivate habits that will not cause you to do that by accident", not having the compiler make up semantics for broken code or putting in checks everywhere. Just because someone, somewhere does it wrong, doesn't mean it's impossible to do it right.

this:

      vector<int> somevector(100);
      somevector[200] = 5;

Is a C idiom translated by cut-and-paste. The unmotivated poking of arbitrary magic-number offsets into a magic-number sized vector is not proper. It's the kind of thing that sets off alarm bells on even the most casual of review.

<comment><USER16> "I'm saying sanely styled code does not have these issues in practice"

Otherwise known as the "just do it right" argument. This is an argument that goes all the way back to the days of writing everything in assembly language, and it was just as wrong then as it is today. If only a restricted subset of a language can ensure that basic issues do not become serious problems, then the language should be restricted to that subset.

"not having the compiler make up semantics for broken code or putting in checks everywhere"

Really? I would rather have the compiler put in run time checks whenever it cannot infer that no input will cause the program's behavior to be undefined. Thus, the compiler might insert a check here:

      for(i = 0; i < input.length(); i++)
        some_vector[i]++;

but not here:

      for(i = 0; i < min(input.length(), some_vector.length()); i++)
        some_vector[i]++;

nor here:

      if(input.length() > some_vector.length()) {
        throw some_exception();
      }
      for(i = 0; i < input.length(); i++)
        some_vector[i]++;

At the very least, requiring bounds checks on array access would create a definition for out-of-bounds pointers: program termination (or perhaps an exception being thrown). A reasonably good compiler can detect when a bounds check is unnecessary and can remote the bounds check as an optimization. Why shouldn't this be something that compilers do -- out-of-bounds array access is never a good thing (oh, wait, you might be dereferencing some arbitrary pointer that you got by some means other than allocating memory with "new" -- OK, fine, but that is what type systems are for; this sort of separation is not unheard of, I see it in Lisp with SBCL's FFI)?

"The unmotivated poking of arbitrary magic-number offsets into a magic-number sized vector is not proper. It's the kind of thing that sets off alarm bells on even the most casual of review."

Perhaps so, but then the answer is not simply "just use the STL." As with most things C++, it requires a long list of things to make code work right, and even people who have been writing C++ code for many years are sometimes surprised to discover that something they thought was fine is actually bad. C++ makes it pretty easy for programmers to do the wrong thing and needlessly difficult to do the right thing, which is why years of expertise are needed to write remotely reliable C++ code.

<comment><USER15> I really don't have any difficulty finding programmers who have the discipline to not use the unsafe parts of the language all over the place. C++ has an issue with having a fragmented multitude of sane subsets, but any of them are fine if they get the job done.

That said, I don't understand why you still keep putting up awful mostly-C code as if any trained C++ programmer wouldn't yell at you for doing it wrong, _even before they saw the part with the error_.

      for(i = 0; i < input.length(); i++)

Where did you learn this? don't do this. Everyone else knows not to do this.

      for(i = 0; i < min(input.length(), some_vector.length()); i++)

This is actually worse, though it does have the virtue of probably working. If you want a run-time check, use at(), or better still use an iterator already.

C++ has all sorts of issues. It's too hard to learn, it's missing some very useful features, and it has a number of rough edges that you have to learn your way around. But the things being complained about in the OP and by you are not real problems for anything but beginners. There just aren't that many naked array accesses or pointer math operations going on in an ordinary C++ application written in non-C style.

<comment><USER17> Iterators don't protect against iterator invalidation due to e.g. emptying a vector while you iterate over it. Accessing elements through an invalidated iterator is undefined behavior and can lead to exploitable security vulnerabilities.

Even modern C++ has very unsafe parts.

<comment><USER18> You're arguing a straw man here. bcoates is saying, and I agree, that the usual examples being given on how horrible C++ is, are not idiomatic C++ and are used only by people who don't have any experience using C++. Of course it's easy to come up with examples of when things might go wrong. C++ is a powerful language, and with great power comes great responsibility, pardon the pompousness of that phrasing. C++ isn't perfect by a long shot, but the reasons brought forth in the OP and most of this discussion are _not_ examples of _real_ problems.

<comment><USER19> Many times it's the _human error_ which causes the bug/vulnerability to happen rather than sheer ignorance/lack of experience. In such cases a tool which prevents this from happening in the first place is superior to one which doesn't have such a safety feature in it.

For the same reason we can't ever completely prevent traffic accidents by requiring higher skilled drivers. We can prevent traffic accidents by building cars, lanes, junctions and roads in such way which minimizes the damage caused by a human error.

I'll rather use a hammer which refuses to strike to my finger even if I try to make it to, rather than one which I can smash my fingers with by accident. I am sure you would too.

<comment><USER18> Sure, and that's why I e.g. prefer strong typing for bigger systems. The examples that have been used so far just aren't good examples of what is wrong with C++, which is what the point was about. At some point, there is a trade off between safety and power, and one that makes C++ quite well, IMO.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER20> If all people started writing code with more RAII and Smart Pointers this would be a better world.

Talking about C, well... it's unsafe by nature, let's face it.

<comment><USER19> If all people started writing code in a modern C++ equivalent called Rust this would be a better world. After all in comparison Rust is _safe by nature_ unlike C or C++. :)

<comment><USER21> Really? I should switch my apps from C++ to an unfinished language?

I'll consider once the Mozilla foundation have written any application of note in it.

<comment><USER19> You should not _switch_ your apps. You should stop creating new projects in C++ once Rust is mature enough for your liking.

The fundamental "problem" we're having/facing with C and C++ is the investments we've put in. Lots of "infrastructure" in modern day computing relies on C and C++ and will do so for ages. We can't just drop the projects and switch to something else(say Rust or maybe Go), _but we can stop creating new C and C++ codebases_ to alleviate the problem for the future.

<comment><USER14> Exactly, it's a chicken and egg problem. C++ has tons of libraries, while Rust has barely any. Rust can use external C bindings, but not C++ ones yet. I think if they solve the issue of using C++ libraries from within Rust, the transition will be much easier, and meanwhile more native Rust libraries will be created.

<comment><USER22> Is the C++ ABI issue _ever_ going to be solved?

<comment><USER23> Yes, in the cases where the operating system is done in C++.

The C ABI is the operating system ABI and it is only ubiquitous in operating systems done in C. Other operating systems use whatever ABI the system offers.

</comment></comment></comment></comment></comment></comment></comment><comment><USER24> Sufficiently Smart Compilers vs. Sufficiently Dumb Code

<comment><USER25> A better way to put this would be Sufficiently Smart Compilers vs Insufficiently Defined Languages.

</comment></comment><comment><USER26> It will exist as long as there are people porting C to other architectures!

C is there since 1972, it is one of the most widely used programming languages of all time and there are very few computer architectures for which a C compiler does not exist. Many later languages have borrowed directly or indirectly from C, including C#, D, Go, Java, JavaScript, Limbo, LPC, Perl, PHP, Python, and Unix's C shell.

</comment><comment><USER27> Nothing is future proof - don't worry. We have only been programming for the last 60 years. C has endured 40 years out of that. That is no guarantee that it will endure further. But the point is programming practices has not drastically changed during the course of these years. As and when a disruption occurs there, almost all our current tools shall be rendered obselete.

</comment><comment><USER28> I don't see how this issue is specific to C/C++.

Don't all languages have "don't do that" corners, even if they are just bugs in the current versions of the compilers/interpreters?

C and C++ at least _tell_ you where some of these are, so actually the situation is better?

</comment><comment><USER29> if assembly was regular writing then C would be cursive. I would like to see D/go/rust succeed where C/C++ has failed.

</comment><comment><USER30> People use C/C++ like you ride on the streets and freeway - the sign says 65mph max, yet everyone else is on 70. Just don't go too much over it.

Laws are the be broken, and C/C++ is the wild west in this respect - <USER2> programming is welcomed.

And I love it :)

</comment><comment><USER31> >> We ditch the C and C++, and port our systems code to Objective Ruby or Haskell++ or whatever.

omfg:))

<comment><USER32> Objective Ruby ? What's that?

<comment><USER31> This is suggestion from articke to code in and I have no idea wtf it is

</comment></comment></comment><comment><USER33> Wow, C and C++ have undefined behavior? I bet nobody knows that unless... they took an undergrad comp sci class.

Why is this on HN?

Use the right tool for the job. Sometimes that C or C++, sometimes it's not.

<comment><USER34> There is substantially more sophistication to his points than you give him credit for. If someone who is an expert in something - and he _is_ \- says something about their area of expertise that you think is obvious and simple, consider perhaps that it's your level of understanding that is lacking, not theirs.

<comment><USER33> Academics have been whining about C and C++ since at least the 1980s. But if you ask any three academics what programming languages they like, you'll get three different answers, depending on what department and program they are in.

I'm sure Dr. Regehr is a smart guy, but I don't consider academics good sources of advice on software engineering, for the same reason I don't get sex tips from Catholic priests. Also, John Regehr's CV relates more to static analysis than software engineering anyway.

</comment></comment></comment><comment><USER35> semi-oftopic: ...nice to know about Haskell++, never heard of it before. Hopefully the lung cancer C++ joke doesn't apply :)</comment>


Pi is wrong... really. - <AUTHOR> http://scientopia.org/blogs/goodmath/2010/12/08/really-is-wrong/

<comment><USER2> Even worse is our definition of temperature... it should really be the reciprocal. The thermodynamic definition is:

1/T = dS/dE where S is entropy and E is energy

dS/dE has a nice intuitive ring to it "if I put a small amount of energy into the system, how will its entropy change", but since we declare that to be 1/T we allow crazy things like negative and infinite temperatures (these actually exist - and the negative temperatures are hotter than the positive ones).

<comment><USER3> On the other hand, most heat transfer relations are proportional to delta-T, so a T' = 1/T definition would make thing like

q = h (T_2-T_1)

become

q = h( 1/T'_2 - 1/T'_1 )

Perhaps unlike the case for pi, I think there's a good argument here for keeping temperature as-is.

</comment></comment><comment><USER4> A similar (primary-source) article was posted about 5 months ago, see <http://news.ycombinator.com/item?id=1449813>.

</comment><comment><USER5> pi = half, 2 pi = the whole...

what's more direct?

<comment><USER6> Did you read the article? So many fundamental equations become more elegant when pi is redefined in this way. Isn't pi/2 = half, pi=whole more direct?</comment></comment>


Spectre/Meltdown: An Azure retrospective [video] - <AUTHOR> https://twitter.com/h0x0d/status/1190448255479336960 <comment><AUTHOR> Video from Microsoft's Ignite Event about patching Azure to mitigate Spectre and Meltdown bugs

[https://techcommunity.microsoft.com/t5/Microsoft-Ignite- Cont...](https://techcommunity.microsoft.com/t5/Microsoft-Ignite- Content-2019/Spectre-Meltdown-An-Azure-retrospective/m-p/946375)

The registers description of the linked video:

>The session was unusual. The main part was a video describing the build-up to the Spectre and Meltdown reveal in January 2018. The specific problem was discovered by Google's Project Zero in June 2017, but was kept under embargo for six months. Microsoft was among those companies in the know, furiously patching Windows and its Azure platform, before the embargo on disclosure lifted on 10 January 2018. Open-source systems like Linux are patched in the open, though, and changes to the kernel, along with industry sources, tipped off The Register.

[https://www.theregister.co.uk/2019/12/12/spectre_meltdown_mi...](https://www.theregister.co.uk/2019/12/12/spectre_meltdown_microsoft_azure/)</comment>


An Interview with the Creator of Ruby (2001) - <AUTHOR> http://www.linuxdevcenter.com/pub/a/linux/2001/11/29/ruby.html <comment><USER2> I had to learn Ruby when I got a job as a full stack dev. Before then I mostly used Python and Java. To date I have not found a language that I love more than Ruby. It's a delight to use. I truely enjoy coding in Ruby, whereas I'm usually some flavor of neutral with most other languages (except PHP... blah). Perhaps there are some people that are on the same wavelength as Matz. One thing I found interesting is that when surveying whitespace of Github repos, 100% of Ruby repos surveyed had 2 spaces for indentation. Looking down that list, I wonder why some languages have more conformity of indentation style (other than frameworks helping enforce styles). Perhaps certain languages attract certain types of developers or help foster a particular culture?

[https://ukupat.github.io/tabs-or-spaces/](https://ukupat.github.io/tabs-or- spaces/)

<comment> forgot-my-pw Wish all languages comes with a fmt tool that will end all stylistic guide debates.

We use linters at work, but even setting linter rules will cause a lot of arguments.

<comment><USER3> Well, you don't need one for Python.

<comment><USER4> You do when your lines get too long. :)

</comment></comment></comment></comment><comment><USER5> 16 years ago, but just 6 years after the language was released, and 4 years before Rails came on the scene.

In retrospect, I'm not sure how successful Matz has been in upholding the principle of least surprise. In many ways, Ruby is one of the worst offenders.

<comment><USER6> Compared to what, though? I really like how everything is a method in Ruby as compared to, say, Python where it seems completely random if something is or isn't -- for example, I have to constantly remember that to get a length of an array in Python I have to do len(x) rather than x.len().

Although I like what Rust and Nim are doing with making the method/function distinction irrelevant -- there, x.f() is just syntactic sugar for f(x) -- so you can use whichever you prefer.

<comment><USER7> > _I have to constantly remember that to get a length of an array in Python I > have to do len(x) rather than x.len()_

On the other hand, in Python lists, tuples and arrays are fundamental data types and thus len() is defined as a fundamental built-in function. I think it makes sense.

What i didn't like was when map() and reduce() were moved away from the basic functions.

<comment><USER8> > On the other hand, in Python lists, tuples and arrays are fundamental data > types and thus len() is defined as a fundamental built-in function. I think > it makes sense.

But len() is only a fundamental built-in function for fundamental data types and you can implement it on any class by implementing the method __len__(self).

For those it doesn't make sense any longer to be able to do len(x).

<comment><USER7> I'm afraid you're right...

</comment></comment></comment></comment></comment><comment><USER7> I always get tempted to switch to Ruby * whenever i remember that Matz intended to make programmers happy. However, I don't think i'd feel comfortable with a language that only allows object-oriented programming, and moreover OOP of the old way (a method must be tied to only one object. This is what prevents me from going to Smalltalk, btw.)

Additionally, the MRI is perhaps the slowest implementation of a dynamic language out there (besides "R"). I know there are alternative implementations; is there any implementation that is significantly faster (at least as fast as Google V8 for ECMAScript) and that supports the full Ruby language without compatibility issues?

* in place of Python

<comment><USER9> _> However, I don't think i'd feel comfortable with a language that only allows object-oriented programming_

Ruby is multi-paradigm; in particular it's easily the most "functional"-feeling of the major scripting languages.

 _> and moreover OOP of the old way (a method must be tied to only one object. This is what prevents me from going to Smalltalk, btw.)_

I'm unsure what you mean by this. Ruby has one of the most flexible OOP systems in existence, a good deal more flexible than Python's, and lets you create more or less any conceivable relationship between methods and objects. (Which is why Ruby is slow).

 _> Additionally, the MRI is perhaps the slowest implementation of a dynamic language out there (besides "R"). I know there are alternative implementations; is there any implementation that is significantly faster (at least as fast as Google V8 for ECMAScript) and that supports the full Ruby language without compatibility issues?_

Ruby's not fast, but it's improved quite a bit from the 1.8 days. It's comparable to Python.

As for high-performance alternative implementations, there's TruffleRuby,[1] but it still has compatibility issues and isn't ready for production use. There's also Crystal,[2] which is a very similar (but incompatible) compiled language with performance on par with Go/Java/Swift. It's also still in beta but they plan to have a 1.0 release by the end of the year.

[1] [https://github.com/graalvm/truffleruby](https://github.com/graalvm/truffleruby)

[2] [https://crystal-lang.org](https://crystal-lang.org)

<comment><USER7> First of all, thank you very much for your informative reply on the implementations.

 _> I'm unsure what you mean by this._

I believe that any OOP system that wants to be flexible, modern, and powerful, should have most of the features that CLOS (Common Lisp Object System) has. Julia (language) did, for example.

It would be lengthy to explain all the features and benefits of CLOS here, but in CLOS, methods are not tied to objects, and all methods do multiple- dispatch. This also allows doing OOP in a functional-like way (this is easier to understand once you see how CLOS works.)

In comparison, most other OOP systems feel limited and restrictive, and _very_ different from CLOS.

 _> a good deal more flexible than Python's_

Probably, but OTOH Python's OOP system is perhaps one of the weakest OOP systems out there, and speaking from my 2 years of professional experience with Python. I find it acceptable, but not good.

<comment><USER10> There are plenty of lispers in the ruby world. "Ruby is an acceptable lisp" is a decently common saying.

While Ruby's OO is not a verbatim copy of CLOS, it is much more versatile than you've described above. The best way to think of it is it's delegation under the hood using a little syntax sugar to resemble classes. It's not multiple dispatch, but methods can be aggregated into modules that can be mixed into classes or objects arbitrarily. Dispatch is dynamic and structural (duck typing). All of this combined with ruby's meta programming features make for an expressive system. It's not restrictive, in fact it runs the risk of the opposite problem, which is people over use the flexibility and write overly magic code that proves difficult to maintain down the road.

<comment><USER7> _> "Ruby is an acceptable lisp" is a decently common saying._

I got excited the first time I read that phrase (i think it was Matz who said it?), but they are very very different languages; for example metaprogramming is a piece of cake in Lisp, while it is something reserved for advanced Ruby users, to put just one example. And for me, metaprogramming is extremely important.

In any case, I think i'll give Ruby a second look.

<comment><USER11> I wouldn't say that metaprogramming is for "advanced Ruby users" at all, FWIW. I find writing dynamic/"unfolding" Ruby code _much, much easier_ than wrangling Lisp macros.

It is worth your time.

</comment></comment></comment></comment></comment></comment><comment><USER12> Is there still some new features coming to Ruby? It seems the language is not this cutting edge technology it was once. I mean we see more changes in Java and PHP than Ruby these days.

<comment><USER13> What new features does Ruby need? Why does a language need to be "cutting edge technology"? What are the issues with Ruby that need changing? These aren't rhetorical questions, I don't know much about Ruby and am genuinely curious.

<comment><USER14> They're adding a kind of pipeline operator (actually a method) [http://mlomnicki.com/yield-self-in-ruby-25/](http://mlomnicki.com/yield-self- in-ruby-25/)

</comment></comment></comment><comment><USER15> > I'm planning a full rewrite of the interpreter for Ruby 2.0 [...] It will > use a bytecode engine.

And so it did! [https://en.wikipedia.org/wiki/YARV](https://en.wikipedia.org/wiki/YARV)</comment>


Ask HN: Developing a "4D" VR Experience. Best Tools for the Job? - <AUTHOR> My team is creating a "4D" VR experience. Basically, we are triggering a 360 video with a HTC Vive. I'll also be controlling external devices, namely a fan and a butt-kicker (for vibration). We'll also be showing the in-headset view on a projection in the space.
My best guess is that Unity would be the best tool for this job. But before I dive into a Unity crash course, I was wondering if this might be possible with WebVR, Three.js, maybe wrapped up as an Electron app?
Are there other tools I could use to create this that I'm just overlooking? <comment><USER2> Unreal would be technically more efficient, as it's backend is closer to the metal than Unity. Unity is good, don't get me wrong, in fact I wrestled with whether to respond, but nevertheless Unreal's rendering is just plain faster, and therefore will make for a more transparent experience for your final product. I am friggin tired, so excuse my non reference laden post, but if you put in 10 minutes worth of ref work, you'll see I'm right.

Best of luck!</comment>


Anker PowerPort PD 1 USB-C Wall Charger Teardown - <AUTHOR> http://www.chargerlab.com/archives/1565.html <comment><USER3> I was looking forward for Ken Shriiff-style charger reviews ([0], [1]) and was disappointed to find out this is just pictures, with almost no analysis.

FWIW, from the photos, it looks like the charger is not very bad from safety perspective -- there is a wide, healthy space between high and low side. (unless there is a diagonal trace in the "The back of the PCB" photo, between high and low voltage sides.. but it is so absurd if true, I think it is just a camera artifact)

[0] [http://www.righto.com/2012/03/inside-cheap-phone-charger- and...](http://www.righto.com/2012/03/inside-cheap-phone-charger-and-why- you.html) [1] [http://www.righto.com/2012/10/a-dozen-usb-chargers-in-lab- ap...](http://www.righto.com/2012/10/a-dozen-usb-chargers-in-lab-apple- is.html)

<comment><USER4> > I was looking forward for Ken Shirriff-style charger reviews

Ha ha, thanks! I agree with you that it looks okay from a safety perspective. It looks like they built the charger with reasonable quality, not cutting corners, but it's not at the Apple level of (over-)engineering. The one sketchy thing is the charger panel that just pops off (instead of being glued/welded), potentially exposing the user to high voltage.

One interesting thing is the amount of complexity that USB-C adds. The charger has a separate daughter board for the Cypress USB-C controller chip. This chip contains a 32-bit Arm Cortex-M0 CPU running at 48 MHz. I believe that works out to about 8 Cray 1 supercomputers using the Dhrystone benchmark.

The switching power supply is a quasi-resonant flyback topology. To oversimplify, the incoming AC is rectified to DC, chopped up into pulses that are fed through the flyback transformer. The output from the transformer is rectified, yielding the low-voltage, high-current DC output.

One somewhat advanced feature is that the output is not rectified by a diode, but by a MOSFET controlled by the controller chip. This is called _synchronous rectification_. This improves efficiency because you don't have the voltage drop you get across a diode.

The SMPS controller chip is interesting. Most switching power supplies have an optoisolator to provide feedback between the output and the control chip. But this control chip connects to both the input side and output side; it contains an inductive isolator internally. The control chip also contains the MOSFET that chops up the input voltage. So the big controller chip replaces multiple components in a typical charger.

The LED indicator is a bit puzzling. There's a TL431 voltage reference chip next to it. The TL431 is extremely common in chargers to provide the feedback for voltage regulation, but apparently it's being used here to drive the LED.

<comment><USER5> You're saying that our phone chargers have the equivalent of EIGHT of the fastest computers in the world in 1976? Wow.

<comment><USER6> A usb c controller is quite complicated. The protocol is not simple at all.

<comment><USER5> It's still mind-blowing that if you wanted a USB-C controller in 1976, you'd need $64 million dollars worth of computing power.

<comment><USER6> You would need more than that, since a significant cost is already built into the economies of scale of making non-leading-edge chips.

Exponential growth is a crazy thing.

</comment></comment></comment></comment></comment></comment><comment><USER7> The subject of this teardown is the 18w PowerPort charger, _not_ to be confused with the soon-to-ship (?) gallium nitride (GaN) 27w charger known as the PowerPort Atom PD-1[0].

I only know of two shipping GaN chargers at the moment: the 45w RAVPower (RP- PC104)[1], and the 45w Mu One[2]. I imagine we'll see an ton of GaN chargers this year.

[0]: [https://www.anker.com/deals/powerport_atom](https://www.anker.com/deals/powerport_atom)

[1]: [https://www.ravpower.com/p/ravpower-45w-type-c-pd-wall- charg...](https://www.ravpower.com/p/ravpower-45w-type-c-pd-wall-charger.html)

[2]: [https://www.themu.co.uk/collections/muone](https://www.themu.co.uk/collections/muone)

<comment><USER8> The Inergie 60C must be one as well, it's too small to be anything else. Also, the finsix dart is GaN but it's not USB C.

<comment><USER7> Thanks for the additions.

Didn't think of the Dart since it's been around for a while. That has to be one of (the?) first GaN chargers to market?

<comment><USER8> I am an idiot, the Dart is not GaN. [https://www.pntpower.com/5-reasons-why- avogy-and-finsix-put-...](https://www.pntpower.com/5-reasons-why-avogy-and- finsix-put-sic-in-their-chargers/)

</comment></comment></comment></comment><comment><USER9> Had never heard of "ultrasonic welding" [0]. Also had no idea the wide range of applications, even many shoes use this process for bonding the materials together [1].

[0] [https://en.wikipedia.org/wiki/Ultrasonic_welding](https://en.wikipedia.org/wiki/Ultrasonic_welding)

[1] [https://science.howstuffworks.com/ultrasonic- welding.htm/pri...](https://science.howstuffworks.com/ultrasonic- welding.htm/printable)

</comment><comment><USER10> Page is hanging trying to load a pair of jquery files

        http://dn-staticfile.qbox.me/jquery/1.11.1/jquery.min.js?ver=1.11.1
        http://dn-staticfile.qbox.me/jquery-migrate/1.2.1/jquery-migrate.min.js?ver=1.2.1

and doesn't seem to display images without them. The rest of the page did render eventually though.

If anyone else has this issue, right clicking the image and using "View Image" does work, I guess it's relying on jquery to display them on the page or something?

<comment><USER11> Images are hidden by default until a script shows them with an animation (fade) once they're loaded. The script is part of the Wordpress theme this site is using. Clearly it's old code considering it's relying on code only compatible with jQuery 1.2.1 which was released in 2007.

<comment><USER12> To be fair, that's jQuery Migrate 1.2, which was released in 2013. Not much better, but still... jQuery 1.11 (the version it's actually using) was released in 2014.

</comment></comment></comment><comment><USER13> If you want some entertaining tear-downs and analysis, BigCliveDotCom on Youtube is great viewing.

[https://www.youtube.com/user/bigclivedotcom/videos](https://www.youtube.com/user/bigclivedotcom/videos)

</comment><comment><USER14> I prefer these reviews: [https://lygte- info.dk/info/indexUSB%20UK.html](https://lygte- info.dk/info/indexUSB%20UK.html) (warning, large number of images)

</comment><comment><USER15> Apologies for being mildly off-topic, but is anyone aware of a USB-C PD charger with more than a single USB-C PD port? Doesn't necessarily have to be wall-wart style.

<comment><USER16> [https://www.amazon.com/gp/aw/d/B07JVL8C3H](https://www.amazon.com/gp/aw/d/B07JVL8C3H)

Anker PA-Y16

It's cheaper to buy two single port ones though :(

<comment><USER17> That may charge 2 smart phones just fine, but it isn't enough for a laptop like a Macbook 13 or Dell XPS 13.

I'm sure we'll see ones that can handle enough output for a computer + phone in the near future!

<comment><USER18> Count me in... I would love a full spec USB-C charger with 100+ watt total output across, say, four or five USB-C ports. Maybe add an A or two for good measure, perhaps with QC.

I do carry an Anker with one USB-C and four A for travel with my (USB-C) laptop(s).

While I am wishing... A USB-C hub (bus powered or from a PD input) with full speed USB-C ports, maybe 4-6, and an A or two for good measure.

<comment><USER19> Maybe someone who knows electronics better than me can chime in with corrections and/or correct terminology, but my impression is that USB PD doesn't lend itself to having a bunch of type-C ports that draw from a shared max power rating in the way that's common with USB BC devices. e.g. if you have a 100W brick, you're going to have five ports with 20W max, or one 60W port and four 10W ports, etc. (that is, each port is essentially an independent charger sharing a housing, and with the heat limitations of the shared housing)

<comment><USER20> The USB-C PD definitely allows you to do exactly what you suggest.

I know this is supported in this google dual-port PD charger: [https://store.google.com/gb/product/usb_c_dual_port_charger](https://store.google.com/gb/product/usb_c_dual_port_charger)

There is an explanation on how the power budget is split in this post: [https://plus.google.com/+BensonLeung/posts/8jmUYtJxAwX](https://plus.google.com/+BensonLeung/posts/8jmUYtJxAwX)

Presumably other multi-port chargers also do similair things

</comment></comment></comment></comment></comment></comment><comment><USER21> Surprising that this doesn't use a higher frequency to reduce the iron core size and make the device smaller and lighter.

Perhaps the product designers said 'it's gotta weigh at least 5 oz' and the engineers thought they'd use old-fashioned huge low frequency 20kHz flyback transformers rather than put a steel weight in.

<comment><USER3> Controller datasheet shows the frequency of 30 KHz to 100 KHz, depending on the load.

Sure, it is not 1MHz, but I think high voltage, high frequency MOSFETs might be too expensive for just 18W design.

</comment></comment><comment><USER21> I would expect a brand-name device claiming to support USB-C PD to support the 15 and 20v modes too, so it can at least charge a laptop.

All the components I checked are already capable of it, so I guess some tests failed and they rushed it to market without 15 and 20v support?

<comment><USER22> Do you need to use the 15V or 20V modes to supply 18W to a laptop or can the laptop just use the 2A@9V?

I can plug my Macbook into a 5V only USB phone charger and it says it's charging (ok, it doesn't really keep up with the power usage, so the battery still drains, but it drains slower than it would if not plugged into anything at all)

<comment><USER21> Lots of laptops require 20v because they are re-using circuitry from the days of 19.5 volt proprietary charging bricks.

Also, having both step-up and step down convertors in your laptop is going to make everything a bit heavier, bulkier, and costlier, for the very tiny proportion of users who want to charge from a 5v phone charger overnight.

<comment><USER23> Since the USB-C port often supports bidirectional power, it may not actually make it that much larger, if at all, as the battery charger IC can often operate in "reverse buck" mode to turn the battery voltage into 5V, which when using synchronous rectification (almost mandatory for efficiency now) means it has all the parts for forward boost, and just needs a slightly cleverer control IC. This is like how many modern power banks can use the same inductor for buck (5V->3.7V) charging and boost (3.7->5V) discharging.

Check this app note from Intersil/Renesas: [https://www.renesas.com/eu/en/doc/whitepapers/power/usb-c- bu...](https://www.renesas.com/eu/en/doc/whitepapers/power/usb-c-buck-boost- battery-charging.pdf)

(of course, it may be slightly less efficient in boost charging, but since the 5V usb source has limited power, this may not be a concern in terms of component thermal limits etc).

<comment><USER24> So this reuse is why almost no power banks support simultaneous charge and discharge, I am guessing.

It is super annoying that I can't use any of my power banks as laptop-like batteries for Raspberry Pis, Arduinos, and the like.

<comment><USER25> Take a look at OmniCharge, e.g.:

[https://www.omnicharge.co/products/omni-20-usb-c/](https://www.omnicharge.co/products/omni-20-usb-c/)

</comment></comment></comment></comment></comment></comment><comment><USER26> I use this one for 30eur to power my dell xps when watching movies and charge 2-3 phones over night: [http://budgetlightforum.com/node/62740](http://budgetlightforum.com/node/62740)

it's cheap super portable considering it charges all my devices at once and if you don't need to charge fast on all ports at once it's totally fine.

edit: amazon reviews look like you have to get lucky to get one that doesn't blow up... mine works absolutely fine since 6 month though.

<comment><USER24> Charging more slowly increases the longevity of your lithium-type batteries anyway.

</comment></comment><comment><USER27> I really wish Anker would ship a charger that can power a MBP 15" 2018\. I use Anker for everything charging/battery/cable related except my third party MBP chargers (because they don't make one) and 90 degree cables (again, because they don't make them. If not my boyfriend would slowly destroy every cable I have by resting his phone on his chest while charging...)

</comment><comment><USER28> Is USB-IF certification any guarantee of quality?

</comment><comment><USER29> Anyone willing to compare and contrast with the iPad Pro's diminutive USB-C charger?

<comment><USER30> there's a teardown of the Apple 2018 iPad Pro charger (18w) on the same site for comparison. Sadly, there's not much analysis except to say that the Apple charger is very well built and compact.

<comment><USER31> Links:

Apple 18W charger (iPad Pro): [http://www.chargerlab.com/archives/939.html](http://www.chargerlab.com/archives/939.html)

Apple 61W charger (Macbook Pro): [http://www.chargerlab.com/archives/1217.html](http://www.chargerlab.com/archives/1217.html)

Apple 87W charger (Macbook Pro): [http://www.chargerlab.com/archives/1292.html](http://www.chargerlab.com/archives/1292.html)

</comment></comment></comment><comment><USER32> Is this link working for folks? It wouldn't load for me :(

</comment><comment><USER33> At first I thought this was about the PowerPort PD Atom 1, which isn't yet released, but it's about the PowerPort PD 1, which came out sometime last year.

</comment><comment><USER34> 0

</comment><comment><USER35> Not sure I could call this "well made" which is a disappointment for me with regards to Anker. The HV and LV sides don't appear to be well, or even at all isolated.

I suppose the big yellow-wrapped thing is the voltage transformation stage, but the connector should feed directly into it. Looks like it is actually be a transformer rather than a switching supply, which I suppose could cut costs.

<comment><USER36> > Not sure I could call this "well made" which is a disappointment for me with > regards to Anker.

Does Anker have a good reputation? I bought an Anker cigarette lighter - <USER2> charger a couple years ago. One of the reviewers pointed out it fit poorly, took it apart, and made suggestions to Anker on how to improve the product (and got feedback from Anker). I figured it was safe to assume the improvements made it into the product. Turns out that a year later no improvement had been made and the damn thing would disconnect every time I hit a bump or looked at it funny.

From my POV Anker is 7-11 quality stuff.

Edit: I'm loving the downvotes from the brand loyalists who've nothing to contribute.

<comment><USER37> There are two different sizes of cigarette lighter sockets, maybe that's why it fit badly?

<comment><USER38> Specifically:

* Size A: inside diameter ~21.0mm (mainly American cars)

* Size B: inside diameter ~21.5mm (mainly European cars)

[https://en.wikipedia.org/wiki/Cigarette_lighter_receptacle](https://en.wikipedia.org/wiki/Cigarette_lighter_receptacle)</comment></comment></comment></comment>


At Snopes, a Quest to Debunk Misinformation Online  - <AUTHOR> http://www.nytimes.com/2010/04/05/technology/05snopes.html <comment><USER2> Great to see some figures on snopes. 7-8 million uniques per month, $3000 bandwidth bill, 2 staff.

With those sorts of numbers I'm sure they could optimise and monetize the site better than that. I bet if they had a paid email list ($5-10/yr)where you got the debunks/explanations 24-48 hours ahead of anyone else you'd get quite a few conversiosns. Maybe even enough revenue to change the horrid site design and clunky search.

Great site though.

<comment><USER3> It's the two founders, plus two additional employees, so I think it would be more correct to say that their number of staff total is four.

</comment></comment><comment><USER4> It's a good project. I find the way Snopes disables highlighting and copying very irritating though. I always have to disable javascript when I'm there.

<comment><USER5> I agree. The value of Snopes is debunking mass emails. What I want to do is email a short citation, but it's a royal pain-in-the-ass and, as is always the case, it doesn't really stop sites that want to scrape Snopes content.

<comment><USER6> Yeah but their content probably gets more links. Clearly it is one component of an incidentally winning strategy.

<comment><USER7> The fact that they are net-successful doesn't mean that every aspect of their approach is a good idea.</comment></comment></comment></comment>


Apple says Web designers can post "any font" for use with Safari. - <AUTHOR> http://typophile.com/node/43971 <comment><USER2> Font designers are a funny breed. They are upset that Apple said designers can "use any font they want" with Safari 3.1 without including a statement adding "unless you licensed it from someone who forbids you to use it for this purpose".

I would like to join the rest of humanity in welcoming typographers into the world of text, images, audio, and video where a browser can transfer any work to a client.

If you want to forbid your licensees from using your fonts on web pages, then educate your licensees.

Perhaps this should be viewed as a profit center. Soon google will return you lists of potential copyright violators. You can go sue them.

</comment><comment><USER3> Kern. Hint. Burn.</comment>


Amazon should open physical stores - <AUTHOR> http://cejest.com/2011/11/22/amazon-should-open-physical-stores/ <comment><USER2> _There is a real trend towards having stores dedicated to individual companies, Apple found great success when they went out on a limb and created their own stores, and a big part of it is the experience they've offered. Great customer support, a visually attractive store and great products._

I don't know if that success would be the same for Amazon. Apple sells more expensive products, so it makes sense to pay for retail space and have salespeople walking around. If they pay someone $15/hr to sell you a $600 iPad or $2200 MacBook, that's a win. If Amazon pays someone $15/hr to sell you a $10 eBook, that's a loss, unless he sells 60 books in the time it takes to sell one iPad.</comment>


Ask HN: Political activism platform - <AUTHOR> After recently coming across news that representatives in my state have introduced problematic and comparatively faulty legislation in the upcoming session, I've been moved to start a bit of a grassroots effort locally to combat the passage of those bills.
I've seen quite a few sites that allow people to enter their zip code and find their representative, does anyone know how I can find, or has anyone written and open-sourced this kind of lookup implementation?
Failing that, are there any platforms that this community would recommend that would allow a simple landing page with copy text, facts and info with linked sources, and then a web form to find their representative? Perhaps even a WordPress plugin that I should look at and build on top of?
Ultimately I'm trying to avoid people leaving the page to perform the lookup since I can't guarantee that the receiving site will either handle incoming load, remain online, or even have the most up to date rep info.  If someone's leaving the page, I'm hoping it's primarily to read linked sources from the "facts and info" section.
Thanks! <comment><USER2> Are you looking up representatives on the federal or state level? Fair warning, if you're looking up state reps, a zip code lookup could return multiple (sometimes 10+) representatives per zip.

Source: In my day job, I've built many one-off issue advocacy pages on both the state and federal levels. Feel free to ping me if you want to talk about it.

<comment><AUTHOR> State level. I'll email you my ideas, thanks!

</comment></comment><comment><USER3> [https://www.usa.gov/elected-officials](https://www.usa.gov/elected-officials)

[https://www.usa.gov/developer](https://www.usa.gov/developer)

[http://whoismyrepresentative.com/api](http://whoismyrepresentative.com/api)

There are wordpress plugins:

[https://www.google.com/search?q=wordpress+plugin+find+my+rep...](https://www.google.com/search?q=wordpress+plugin+find+my+representative&oq=wordpress+plugin+find+my+repres&aqs=chrome.1.69i57j33.17133j0j4&client=tablet- android-digiland&sourceid=chrome-mobile&ie=UTF-8)

This map can be embedded on your website:

[https://www.govtrack.us/congress/members/map](https://www.govtrack.us/congress/members/map)

<comment><AUTHOR> All great resources, thank you!

</comment></comment><comment><USER4> Congressional info API including ability to "Look up members of Congress by location or by zip code."

[https://sunlightlabs.github.io/congress/](https://sunlightlabs.github.io/congress/)

Open States API for info on state legislators:

[https://openstates.org/](https://openstates.org/)

City council info for Chicago, Philly and NYC:

[https://www.councilmatic.org/](https://www.councilmatic.org/)

</comment><comment><USER5> well done! Programmers should be more involved in politics, and not on government's side, but on people's side. There are many examples what to do about it: transparent voting, list and rank all public sector employees, etc

</comment><comment><USER6> [https://democracy.io](https://democracy.io)

<comment><AUTHOR> This looks like exactly what I'd need, I'll email about their email API.

</comment></comment><comment><USER7> Out of interest? What state?

<comment><USER8> His bio says he's in Austin, which is in (or at least surrounded by) Texas.

<comment><AUTHOR> _(or at least surrounded by)_

Ha, yeah that's one way to put it</comment></comment></comment>


Ask HN: Evaluate this behavior by potential cofounder - <AUTHOR> We've been talking for about 1.5 years, known each other for about 4 years ... talking off and on throughout those 4 years.
Throughout the past 1.5 we've been talking about different ideas, interest levels in different areas, and most importantly understanding if an idea resonates with us.
We found an idea about 4 months ago that resonated with us both, and have been actively talking to companies (customer discovery), but since about 3 weeks ago I haven't heard a word from him. We had been actively doing customer discovery for about 3 months talking to people prior to the absence of talking.
Anyone experience something similar? <comment><USER2> Have you tried a direct question? Something along the lines of "Hi! Haven't heard from you in a while. Is everything okay?"

<comment><AUTHOR> I think this is sound advice, thanks.</comment></comment>


Apple Turns on iPhone Tracking in iOS6 - <AUTHOR> http://www.schneier.com/blog/archives/2012/10/apple_turns_on.html <comment><USER2> As somebody who actually has first hand knowledge of this issue (I wrote and designed the tracking for a major iOS ad network), I can say that this is an incredibly misleading article.

Here's what's _actually_ going on:

\- Apple has deprecated the UDID. We're still allowed to use it for a while, but in the long term it's going away.

\- Apple has created a new identifier (the IFA), specifically for the use case of advertising. This identifier uniquely identifies a device across apps, but beyond that provides no information about the device or its user.

\- This ID comes with strings. There's an option in Preferences to "Limit Ad Tracking." The terms and conditions specify that when this option is enabled, we still get access to the ID, but we are only allowed to use it for some specific purposes like conversion tracking (eg. making cost-per-action campaigns possible), and fraud detection (eg. preventing fake clicks). We are not allowed to use it to create profiles, or to improve our ad targeting algorithm. We are absolutely not allowed to divulge the information to third parties.

Without this, advertising wouldn't be possible. Some may think that that'd be for the best (myself included), but that's an entirely different argument, and you'd have to realize that the market would be very different (No free/freemium apps, and everything would be more expensive). You can't have your cake and eat it too.

I expected better from Schneier.

<comment><USER3> Thanks for giving us the information on "what's actually going on". But that makes it seem worse, even when you apparently can't see it from working in the field.

Apple continues to give apps access to the UDID; the recent leaks were apparently not as stark a reminder as some people thought.

The "Limit Ad Tracking" option seems wholly useless; another "X-Do-Not-Track". In this case, the user even expresses the wish to _not be tracked_ , and Apple just continues to provide the data while telling the apps you checked a meaningless box. Apple is in no position to control what app developers do with the data after the fact; the only possible way here is to not disclose that data at all.

(Also, Google does just fine without a globally unique "advertising number". It can do so because people get actual value for the advertisements, and the advertisements are targeted. Apple is just providing this trove of data on the cheap to every hinterland app developer. Thats a huge mistake.)

<comment><USER4> If Apple wouldn't provide an ID then developers would code their own device identifiers. This here is crossplatform for iOS and Android:

<https://github.com/ylechelle/OpenUDID/blob/master/README.md>

Or just read the MAC address: [http://stackoverflow.com/questions/677530/how- can-i-programm...](http://stackoverflow.com/questions/677530/how-can-i- programmatically-get-the-mac-address-of-an-iphone)

> Google does just fine without a globally unique "advertising number". It can > do so because people get actual value for the advertisements, and the > advertisements are targeted.

I don't understand, can you elaborate? How can advertisements be targeted without tracking?

<comment><USER5> > I don't understand, can you elaborate? How can advertisements be targeted > without tracking?

Keywords is how Google does it. Try using Google in Incognito mode (or whatever your browser of choice calls it) and note the relevant ads. Obviously this does not work as well in all apps, but to say you can't do targeted advertising without tracking is not true.

</comment></comment></comment></comment><comment><USER6> From the bottom of the article:

> EDITED TO ADD (10/15): Apple has provided a way to opt out of the targeted > ads and also to disable the location information being sent.

Ok, why is that "edited to add"? Seriously. The page he links to on apple.com says it was last modified more than a month prior. Why did Schneier post his article, get some hits, and only then add this little tidbit which basically turns the whole thing into a non-story? Couldn't he have researched it all up front before posting the story? The page on apple.com is the _very first hit_ for "iAd opt out" on Google. It's just beyond lazy to have posted this story without having done that search first.

I realize Schneier is a bit of a sacred cow in most tech circles, but this seriously just smacks of sensationalism:

"OMG Company X does something horrible!"

* wait for pageviews to roll in *

"EDIT: Eh, not really. Shoulda Googled first."

Come on. Really.

<comment><USER7> Schneier does this often enough that I kind of expect it. He's not a journalist- that's not an excuse for him to lack research before writing, but it does mean I take a different quantity/flavor of salt with his writings.

When it comes to general advice, he's spot on. When it comes to commenting on actual implementations, he does miss details. Hell, it's not like he's Chuck Norris.

</comment></comment><comment><USER8> Just to be clear, Apple used to allow the use of the UDID for tacking which was directly tied to your device and non-deletable.

They now use an anonymous, temporary, random ID that can be turned off.

How is this not an improvement?

<comment><USER9> Wasn't there a period of time where UDID tracking was banned and the IFA had not yet been introduced? Some people were probably hoping that situation was permanent.

<comment><USER10> The UDID was deprecated, but not actually banned, I believe. So, part of the transition process to using the IFA.

</comment></comment></comment><comment><USER11> From high horse: Well one more reason Android is better than iOS.

Coming down from high horse: Oh crap, my phone's software is programmed by an advertising company...

Conclusion: My life is being bought and sold out of my control.

<comment><USER12> While you are on your high horse: go to Settings | Location access and note the description below Wi-Fi & mobile network location item. Also note the checkbox on the right.

I remember that the system asked about it first time it needed location (and every time you turn this option on). The downside is that Google Now does not work without it.

</comment></comment><comment><USER4> 4 weeks ago:

> "Apple adds new "Limit Ad Tracking" feature to iOS 6"

<http://news.ycombinator.com/item?id=4545602>

3 weeks ago:

> "Google implements Apple's Ad Identifier for mobile tracking choice"

<http://news.ycombinator.com/item?id=4581781>

Both hacker news submissions have zero comments. Why is it that a month ago no one cared, but now everyone is grabbing his tin-foil hat?

Also I am pretty sure at least some of the more extensive iOS 6 reviews have mentioned the new "limit Ad tracking" feature. And aren't we presumed to be developers who uses this stuff? I did know that Apple had a replacement for the UDID.

PS: On Schneiers blog one commentator claims that he/she was notified of the Ad tracking by a prompt in the iOS update. Sadly I have no updateable iOS 5 device here to examine that. But I think this was only an info for the new privacy pane, wasn't it?

<comment><USER4> Addendum:

It is explained (from the developers point of view) in the WWDC 2012 session "Privacy Support in iOS and OS X".

<https://developer.apple.com/videos/wwdc/2012/?id=710>

The old UDID is splitted into three new API:

1\. Application ID, which scope is the app and lifetime is till uninstallation of this app.

2\. Vendor ID: scope is developer and lifetime is till uninstallation of all developer's apps.

3\. Advertising ID (identifierForAdvertising or IFA): scope is the device and a new ID is created by "Erase all contents/settings" and it is not restored across devices (practically lifetime is lifetime of the device). This means when you start to use a new iPad it will have its own Advertising ID and not use that of your old iPhone, because the ID is not tied to your Apple ID account, but tied to a device.

It is noteworthy that after Apple banned the usage of the UDID some developers and ad networks started bypassing Apples privacy rules and made their own open source ID replacement:

<https://github.com/ylechelle/OpenUDID/blob/master/README.md>

But I don't know if this will be permitted in the future or you have to use Apples provided ID system (I would assume the latter).

<comment><USER13> Thanks for this succinct info.

</comment></comment></comment><comment><USER14> You can turn it off by visiting <http://oo.apple.com> on your phone.

<comment><USER15> That only turn off tracking for iAd, which is one of hundreds of ad networks.

</comment></comment><comment><USER16> FWIW, The learn more link in Settings-> General -> About -> Advertising says "iOS 6 introduces the Advertising Identifier, a non-permanent, non-personal, device identifier, that apps will use to give you more control over advertisers' ability to use tracking methods. If you choose to limit ad tracking, apps are not permitted to use the Advertising Identifier to serve you targeted ads. In the future all apps will be required to use the Advertising Identifier. However, until then you may still receive targeted ads."

<comment><USER17> Should have been under the "Privacy" setting -- if they really cared.

<comment><USER16> I think the location information and other stuff applies to everything app can do, which is in Privacy tab. I think this option is disable the identifier itself.

</comment></comment></comment><comment><USER18> "For the last few months, iPhone users have enjoyed an unusual environment..."

Am I the only one who finds that humourous? An "unusual" environment? What exactly is "normal" about tracking people's movements in the name of convincing advertisers to pay you?

This briefly enjoyed environment should not be unusual. It is the one we've lived in for hundreds of years. It should be the norm. iAd should be _opt-in_ not opt-out. There are no valid arguments to the contrary that are not motivated out of just a tad bit too much greed, the unhealthy kind.

(Why do I say the greed is excessive and unhealthy? Because Apple has already sold a highly marked up device composed of cheap electronics and booked that revenue. But this is apparently not enough. The casualty of this greed is the consumer's basic notions of privacy. That price is arguably far too high for anyone to pay to any company in return for "helpful suggestions" of products and services they _might_ want, based on seller guesswork. Apple made a fortune selling iPods. They didn't need to track users' listening preferences to do it. There are limits to what is reasonable.)

</comment><comment><USER19> It's always a quandary--I will most likely be seeing ads, so would I rather that they are targeted to me and possibly even helpful, or do I want to tighten down as much as possible all possible data dumps of me?

I'm still trying to figure out when I want to turn off these sorts of things, versus when I'd rather keep them on.

<comment><USER20> Actually, even if I end up with ads when I wasn't at least sort-of looking for them (say, opening Yellow Books, doing a search), then I'd rather if they're not targeted — the less information they have the worse they are at hacking my brain.

</comment></comment><comment><USER21> _For the last few months, iPhone users have enjoyed an unusual environment in which advertisers have been largely unable to track and target them in any meaningful way._

This is completely false. It hasn't changed at all in any meaningful way.

</comment><comment><USER22> Advertisers do not need to rely on the UDID(which is still widely used) to track you since all that matters is they have a unique key they can associate with the hardware. The MAC address does the same thing and there are a handful of other options that are close enough for what they care about.

</comment><comment><USER23> Apple actually messed up the IDFA for users that update from iOS 5 to 6 (over wifi). All these users are assigned an IDFA number of 0000000. Users that are on the new iPhone 5 or updated from iOS 5 to 6 via a network connection have a valid IDFA number.

</comment><comment><USER24> Are you kidding me? Regardless of privacy, this is incredibly useful. I would love having even the slightest amount relevance with the iAds popping up on my iAds.

</comment><comment><USER25> From Apple's press release [http://www.apple.com/pr/library/2011/04/27Apple-Q- A-on-Locat...](http://www.apple.com/pr/library/2011/04/27Apple-Q-A-on- Location-Data.html)

        1. Why is Apple tracking the location of my iPhone?
        Apple is not tracking the location of your iPhone.
        Apple has never done so and has no plans to ever do so.

<comment><USER9> Scheier's not talking about location.

</comment></comment><comment><USER16> update to the linked article... "EDITED TO ADD (10/15): Apple has provided a way to opt out of the targeted ads and also to disable the location information being sent."

</comment><comment><USER26> Another case of how Apple doesn't care about its customers. They offer the opt-out option but turn the service on by default and don't notify anyone.

Good thing (for Apple) most of their customers have had too much koolaid to care.

<comment><USER27> What a ridiculous comment. Take your trolling comments somewhere else. Nearly every company is guilty of reusing collected data and almost always without telling customers.

<comment><USER28> It's not a ridiculous comment. Do you work at Apple? What's wrong with him expressing his opinion. I feel the same way and belive we can have a discussion about what's right and what's wrong. I agree that most companies just automatically subscribe you in when they create new feature and they make it users responsibility to opt out but I hate it as much as most of us. At least they (including Apple) should be responsible of informing users if they decide to keep us opted in automatically. Tracking is not a joke, people are very concerned about it.

<comment><USER29> It is counterfactual to say that Apple does not care about its customers. It does way too much for them to make that statement anything but ridiculous.

That said, it's also possible to recognize cases where their behavior _might_ not be in the customers' best interests. Whether you think this is one of those cases probably depends on how much harm you think tracking does to the average consumer. Personally, I'm completely satisfied with their opt-out approach. People who care can opt out. The vast majority of people who don't* can receive more relevant advertisement. But I can accept that other people have different value functions where this approach would be considered less benign.

*And before someone quotes a survey where people claim to care, my personal view is that actions speak louder than words on this point. If you really care, you'd be taking steps to make yourself aware of what is happening on your phone and responding accordingly.</comment></comment></comment></comment>


Hello Downloader - <AUTHOR> http://www.alphabasic.com/Please_read.html

<comment><USER2> Honestly, I don't think the 'donate' model is a viable one. Sure you can make _some_ money off of it, but that cannot be the norm. I think. Maybe (hopefully) I'm wrong.

Now don't get me wrong, I think that _selling_ music in the internet age is a fundamentally broken model, so much more than the _donate_ one. At a time where distributing media is as simple as one click, trying to make money off of distribution is just wrong. Take into account how widespread internet access is today, and do the most basic ecnomical analysis, take "Porter five force" for instance and you'll quickly realize how non-viable this model is. Labels who act as middle men between the artist and their audience might have been needed 20 years ago, but today, what are their added values?

Now, if I do not believe that selling music is profitable, that doesn't mean that musicians cannot make money. Here's a simple business model for you: Make money off concerts and use your records as promotion units. Give your music away for free, hope for success, give a concert, make money.

Labels want to scare you into thinking that their distribution model is the only guarantee that music/art will survive. Let's not forget that musicians existed and made money long, very long before technology allowed businessmen in suits to make money off of them.

<comment><USER3> I find it really bizarre that in a forum which generally celebrates the ability to sell and profit from unlimited copies (c.f all the app store success stories), we have decided that such technology should not be available to others. If musicians want to make money, they're gonna have to do it sweating under the lights. Why is that?

Would people here be as enthusiastic if the only way to get paid for writing an app was to sit down and type it out in front of each customer?

<comment><USER4> They can sell Mp3s but not for 99 cents a song... especially when Angry Birds costs $1.99. An entire album should be 99 cents or less. 25 cents sounds good to me.

EDIT: my point is don't complain that people aren't buying your product if you're charging them a price that's waaay above market value

<comment><USER5> >>>They can sell Mp3s but not for 99 cents a song... especially when Angry Birds costs $1.99.

Now wait a minute there. What about an eBook? What about a movie or TV episode?

If Angry Birds for $1.99 is the price standard for everything, you're setting up a trap that most everything is going to fall into.

I've tried Angry Birds on demo tablets in stores -- and countless YouTube videos demoing tablets -- and I don't see the appeal. Even free, I wouldn't want it. Most games simply don't appeal to me. I'd rather read or listen to music or watch video.

Angry Birds might be worth $1.99 to you, but to me it has negative value.

<comment><USER4> Angry Birds made over a hundred million _in profits_ so far, I'm saying maybe the music business should examine it's pricing structure. Don't get me started on Ebooks or TV shows.

<comment><USER5> >>>Angry Birds made over a hundred million in profits so far

And added what to human productivity and betterment? Never use money as a measure for anything except money.

</comment></comment></comment></comment></comment></comment><comment><USER6> This is why I love bandcamp (for example <http://ohdaughter.bandcamp.com/>).

The first couple of downloads (I don't know how many, maybe the first 100) of a track/album are usually free, and after that you pay for the music. So when you suddenly go all Lady Gaga as an Indie artist you get at least something out of it, but when nobody knows you the can have a free listen.

If the free downloads are out, you have to buy the music. Some artists have a steady price like 8-10$ per album or 3-4$ for an EP (which I find _very_ reasonable and am totally willing to pay if it goes directly to the artist, and it mostly does!) and some let you choose the amount you want to pay for the music. And if that wasn't enough, if you have paid for the download, you get the audio files in almost every possible format existing.

Ah, bandcamp. Music distributing done right.

/edit:

Some more info: <http://en.wikipedia.org/wiki/Bandcamp>

\- Pricing model: _Set by artists_

\- Available audio formats are MP3, FLAC, AAA (aka .m4a), Vorbis and Apple Lossless and even more

\- About 4 million songs online, including music from Sufjan Stevens, Amanda Palmer (Dresden Dolls) and Coer de Pirate, and game soundtracks from Minecraft, Machinarium and Plants vs Zombies

And last but not least: <http://bandcamp.com/faq> (yes, they do cover _all_ questions who could possible arise)

(And no, I don't work for them. I just love them, as do many others: <http://bandcamp.com/testimonials>)

<comment><USER7> As an artist, Bandcamp is _fantastic_.

When someone buys an album, the money goes to our Paypal account immediately. Not only is the sales stats updated in real time, you can even play Defender on the graphs. Other digital retailers like iTunes take months just to get a sales report, let alone get paid.

I'd say 90% of our digital revenue comes from Bandcamp, which is surprising.

</comment></comment><comment><USER8> I once tried to buy a digital album from a local band, without using iTunes (just don't like it).

After searching around (which, to Benn's point, probably took longer than illegally downloading) I found it listed on Amazon. After I downloaded their ridiculous download software (just give me a zip?), I got right up to paying, when I was told that they were not licensed to sell to countries outside the US. Great. I can't buy my country's own product on Amazon. Nice one music industry.

At that point I gave up.

</comment><comment><USER9> This is exactly the way I want to buy media and other "soft" goods. I wish it was widely adopted already.

I want to know what I'm buying and iTunes previews, shareware trials, demo versions, movie trailers or what have you aren't nearly good enough to decide if I like something or not. Or someone just drags an MP3 on my Skype icon: "Hey, did you hear this song? It's really good!" -- "Wow, yes it is." (I'm a naughty pirate now, but if it weren't for piracy I'd never have listened to that song).

So when I do find something I really like, be that music, software or a TV show, I often _want_ to give the creators some cash. And it's incredibly frustrating to do that. Maybe the band is on iTunes, but that album with the nice song isn't (and as they pointed out, you'd end up giving cash to people who contributed nothing to the process of creating the stuff you like). Or the movie isn't available as digital download and you're supposed to buy a little plastic box with a disc in it that you have to dust off regularly and modern computers don't even have a slot for anymore. Plus, you already have the damn thing anyways, so all you really want to do is throw some money at people to show that you appreciate their work and want them to be able to pay the rent so they can keep making cool stuff. So why not make it as easy as possible to give you money?

Speaking of easy, my only problem with the above page is that I have a beef with PayPal and would greatly prefer them not profiting from anything I do (well, actually I would prefer for gaping holes to simultaneously open underneath their offices and suck them down straight to an equivalent number of burning, spiked pits in hell, but that's another story). So maybe provide some options here. Other than that, best of luck, and please let us know how it works out.

<comment><USER10> Out of curiosity, have you used/tried flattr?

<comment><USER9> I like the idea of Flattr, but I think it lacked the ability to donate a specific amount to a specific person/thing. So it seems to be more of a cash- backed "Like" button, which is nice too, but different from "I feel this Software is worth £40".

</comment></comment></comment><comment><USER11> This reminds me of the game Darwinia by Introversion.

This happened years ago. After hearing about it and trying the demo, I downloaded what I thought was the full copy over a P2P network.

The downloaded game behaved like the full copy and contained the first 2 levels as far as I remember. After that came a sequence spoken by the scientist that went a bit like "Let's be honest. You and I know that this isn't a legal copy and I don't blame you." and went on about how supporting the developers was important. After that no further levels could be played.

Introversion seems to have leaked this version on P2P networks themselves. I bought the full copy a short while later.

It's strange that I have yet to find any online sources or Youtube videos about this on the web. I guess no one wants to admit having pirated Darwinia.

<comment><AUTHOR> I had no need to pirate Darwinia when I got it for 5$ in the Humble Introversion Bundle, along with 6 other games. (Could have gotten it for 1 cent).

<comment><USER11> My story was in 2005. 6 years before the humble bundle.

<comment><AUTHOR> Ah, didn't know it was such an old game. Well in any event, thanks for sharing. While plenty of people will admit to downloading music and videos, not so many outside of the UG community admit to games. Maybe as developers, we're more wary of resentment from our colleagues which are more likely to feel harmed by our actions.

<comment><USER12> > thanks for sharing

Such a poor choice of words.

</comment></comment></comment></comment></comment><comment><USER13> Very nice. This may be weird, but I totally enjoyed reading this.

However, I'm actually surprised they didn't mention their Bandcamp presence[1], where I bought something a few month ago and was very pleased with the experience. But then again, I don't know from when the "Hello Downloader" document is.

[1]: <http://alphabasic.bandcamp.com/>

<comment><USER14> It's worth noting that this album, (and thus, the page we're talking about) was released in 2008.

<comment><USER15> And it appears that the legal dispute with Apple that the page refers to was also settled in some way in early 2008 (The details are unclear; all the verbiage the author has produced about his dispute with various entities in the music industry appears maddeningly incoherent and vague to me).

</comment></comment></comment><comment><USER16> Can somebody explain how a donate button like the one on this page complies with the PayPal TOS?

I looked into adding one to a site, but the PayPal terms seem to make it pretty clear they're for non-profits or giving money for a specific cause. If you get >$10k in "donations" they can/will even hold your money and require "proof" it's going to the cause you tell people it's going to.

I've seen the buttons on a number of sites, and they rarely seem to match up with the PayPal TOS for donations. Does PayPal not enforce that requirement?

In my case, I've decided to go with a small, one time signup fee, but I'm still curious.

</comment><comment><USER17> The album mentioned in the post "Soundtrack To A Vacant Life" came out a couple of years ago. So this post might be old.

Also, that's an excellent electronic/idm album to work to.

<comment><USER18> Yeah, this text file was included with torrents that Benn Jordan (the guy behind The Flashbulb and the founder of Alpha Basic Records) "leaked" himself to trackers when the album was first released. I'm surprised to see it get so much attention years later.

<comment><USER19> That explains the complaint about DRM-ed downloads. I don't believe that's true anymore for any of the major services.

<comment><USER20> What's the difference, they're all still trying to ask ten times what they'll give the artists, for no reason and while taking 30% profit on a download that's at most worth one ad showing.

</comment></comment></comment></comment><comment><USER21> No company scores any points with me by starting out by greeting me as a "pseudo-criminal".

<comment><USER22> 'Pirate' though, that one sounds cool so we'll accept it. Seriously? They are implying by that greeting that it is not them who would label you as such a thing. Moreover it sounds like they've had it up to here with the major labels and distribution outlets who would call you an actual criminal and mean it.

Also, don't kid yourself. It is a crime (morally wrong, if not outright encoded in law) to download someone else's work for free so that you can enjoy it without paying a dime to _anyone_ (even the artist), unless they're giving it away. You don't even see that page unless you tried to acquire their artists' work for free.

<comment><USER23> > morally wrong, if not outright encoded in law

I'd say exactly the oposite. It's illegal (= prohibited by law), but might not be morally wrong - I don't feel bad for downloading movies/music when any of the following are met:

(i) the content is not readily available (e.g. movies right after release, movies and music in non-G6 countries) (ii) the content is of shitty quality or atmosphere (e.g. low bitrate, CDs, cinemas) (iii) I would not pay for content (i.e. even if it were readily available in supreme quality, I would rather not have it than buy it) (e.g. albums that I'm not sure are good).

<comment><USER22> This is where most people really start to bicker about this issue. There is the group that understands that it is morally wrong to steal, and then there is the group that does mental gymnastics to get out of "feeling bad" about it or to otherwise justify it somehow. You even end it with "I would not pay for content [...]." If that isn't outright just saying "yeah I steal and I don't care" then I don't know what is.

<comment><USER23> I guess the issue is elsewhere - there is a group of people that think that copying is the same as stealing, and there is the group that can see the difference.

I belong to the second group. Let me try to explain it to you... Would you rather that I stole your car, or just copy it?

<comment><USER24> The comparison is flawed. The theft is not of the physical product, but of the proceeds or profits.

<comment><USER24> @Falling3 - If you mean to tell me that the majority of people who download copyrighted items, then go forward to buy the music, sure your argument is fair.

@Tomp - Well it's hard to compare digital products to physical products since you don't have to create the item more than once for a digital good. Just because you didn't plan to pay anyway, doesn't make it any less "stealing" You can't use the argument "I was never going to buy it anyway" as a valid reason for stealing something.

<comment><USER25> If the argument is "piracy is bad because it results in a loss of profits", then the counterargument "that's ok I absolutely would not have bought it anyway" is completely valid.

<comment><USER24> Why should you be entitled to something free because you never planned to buy it? Please explain

<comment><USER25> No one is talking about entitlement. Read what I said. If the above argument is presented as reasoning against, then the counterargument is valid.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER26> Heh I know. Donate isn't a very good model. Etc. I don't even especially like their music.

But I clicked the link. I read it. No fancy HTML. Strong points. So I clicked donate anyway. It might not be much, it won't last, and I wont donate to them every month, but hey, for me it's more of a way to say "I support your point of view".

</comment><comment><USER27> I'd be much more likely to donate money for a track/album if I had some automatic way of tracking which I had donated to. One way to do this would be a website that let you donate a suggested amount for a song or album. For each song/album you donate towards, you get some signed key that says you supported that song.

There's some interesting things that you could build off of this:

\- Media players could show a little badge whenever you're playing a song you've donated to. They could also remind you (if you wanted) when you listen to a song frequently but haven't supported it.

\- Hook into Facebook - when someone downloads a song, they can see which of their friends have donated to it.

\- An additional metric for music suggestion services. What better way to show you like a song than by putting your money where your mouth is?

</comment><comment><USER28> I am surprised more labels aren't doing this.

How much is a label spending combating piracy? How many labels have actually prevented an album become available via bit-torrent?

Few albums actually flop because they can be pirated. I think a viable strategy is for the label themselves to upload the album with a message like this. Its going to be pirated anyway. These people aren't going to go to iTunes or buy the CD. Why not just have a simple message which says something like:

"If you enjoyed this album please consider making a donation to the artist. The artist will receive 85% of your donation. The other 15% helps cover the cost of production."

I mean, its worth a shot isn't it.

</comment><comment><USER29> Before they determine who stole their music, they should figure out who stole their stylesheet.

<comment><USER30> > Before they determine who stole their music, they should figure out who > stole their stylesheet.

What's wrong with the current style?

</comment></comment><comment><USER31> I have no idea if what he's trying to do here will actually work out for him, but I went ahead and donated $5 because I have to respect him for at least trying.

</comment><comment> cm-t Framablog, a blog about free software, net neutrality and popularizy these philosophie just published a french translated version [http://www.framablog.org/index.php/post/2012/05/24/salut- a-t...](http://www.framablog.org/index.php/post/2012/05/24/salut-a-toi-pirate)

</comment><comment><USER32> Excuse the shameless plug, but pages like these ensure me that launching musicrage.org was a good idea.

</comment><comment><USER33> Why don't musicians just decline to license their music if they get tiny share? Can't they create some sort of union that would give them bigger negotiating power? Or just sell the music on the internet? I wonder why market mechanics don't work here.

<comment><USER23> Because they usually licence their music _before_ they become famous.

Contrary to popular belief, music labels are NOT (for the most part) middle- men (i.e. content distributors). In reality, they are INVESTORS. They bet on a number of artists (providing them with managers, tour opportunities, studios, promotion), and only a small number succeed. It's actually quite reasonable for them to expect a huge payoff (= a large cut of the profits) from the ones who do.

<comment><USER34> The current model seems unnecessary with the internet though. Seems like artists, if they are good, should be able to become famous selling their music direct to consumer through some distribution service like iTunes without a long term contract.

Once someone has made a name for themselves, it would seem perfectly reasonable for a label or a venue to approach them about doing a concert or a tour and taking a cut of the proceeds.

Perhaps the problem is that bands or artists want to fast-track their road to fame. In signing with a label, it seems like they are giving up a lot to get there faster. The question is, can artists who are willing to work their way up more slowly or organically able to, or are certain doors closed because they aren't signed with a label?

<comment><USER23> Distribution and getting listeners/fans is only a part of the problem... Getting a studio and a professional to edit your music is the real cost that new artists have to deal with. I have a friend that makes music _on a computer_!!! and he's been wanting to produce a professional recording for more than a year (needs $$$ for studio/editing/mixing/I-have-no-idea-what).

<comment><USER34> I guess it depends on what kind of music you are recording, but do the first songs you release to potential listeners have to be professionally edited or mixed? As long as its recorded using somewhat decent equipment, it seems like that would be enough to get something together to release.

<comment><USER16> The problem is that professionally edited and mixed music is the norm. Nobody's stopping bands from releasing poorly edited and mixed music, but it adds another hurdle to overcome.

</comment></comment></comment></comment></comment></comment><comment><USER35> I like it. I would be interested in seeing if this works for them.

<comment><AUTHOR> It happened 4 years ago, and the guy's not rich, but this model supported him enough to release 7 full length albums since, and do quite a few concerts. Furthermore, his attitude towards the music industry (and fantastic creativity in music and other things) gained him a bit of a cult following.

</comment></comment><comment><USER36> YES

</comment><comment><USER37> Doing it right!</comment>