Show HN: A decentralized social network with end-to-end encryption - <AUTHOR> https://github.com/mschultheiss/Charme <comment><USER2> The cryptography in this system does not appear to be safe. Apart from the fact that it's browser Javascript, which can only be as secure as the server's verified TLS key anyways (and thus doesn't add any security TLS doesn't), it's also using outdated RSA crypto constructions that are vulnerable to attacks.

I think you should find an expert to work on this project with you and provide the cryptographic design for you. Cryptography in a social network is like cryptography in a messaging application: _it has to work_. It's irresponsible to offer someone a solution for sharing secrets (with peers or with their network of close friends) if you can't keep those secrets.

Thankfully, you're not doing that yet; I think it was good judgement for you to include the "NOT SECURE" warning in the Readme.

Good luck!

<comment><AUTHOR> Yes, as written on top this is a technology preview, so it is not safe yet. Furthermore the production version will use the web crypto api. The client software must be shipped packaged as a standalone application (Apache Cordova etc.) with integrity protection or hosted on your own server and served via https. Yeah, the goal is actually to get some feedback about the crypto design and improve it :)

<comment><USER2> Unfortunately, the Web Crypto API doesn't automatically get you safe cryptography either. It was added by the W3C to allow video vendors to implement content DRM in pure Javascript rather than requiring plugins, and so it includes a great deal of legacy crypto.

Long story short, you need an expert in cryptography to design this for you, whether or not you use WebCrypto.

This isn't something you should take risks with. It would be better to advertise a decentralized social network with NO CRYPTOGRAPHY (which is what this essentially is) than to say it has "cryptography that hasn't been audited" (which most users won't distinguish from real crypography).

<comment><AUTHOR> 1\. The web crypto api was indeed made to secure communications, such as stated by the W3C on [http://www.w3.org/TR/WebCryptoAPI/](http://www.w3.org/TR/WebCryptoAPI/) (...) "Uses for this API range from user or service authentication, document or code signing, and the confidentiality and integrity of communications. "

2\. Yes, you are definetly right, an detailed audit of the protocol is necessary by more than one expert.

3\. Here is a short description of the basic concept: Client and server are seperated. The client software is basically what is hosted on Github. Its source code must be protected from MITM attacks of course, so it is best to ship it as standalone, downloadable application in the final release. THE CLIENT CODE WILL NOT BE OFFERED BY A SERVER IN A PRODUCTION VERSION.

So at sign up, the client software now generates a (RSA) public key pair and some symmetric keys used for (AES) encryption and integrity protection locally and encrypts it with a passphrase. The passphrase is only known by the user, but not by the server. The encrypted string is also integrity protected. It is sent to the server, stored there, and decrypted with the passphrase at login again. This way we ensure only the client software can see secrets, such as the private key, but not the server software.

Next, you have a key directory. It is signed after every modification with a secret salt which was generated by the client (and not known by the server) at signup. The keydirectory contains all the verified public keys of the user. (Protecting it from replay attacks would be worth another essay here) Now when you write messages for example, you get the public key from this directory and encrypt/sign it basically like in PGP. So the focus of this preview is not on the crypto primitives, but rather on the concept itself.

Edit: I hope this does not sound too unfriendly, I am very happy about your feedback and I promise I will look for further advice regarding the crypto/protocol ;)

<comment><USER3> > 1\. The web crypto api was indeed made to secure communications, such as > stated by the W3C on > [http://www.w3.org/TR/WebCryptoAPI/](http://www.w3.org/TR/WebCryptoAPI/) > (...) "Uses for this API range from user or service authentication, document > or code signing, and the confidentiality and integrity of communications. "

So they say. You'd be hard-pressed to find a cryptographer that _likes_ Web Crypto.

> 2\. Yes, you are definetly right, an detailed audit of the protocol is > necessary by more than one expert.

Shameless plug: [https://paragonie.com/service/code- review](https://paragonie.com/service/code-review)

> So at sign up, the client software now generates a (RSA) public key pair and > some symmetric keys used for (AES) encryption and integrity protection > locally and encrypts it with a passphrase. The passphrase is only known by > the user, but not by the server. The encrypted string is also integrity > protected. It is sent to the server, stored there, and decrypted with the > passphrase at login again. This way we ensure only the client software can > see secrets, such as the private key, but not the server software.

Are you going to build it in, say, Electron? That's pretty neat.

What padding mode are you going to use for RSA? What hash function for MGF1?

Are you going to also employ digital signatures? Will you use the same RSA keypair for signatures?

What about your other parameters? (There are attacks for e=3 RSA signatures, for example.)

What cipher mode are you going to use for AES? What key size? Are you going to MAC then Encrypt, Encrypt and MAC, or Encrypt then MAC? I'm assuming the third option.

How are keys going to be authenticated to the clients? How will they detect/prevent the server from substituting a user's RSA (eww) key for one of their own choosing?

How are you going to derive your encryption keys from the password?

Why not save a lot of time and frustration and just use node-sodium (assuming Electron of course)?

        - Transport: crypto_sign() + crypto_sign_open()
        - Encryption: crypto_box() + crypto_box_open()
        - Key derivation: crypto_pwhash() + crypto_box_seed_keypair()
          + crypto_sign_seed_keypair()
        - Salts, keys, nonces, etc: randombytes_buf()

Life is easier with sodium. [https://paragonie.com/blog/2015/09/how-to-safely- implement-c...](https://paragonie.com/blog/2015/09/how-to-safely-implement- cryptography-in-any-application)

<comment><USER4> Even if he makes all those decisions correctly the system won't support forward secrecy.

<comment><USER3> Why do you think I separated crypto_sign() from crypto_box() in my description?

</comment></comment></comment></comment></comment></comment></comment><comment><USER5> I want this to work so much. So many people have tried this, and I have signed up for, or self-hosted, every single one of these things, and even convinced my friends to join a few. None of them ever take off. How is this different?

<comment><USER6> Yes. There's Diaspora and Frendica already, with maybe a few hundred users.

To launch something like this, you need to figure out some way to get a user base, a user base that people will want to connect with. Something like

\- Ivy League students (hey, it worked for Facebook.)

\- VC, angels, investors, and startup CEOs. (They might like something with more security, especially since they might be planning to take a bite out of Facebook or Google.)

\- Political groups, where there are communities of fund-raisers and lobbyists, people trying to get things done together and concerned with others not listening in.

Consider targeting groups that involve people working together to do something. They need to-do lists, spreadsheets, scheduling tools, and other collaboration support. Basically Box.net's feature set, but without Box, Inc.

<comment><USER7> Its a big leap to jump from a centralised social network to a truly distributed self hosted network. The missing link seems to be the semi-central ones, like having few central hosts which allow users to flow between them. Get the protocol to evolve and user adoption to happen on this and subsequently allow anyone to plugin their self hosted server, if they want to and still allow full network discovery across the hosts all over world.

</comment></comment></comment><comment><USER3> [https://github.com/mschultheiss/Charme/blob/7634cd89febbe288...](https://github.com/mschultheiss/Charme/blob/7634cd89febbe28825d6d33c012c2fe4754f02c2/server/charme/lib/App/Users/UserRegistration.php#L34)

Please see:

[https://paragonie.com/blog/2015/07/how-safely-generate- rando...](https://paragonie.com/blog/2015/07/how-safely-generate-random- strings-and-integers-in-php)

\</comment><comment></comment><comment>--

[https://github.com/mschultheiss/Charme/blob/c8eb501f1ac0c607...](https://github.com/mschultheiss/Charme/blob/c8eb501f1ac0c607d953aa60bc95bae6e548ad0b/mobile/Android/CharmeApp/charmeApp/src/main/java/com/mschultheiss/charmeapp/Controllers/ActivityLogin.java#L217)

[https://github.com/mschultheiss/Charme/blob/7634cd89febbe288...](https://github.com/mschultheiss/Charme/blob/7634cd89febbe28825d6d33c012c2fe4754f02c2/server/charme/lib/App/Users/UserRegistration.php#L79)

please see:

[http://codahale.com/how-to-safely-store-a-password/](http://codahale.com/how- to-safely-store-a-password/)

[https://hynek.me/articles/storing- passwords/](https://hynek.me/articles/storing-passwords/)

</comment><comment><USER8> This is a serious question, because it's the situation I'm in: Why would somebody who is techy enough to use a decentralized social network, not just use IRC?

I have a group of techie friends. We started a "private" IRC channel in 2010-ish and so far have been unable to find something better. Modern clients embed images, embed video links, and so on. We have bots that handle upvotes and offline messaging and a few other things. We even have a thingy that shows history (and most modern clients do that anyway)

None of us would be willing to self-host anything. Too much effort.

Am I misunderstanding how decentralization works for Charme? Is it more like hosting my own website, or more like using git?

I like the idea. I worry about moving my existing social capital.

<comment><USER9> In my opinion, IRC does not have the features that Charme can offer right now (not looking at the security perspective right now): It allows smart ways to filter your friend's messages. For example, you could filter for people driving from point A to point B. Considering some hundred friends within one group (like in FB), you could handle the massive amount of messages manually any more. So, these context things in Charme look very promising.

For hosting I agree that it might be a problem. But normally, you always know one of these techy guys :)

However, I completely agree with the last part: moving a user base is very tough or even impossible.

</comment></comment><comment><USER10> > [https://github.com/mschultheiss/Charme#why-am-i-not- > allowed-...](https://github.com/mschultheiss/Charme#why-am-i-not-allowed-to- > loose-the-passphrase)

One 'o' in "lose".

</comment><comment><USER11> Discovery is crucial.

A social network can be thought of as a kind of search engine: you're trying to find people, posts and resources that are relevant to your interests.

On the other hand, a social communication app works by allowing you to connect to your existing friends. So for example, with an app like Peach, finding new people or searching for posts matters less.

The really hard question for the first case is: how do you combine searchability with end-to-end encryption?

<comment><USER12> There have to be things that are explorable and things that are not. Your messages, your "wall" (to non-friends) etc - those can be encrypted.

your name, your city, your public posts, posts made by companies - you could design this so those are not encrypted/are available for search.

</comment></comment><comment><USER13> As someone who has been working on something similar (see old proof of concept here: [https://ciety.com](https://ciety.com) \- sorry for the expired ssl certificate), I applaud your efforts.

I have learned a lot since the version above (a lot has been changed) and I see room for a lot of improvement. I also have a nice desktop client on the way since you shouldn't be doing crypto in the browser/javascript, feel free to add me on Skype (samgranger) or email me: email@example.com - I'd be willing to give you some pointers. I'll be releasing v2 soon (which will also be open source).

<comment><USER14> Not sure if you missed it but letsencrypt.com has first party certificates for free on 90 day renewal terms. Encrypt everything, and then some.

It's at the OS level too, at least on Win10, as I was going through the mmc Cert module to see what was in there and lo-and-behold. I had thought it was just an agreement amongst the three browser developers. I should check my Mac to see if Apple pushed an update too.

</comment></comment><comment><USER15> It's a nice effort, but it's covered in warnings that say "don't use this" \- therefore, not yet interesting.

I'm going to leave this here: [https://movim.eu/](https://movim.eu/)

Movim is a social networking client that is based on standards. It uses XMPP under the hood, and utilises the XMPP standards for instant messaging, multi- user chats, and microblogging (amongst others). It covers all the major features of facebook (IMO) as well as being federated, so that people can run their own nodes.

</comment><comment><USER16> Nice. Keep working on it. We need a solution. What's your stack?

</comment><comment><USER17> I support the idea behind this, but I love the community on Diaspora, and more importantly it is also decentralized and open-source.

<comment> blubb-fish The big downside of it is though that your stuff is potentially stored on someone elses pod - okay, you can create your own server for the pod etc but this won't help you if messages from you are insecurely stored on some strangers server.

The solution would be to (somehow) introduce asymmetrical encryption for the content.

</comment></comment><comment><USER18> You really need to look on the security perspective to harden it. When it's marketed with security in mind.

And there's so many things wrong with the PHP syntax etc. as well as you have committed the entire Composer vendor/ folder. Put it in gitignore and remove it. You should not commit dependencies to your code base.

</comment><comment><USER19> I'm also writing a paper on decentralized social networks. And the biggest hurdle I think is to make currently available technology stacks easier to use for non technical users.

</comment><comment><USER20> >> "If you want to support development and have to much money"

 _too_ much money.

</comment><comment><USER21> how is it different from diaspora?

<comment><AUTHOR> It has end-to-end encrpytion - so if you are hosted on a friend's server for example, the friend can not read your messages, which might be useful :)

<comment><USER21> in that case, wouldn't it be better to focus on adding e2e to diaspora? or is there an architectural limitation with it? that seems a lot of redundant work at the moment.

<comment><USER22> Without knowing anything about the technical difficulties, I would argue that Diaspora as a brand is already dead -- associating with it is basically a guarantee of no users.

<comment><USER23> That is so untrue. Diaspora is doing better than ever, after the unrealistic burden of killing Facebook was gotten out of the way. Now it is "just" a well functioning network with tens of thousands of active users and an active development team.

</comment></comment></comment></comment></comment><comment><USER24> One main problem is that you have to make passwords recoverable. In real world message like "warring! we can't restore your key!" just doesn't work at all. People ignore it and still want you to recover their keys. Also forcing people to have password is also very vulnerable.

</comment><comment><USER25> How do you handle discovery is it location based or in person like a darknet?

</comment><comment><USER26> Is there a reason why this still relies on a server? I would have thought that the better option would it to be completely P2P, without any servers whatsoever.

</comment><comment><USER27> End-to-end-encryption-not-secure. hmm.

</comment><comment><USER28> i did also thought about something like a P2P hybrid network</comment>


Show HN: Honesty.io - Pay what it's worth digital downloads. Advice please? - <AUTHOR> https://www.honesty.io

<comment><AUTHOR> Developer here!

Honesty.io is an experiment to pass on the Humble Bundle style "pay what you think it's worth" mechanic to all independent publishers (not just games).

No attempt has been made to create a marketplace. I am undecided. I see the value of a marketplace to a new publisher but I believe the future of publishing is niches.

Minimum prices and disabling the charitable donation and tip are features I've considered but am concerned they dilute the altruistic message?

Any advice would be greatly appreciated!

</comment><comment><USER2> I think it's a good side project, but don't bet your life savings on a donation-based business model. Hope is not a good business strategy ;) Wonder if you could mine Bitcoin based on how much content is consumed for free (i.e. The more they stream movies, the more you can generate for yourself and the content creator/publisher). Just thinking out loud.

</comment><comment><USER3> Have you considered adding an embeddable widget, I think lots of content creators probably have simple webpages, and the ability to create them, but lack the time, desire and skills to add ecommerce to their site?

I also think it might be nice to provide the option to show an average download price, probably excluding free downloads, to avoid skewing.

<comment><AUTHOR> Thanks for commenting - I think that's a great idea. The widget fits with my desire to let the publisher be independent of a marketplace.

</comment></comment><comment><USER4> excellent innovation. love the attitude. congratulations.

i believe you could make this stronger by reciting the benefits derived from voluntary fan support of artists.

even when phrased in the abstract, this position always sounds self-serving when it's made by artists themselves.

but i think that _you_ could -- and perhaps _should_ -- state the case, and have it seem entirely appropriate.

-bowerbird</comment>


Zim – A Hierarchical Notes Application - <AUTHOR> https://zim-wiki.org/ <comment><USER2> > Pages are stored in a folder structure, like in an outliner, and can have > attachments.

I wish this model worked for me, but the concept of "pages" just doesn't. I would immediately get into a situation in which I'd need a sub-page for an aside.

Is this a problem for anyone else?

I am currently using Dynalist to solve this, but very annoyed by its proptietary nature. Is there any free software that successfully implements this "infinite outline" approach?

<comment><AUTHOR> I've actually never encountered that issue, but because Zim is a wiki style editor, you could create links to different pages for asides. It's still another page, but at least it can be all grouped together.

I have found Zim to be a great tool for note taking and creating a personal knowledge base. I can create a link to a more detailed explanation from any page if needed, or write down examples separate from theory.</comment></comment>


Redux middleware for action side effects with callbag - <AUTHOR> https://github.com/janryWang/redux-callbag <comment><AUTHOR> You may not need redux-saga/redux-observable</comment>


CONFIDENTIAL Looks Like Someone Just Accidentally Revealed "Google +1″ (Pic) - <AUTHOR> http://techcrunch.com/2010/12/07/google-plus-one-pic/ <comment><USER2> After reading all the recent HN posts about unblurring data in photos, I would be a little afraid for the person who leaked this.

<http://tctechcrunch.files.wordpress.com/2010/12/a1.png>

<comment><USER3> In fact you can make out not only the number of characters blurred but also some of the characters themselves just by zooming in.

<comment><USER4> Wow, I just emailed the address and got an autoreply with an invitation to the pre-launch beta! Ah, Google, you rascals of viral marketing...

<comment><USER5> I can make out some of the characters but not nearly all. How can you decipher that?

<comment><USER2> I thought it was 'chasen' but sending an email there bounces back. Also tried 'chaseh' but got no response.

<comment><USER4> I was actually just kidding. However, I admit that I did search LinkedIn for a Chase H. at Google.

</comment></comment></comment></comment></comment></comment><comment><USER6> Anyone is free to have ethics and choose to not participate in spreading confidential documents. Just saying.

</comment><comment><USER7> Facebook will be breathing easy. That looks shit.

</comment><comment><AUTHOR> GoogleLeaks.com

</comment><comment><USER8> Poor headline style.</comment>


Can you think of an example with lower energy to secure than the best attack? - <AUTHOR> https://medium.com/coinmonks/blockchain-myth-5-proof-of-work-wastes-energy-a848000aea9a <comment><AUTHOR> I'll save you two examples:

1\. Finding a private key to a public key without a brute force attack can be done by physically forcing the holder of the private key to give it up ($5 wrench attack). This is the low energy attack vector. You can secure the private key only by expending more energy to protect it.

2\. In the game of hide and seek to avoid searching the whole space you can follow the person hiding to their hiding place, watch them come out, or intercept their communications. All these activities require effort on the part of the hider that is at least equal than the effort to follow/detect them. If no communication is made and the hider never leaves the hiding spot, the situation is analogous to a death, and so is not the same scenario.</comment>


I Said 'Yes' to Everything for a Week and Ended Up in the Hospital - <AUTHOR> https://www.vice.com/en_us/article/i-said-yes-to-everything-for-a-week-876 <comment><USER2> Surprised the article didn't mention the movie "Yes Man" which was exactly this premise.

Synopsis - man going through a hard time goes to motivational speaker/semi- cult meeting who's followers have to say 'Yes' or perform in the affirmative to whatever is asked of them.

</comment><comment><USER3> Un-athletic person jumping into a high rep workout done for time? The author is lucky they didn't suffer kidney failure or die.

From an article [1] on rhabdomyolysis:

 _What movements cause rhabdo?_

> Well, there's no magic movement that always causes rhabdo. But some > movements are higher risk than others when performed by new athletes or when > performed to excess repetition. These are usually movements with a demanding > eccentric motion. Stay with me. This really isn't too complicated. Most > movements have two parts: an eccentric part and a concentric part. Eccentric > means that muscles are stretched under load. As you lower into the bottom of > a squat, you are performing the eccentric portion of the squat. Your > hamstrings are lengthening under load. Concentric means that muscles > contract under load. As you drive out of the bottom of the squat you are > performing the concentric portion. After being stretched, your hamstrings > are now contracting and driving the load upwards. Eccentric motion is very > demanding on muscles. _Stretching muscles under a load with lots of > repetition can cause the muscle breakdown that triggers rhabdo._ Here are a > few examples of movements with a strong eccentric portion: jumping pullups, > GHD situps, walking lunges. Now these are all excellent movements that have > their uses in building a strong and healthy body. _Just don't jump into > doing hundreds of them, unless you're a strong and experienced athlete that > has worked up to that level of ability._ [emphasis added]

[1] [http://crossfitimpulse.com/rhabdo-and- crossfit/](http://crossfitimpulse.com/rhabdo-and-crossfit/)

<comment><USER4> I did __one __personal training session last year and got Rhabdo from it. Guy from the article is lucky he was in the hospital for only 1 day; I stayed 4 nights and they didn 't even want to let me go then.

</comment></comment><comment> King-Aaron I can't say this article made me think very highly of the author.

</comment><comment><USER5> Yes Man !</comment>


Google will start warning Chinese users about problematic search terms - <AUTHOR> http://insidesearch.blogspot.com/2012/05/better-search-in-mainland-china.html <comment><USER2> This is totally badass. Instead of a technical solution to a technical problem, Google is going with a political solution to a political problem.

There are a ton of technical ways Google could silently defend against this particular form of censorship (someone suggested reencoding the offending characters), thus starting a cat-and-mouse game with the censors. But that would (1) be an "act of war" in terms of blatantly attempting to pierce China's Great Firewall, giving China an incentive just to block Google wholesale; (2) not inform people that their searches were being censored; and (3) be a lot of work, with no likelihood that they could ever keep searches uncensored for very long.

By playing totally dumb, and saying "huh, we've noticed some kind of technical problem with your search, try phrasing it a different way," Google (1) takes no overt action to evade the censorship; yet (2) lets everyone know it's happening and subtly encourages them to try to evade it themselves; and (3) sets up a system that sees any censorship as damage and routes around it, which hopefully is an approach that's relatively difficult to counter without blocking the whole site, and is how the internet ought to work anyway.

In conclusion: from the little I know of what's going on here, this is a seriously clever move. Interested to see how China responds.

<comment><USER3> """By playing totally dumb ..."""

In China, that is actually the usual way to get around the law.

</comment></comment><comment><USER4> Removing the censorship was never the best way to help dissent in China. Simply indicating that the requested search had some results censored is the most potent way to fight censorship and stew dissent.

When I suggested this a few years ago and criticized Google's decision to un- censor the results, all my comments were brutally modded down.

It seems that Google has finally seen the wisdom of this approach. The next move for China is to ban Google completely, which is sadly much easier now that Baidu has had a few more years to gain traction and market share.

<comment><USER5> One of the reasons they back down on China was because they could not compete with Baidu. It's not just the ethical 'I won't censor my results' (which in my own view, is a good thing).

I'm not sure how their decision went, but I assume that they did their research first to see if their changes would really drop their marketplace share too much. I'm not sure if China will block Google... if they do I don't think it would be much different than Google censuring their own results (the censored content would not be accessible). When people try to go to Google they would notice it's censored too.

<comment><USER6> They ignore China because it was bad publicity and not worth the rounding error gain in net profits. There are plenty of obvious problems hosting a website in China but you need to add it's a poor country where it takes several times to traffic and several times the resources to make the same income.

PS: Don't believe me? _in a country with 457 million Internet users... Baidu currently has a 75.8 share of China's search engine market, according to Beijing-based research firm Analysys International. Google is a distant second with a 19.2 percent share._ And with that 75% share Baidu, had a net profits for the quarter ended March 31 were US$164 million. Compared to Google's $10,645 million last quarter. ([http://www.pcworld.com/businesscenter/article/226507/chinas_...](http://www.pcworld.com/businesscenter/article/226507/chinas_baidu_revenue_profits_up_on_strong_traffic_growth.html))

</comment></comment></comment><comment><USER7> I can imagine this blog post was very carefully written; Google subtly avoids mentioning that these "interruptions" are likely due to the massive censorship measures in place in China. Can anyone explain why seemingly innocuous terms like 江 (Jiāng) are being censored?

<comment><USER3> "Jiang" may refer to "Jiang Zeming" (former President some ten years ago).

There was some rumors a few weeks ago that he had died. China is currently in a transition of power from one to the next president (there have only been two such transitions so far, and there is no established legal process for it yet). Jiang Zeming is seen as a stabalizing factor during that process.

So, having rumors floating around that he died, would be potentially risky to stability (because people very easily believe stuff and easily get nuts about totally unfounded news, because you never know what to believe and what not if there is no independend press).

<comment><USER8> More detail here: Jiang Zemin death rumours spark China web crackdown - <http://www.bbc.co.uk/news/world-asia-pacific-14054456>

Not a few weeks ago though; appears to be from nearly 10 months back.

</comment></comment></comment><comment><USER9> There's something I don't get - why is the Great Firewall of China only blocking these terms in GET requests?

If it's only GET, then a user can use POST to search and bypass all this entirely - Google just has to change the request type, which IMHO is much easier than what they just did.

If it's both GET and POST, then I don't see how typing in the infringing character which is then POST'd via AJAX is any less prone to connection termination than a GET search request.

It doesn't add up.

EDIT: downvotes? Seriously?

<comment><USER10> It's possible google stores the finite list of bad queries in JS and has the user's browser do the comparison client-side.

<comment><USER11> Yep - the web page is a client-side app, proactively warning the user about problems in the network

<comment><USER12> Let's get that list!

<comment><USER13> I wonder if they load the whole list of "bad" terms on the client-side. Wouldn't that trigger the firewall? Unless they encrypt it, or use a bloom filter (which would save some bandwidth)...

<comment><USER14> not sure if a bloom filter with false positives would be a good idea in this case.

</comment></comment></comment></comment></comment></comment><comment><USER15> The same blog post in Chinese is provided as a 10 MB PDF [1]. My PDF reader simply gives up while loading it and prints insane amounts of error messages. I'm guessing they converted all the text to curves to avoid being censored?

[1] [http://services.google.com/fh/files/blogs/google_chinasearch...](http://services.google.com/fh/files/blogs/google_chinasearchchinese.pdf)

</comment><comment><USER16> My over engineered solution. Catch the bad letter and replace it with a something else(i.e. another value mapped to a separate fontface). Translate the request on the server side being sure to reencode the page if it contains a 'bad letter'.

Demo: <http://christopherwoodall.com/ceasar/>

<comment><USER17> Well, yeah, you could also get a proper VPN that encrypts your traffic, but that's a bit beside the point.

</comment></comment><comment><USER18> I think this is quite a brilliant move for Google. I know a lot of Chinese people considering Google inferior, because "I often don't get anything when I use Google. It must be a company of inferior technology." Actually, they have just encountered the GFW's reset, and for common people it's natural to blame the site. Now with this move, these people will gradually know that it's GFW's censorship.

</comment><comment><USER19> I am totally naive to these cat and mouse games, but why does not Google just force SSL in China? They would have to turn off the partial searches feature, which has been shown to leak the cleartext, but I think it would totally fix any sort of censorship. Then again, maybe this type of response works better politically.

<comment><USER20> SSL only works if you trust the certificate authorities.

<comment><USER19> Yes, but that would be likely detected, and the CA that had its private key stolen or coerced for government use would be exposed nonrepudiatably. All browser makers would immediately drop the bad certificate. In the case of targeted connections, this may avoid detection though.

<comment><USER21> You seem to be unaware that businesses (and governments) can legitimately buy keys that allow MITMing SSL connection or they could just be a CA themselves (no problem for China).

It is annoying that people downvote you instead of explaining your error in your assumption about SSL.

<comment><USER19> Yes, but then that bogus certificate is in the wild. Once once someone has a copy of a bogus certificate, then they can prove that that CA is corrupt. That CA loses its business model. What I am saying does not prevent one-off attacks, but all it takes is one person to capture a bad certificate to discredit a CA. Hence it would not work in a universal censorship scheme as Google is combating. Maybe I am still overlooking something, and I suppose China could just SSL proxy the whole country, which would defeat all of this.

<comment><USER21> You are very confused about how SSL in the context of HTTP works. Here's the best talk I know of this subject:

BlackHat USA 2011: SSL And The Future Of Authenticity: <http://www.youtube.com/watch?v=Z7Wl2FW2TcA>

</comment></comment></comment></comment></comment></comment><comment><USER22> Brilliant. Raising awareness will not let people forget and become comfortable with the status quo.

<comment><USER23> I'm in China right now and simply astounded at the apathy I see from even very well-educated folks, though. Local Chinese roommate works at Oracle and is completely fine with censored search, doesn't use VPN, etc. And this is beyond the less technical people, many of whom aren't even aware of the firewall.

I think this is still a clever and classy move for Google, though I just wonder if it motivates people beyond those already intrinsically motivated (a relatively large % of current Google.CN users).

<comment><USER24> You're astounded because well-educated people from other cultures don't care about the same things you do?

</comment></comment></comment><comment><USER25> That blog entry was pretty non-technical. Does anyone have a clue why this might be happening? It's not like 江 is in any way uncommon.

<comment><USER26> The implication is that the Great Firewall will see a GET for google.com/search?q=[any of those characters] (or equivalent) and not let you get to google for a minute afterward.

<comment><USER27> But why would the Great Firewall block such common things?

<comment><USER28> Presumably, they're characters that are either in sensitive personal/place names, or they're part of commonly used and politically significant euphemisms or idioms.

There's also possibly a punitive element of this: in addition to whatever issues they have with some search terms, the Chinese authorities may have decided to be trigger-happy with the banning as a punishment to Google for ceasing its cooperation on search filtering.

</comment></comment></comment></comment><comment><USER29> As a Chinese, I think this feature is quite useful for us.Though I use VPN most of the time, I do dislike being interrupted for several minutes when I accidentally searched some censored words.

<comment><USER24> Why do people like to start a point with "As a x"? Does it mean that he/she speaks for the group as a whole or does it add extra relevancy?

<comment><USER30> extra relevance. it's a valuable datapoint to see what someone who is actually affected by the censorship thinks of google's new measure.

</comment></comment></comment><comment><USER31> So everybody plz try to help us, voice of a google user from China.

</comment><comment><USER32> And so, the wall crumbles.

</comment><comment><USER33> Since when is McDonalds a sensitive/censored query? (And why?)

</comment><comment><USER34> Way to beat around the bush. This is the botched censorship system, and at least Google used to make that clear. Nowadays, they show you 10 minutes of HD video of someone trying out various search queries in various browsers and being blocked.

And they have the chuzpe to add "we have checked our systems and couldn't find anything". Way to make yourself complicit.

There have already been congressional hearings into Google's business in china, back when they still tried to enable unhindered access for users there.

<comment><USER28> I did find it interesting that they got through that whole article without using the words "blocked" or "censorship". However, your read of this is completely off-base.

Reading between the lines: "Since we moved to Hong Kong and stopped filtering search, the Chinese government is just cutting off internet connections that are seen searching for sensitive terms; here's a workaround that will give you advance warning, so you can rework your search phrasing."

</comment></comment><comment><USER35> This stinks of cowardice.

If Google has reason to suspect that these interruptions are caused by active censorship by the Chinese government and are unwilling to do so out of fear of that censorship we are all in trouble.

It's not as if the population of China is unaware of censorship. Helpful reminders of what is socially acceptable and what are not have appeared in colorful cartoon form for years online.

It's not as if the Chinese government denies controlling access to information. They see it as a fundamental good to maintain the stability and health of society.

The only place and time where this matters is where the censorship is cast is a negative light. China doesn't want to be insulted on the international stage, and it doesn't want companies promoting unrest among its people. However that criticism is exactly what _must_ happen.

Google could describe what's going on as relating to 'sensitive' terminology. They could describe the 'restrictions' as being imposed for the good of society and apologize that non-sensitive terms are being caught up in the fight for the greater good.

OR they could grow a pair.

Corporations in power have a responsibility to fight for the rights of those people without power. They have a responsibility to do so visibly to set a good example for others, and they have a responsibility to directly and honestly criticize people, companies, and governments they see as violating those rights.

This is an active debate with no guarantee of an outcome that favors American style freedom of information. If the players who can fight this fight won't, we're* fucked.

*We being those who want American style freedom's to exist globally.

<comment><USER36> They are fighting it by giving Chinese internet users access to a search engine that reveals when censorship is occurring. This is not a move that the Chinese government will be happy about. Google needs to carefully toe a line here. If they take a harder stance then the Chinese government will block them 100% from operating in China, which does far less good in fighting censorship.</comment></comment>


List of Topics Categorized as Pseudoscience - <AUTHOR> https://en.wikipedia.org/wiki/List_of_topics_characterized_as_pseudoscience <comment><USER2> I often tell people that I believe that the sun revolves around the earth because, well, I see it moving around (half of the path).

When they either laugh or think I am trolling I ask them to change my mind by refuting this observation. I also tell them that I have a first hand observation while they have some vague, hand waving pictures of trajectories.

The discussions with some get interesting when they slowly discover the concept of center of mass, relative movement etc.

Children are better at that because they do not have yet opinions burned into their brains by weak schooling (schooling which prefers to drop equations than let them discover things as they go).

I have a PhD in physics so it is easier for me (and people do not assume that I am an excited flat earth believer or somethkng) but I am really sad that a lot of things which people are told are just that: told. Not done through self discovery.

</comment><comment><USER3> This was a good read. I like to consider myself fairly rational, but even so a small handful went against my intuitions.

Admittedly, the article defines itself as a list of things which have been labelled as pseudoscience at one point or another, and obviously the lines aren't always clear as some things make the list because of quacks' overenthusiasm and/or twisting of what is a small localised benefit into much more than it is.

Regardless, for fun here are a couple which went against my current intuitions:

Fasting: while not in vogue to cure diseases per se (although some people point to diabetes), variants of fasting seem to be in vogue at the moment.

Graphology: To me (someone with pretty lazy handwriting), I feel like comparing mine with someone's which is significantly more neat would say _something_ about our respective personalities.

<comment><USER4> Yes, Fasting should probably be removed from that list (via better studies on fasting?)

As should

Lunar effect – the belief that the full Moon influences human behavior.

If my anecdata does not count, it sure is proven that

1\. light influences human behavior 2\. full Moon reflects light

Q.E.D.

Following the link, this is indeed the only proven effect of the moon: "The lunar cycle seems to influence human sleep, even when one does not 'see' the Moon and is not aware of the actual Moon phase."[Cajochen 41]

</comment></comment><comment><USER5> I don't believe in photos from space as well. When you think about it, the reproducibility of the scientific method seems to have been lost in modern times in favor of "nerd/black/wheelchair science man said so" TV shows. I much prefer the algorithmic proof of scientific claims, so that I can use my own tools and my own brain to confirm the result such as the sailing ship phenomenon and the geometry of the horizon. Anyone agree?

<comment><USER6> In principle, sure! "Nullius in verba" and all that. But where I think this is interesting and most important is for those pieces of knowledge whose scale / cost make independent confirmation firmly outside the reach of any but the most well-resourced of agents. I think the subject of vaccine safety exemplifies this well. There are only a tiny number of people in the world who, realistically, can independently kick the tires on whether vaccines do / don't work or whether they are / aren't safe. Vaccine believers / skeptics are basically all just left to take someone else's word for it.

</comment></comment><comment><USER7> A lot of us like this post, because we can run through it and not be offended by any of it.

Unfortunately, the vast majority of people will run through it and will be happy ignoring the one or two on the list that they seriously subscribe to.

</comment><comment><USER8> [https://en.wikipedia.org/wiki/Propaganda](https://en.wikipedia.org/wiki/Propaganda)</comment>


Apple's ping is a big pile of steaming dung - <AUTHOR> http://swizec.com/blog/apples-ping-is-a-big-pile-of-steaming-dung/swizec/1444 <comment><USER2> I pretty much had the same experience.

For comparison I found Muse had a stream on Ping so I checked it compared to their Twitter account. Ping's stream for them was sanitized and small. It was not personal and I assume it didn't tell me anything other than what the label wanted me to know.

With full access to my very large library including many albums purchased in ITMS, they suggested a series of artists I have no interest in.

Activity is only measured by what you purchase or review in the ITMS, not on what I actually do in iTunes. They have an opportunity to steal everyones lunch with Ping. Mirroring last.fm functionality with scrobbling and then presenting that info in the profile is a no-brainer.

When looking at my profile, I noticed that the two things it pointed as were two reviews I made in iTunes from years ago. Fresh content is king.

The interface is terrible. Navigating around Ping is a mess.

Granted this is a 1.0, but they have a lot of work to do if they want it to get serious traction and they need to loosen the content reigns a bit. Waiting for my profile pic to be approved is silly.

<comment><AUTHOR> I could understand not supporting last.fm integration. Sure, they want to sort of kill last.fm anyway.

But the fact there is no scrobbling of played music? That's just silly, what on earth were they thinking? O.o

Honestly, I'd like to know, can ANYONE explain that?

<comment><USER3> Sure. If I had to guess, I'd say that Apple's stretched extremely thin, their products are worked on by surprisingly small teams, they were under time pressure to get this out the door, the culture of secrecy kept them from doing some user testing, and (given the number of small details Ping got wrong) this particular project didn't have strong product leadership with experience in the space.

<comment><USER4> I did no user testing (just did what I thought was obvious), I only had 3 months, I worked by myself (mostly), and my site, <http://like.fm>, doesn't suffer from most of his fail points. I think apple just wanted to add a slight social layer to their store.. You know, to drive sales. I mean if you are one to buy stuff from the iTunes store, you'll probably sign up and follow something. Other people who use the service aren't immediately going to be much value. I mean why else would they make a "social network" embedded in iTunes. You just can't expect something like that to get enough meaningful adoption if it's exclusive to a single platform in a heavily segmented market. So apple wasn't crazy (they just can't be that blind), they just wanted to add a light social layer to iTunes store to boost sales.

<comment><USER5> I wonder if they didn't want to do a Buzz in terms of making all your private information suddenly public, and might ease into features such as scrobbling over time. The amount of spam on there is probably their biggest problem at the moment. It is hard for me to objectively judge as my market segment isn't catered for at all in terms of features. It will be interesting to see what the rest of the population think of it. To me it feels far to much like it has been designed to drive consumption of 'popular' music and 'me too' buying.

EDIT: The top 10 pop chart artists all seem to have around 100k followers, will be interesting to see how it goes.

<comment><USER4> Even if they do ease in scrobbling their "social network" will be crippled by the fact that your Winamp buddy, or Rdio friend, or Linux pal doesn't use iTunes. For Ping to succeed they're going to have to convince users that their platform is dedicated to social music, not enhancing the itunes purchasing experience. So unless iTunes gets every music listener in the world, or darn close to everyone, to use iTunes instead of however they currently listen to music, then their social functionality is going to always be less useful than a platform independent service. A social network gains value with more users (in general), so if iTunes is restricting the flow of potential users it's just going to hurt them.

iTunes could satisfy the iTunes user market. But unless clusters of friends all use iTunes, a decentralized service will be more useful. And i'm not sure if being an itunes user means more of your friends use itunes (to any level of significancy). So chances are most people will have a bunch of friends who can't participate.

</comment></comment></comment></comment></comment></comment><comment><USER6> Next week on Daring Fireball: _Why Ping is much smarter than you think and will prove the naysayers wrong_.

<comment><USER7> Actually, if you're into cool, trendier, up-and-coming, non-mainstream music, Ping is pretty fantastic. The first recommended follow for me was Alexandra Patsavas who is the christener of cool when it comes to indie music. Ping got it spot on. I have no more need for using MySpace. I hate to brand all the naysayers wrong, but frankly they don't seem to share the same musical tastes as I do. I'd like to think I have pretty damn good taste, better than the naysayers :)

The naysayers seem to have wanted a Facebook replacement. I hate FB. Ping is a nice domain-specific social network. It serves a purpose, like LinkedIn. And I quite like it.

<comment><USER8> How can something be cool and trendy while also being obscure and not mainstream? Don't "cool" and "trendy" imply prestige and popularity?

<comment><USER9> No. Cool and trendy mean that something is on the path to being mainstream. When it does hit mainstream, it's passé. :-)

</comment></comment></comment></comment><comment><USER10> You don't get it. Ping is only there to drive up music sales. This is why every single page has Buy buttons. And why the focus is mostly on music from the store and not for example your ripped music is scrobbled.

This is not about music fans. This is a controlled environment to sell more music.

<comment><USER11> Sure, but to sell music you need to sell it _to_ fans. You can't just make a page with a buy button on it, call it a social network and expect it to increase revenue.

Either Apple have something up their sleeve or they're being terribly naive.

<comment><USER12> I think if you're Apple, you probably could create a blank page with a Buy button to increase revenue.

</comment></comment></comment><comment><USER13> While trying to avoid the cliche "Apple sux" explanation, I'm actually genuinely surprised they botched this as badly as they seem to have.

Maybe it's releasing a product without a comprehensive music database being in place. Maybe it's the inability to link to, you know, their OWN PRODUCT a la last.fm and, well, anything.

But really, whoever was in charge of this obviously wasn't being watched closely enough - this is a software foul-up of pretty large proportions.

Plus I like the implication that they don't trust any other form of avatar/username site (Gravatar, etc) and instead you have to take your picture with your cute widdle iCameraAsApprovedByApple and then wait for it to be "approved."

Which makes me feel immensely sorry for anyone whose job encompasses looking to see if pictures violate a ToS agreement, even if it is 10 minutes a day, and even if it is "pre-filtered" by some type of algorithm (surely, please for the love of all things surely).

Overall, depressing.

</comment><comment><USER14> Apple's controlling nature, and desire to be the Disney of the computer world, seem incompatible with the instincts needed to create a successful social network.

<comment><USER15> You've nailed it. All the things that make Apple's business model advantageous – the meticulous scripting, the secrecy, the glossed-over experience – work wonders on hardware. But when it comes to social networks, it's clear that they just don't understand the model at all. Because they can't do ANY of these things and have a successful social network.

</comment></comment><comment><USER16> I was still thinking of giving some credit to Ping when I saw, after being disappointed with all the other features, that you could post a music to your profile. That's something that I quite regularly do on my Facebook profile, simply post a youtube video of some music I like so I can share it with my friends.

I quickly went back to my library, right clicked on a song and searched for some Post button. Unfortunately, as I was soon able to find out, you can only do that inside the ITMS. Of course, some of the songs I have on my library are not in the ITMS, but they could still figure out an automatic way of matching the artist and track name, ask me if one of the matched songs is the one I'm talking about and post it.

As a result, Ping, instead of being that brilliant last.fm killer idea we all envisioned when we heard about it of bringing a music social network to the actual music player people use, is just a webpage poorly stamped to my music player, with absolutely no integration with my library.

Even Last.fm, a 3rd party social network has more integration with my library then a social network _inside_ my music player. If this makes sense...

P.S.: what I said about Posting is equally applicable for Liking a song. You can't do that in your library and there is also no relation between your 5-star rated songs and the music you actually like according to ping.

</comment><comment><USER17> > And I have no idea who Yo-Yo Ma and Jack Johnson even are.

oooookay.

<comment><USER18> Yeah, this guy not knowing who one of the most skilled cellists on the planet is kinda undermines any of his music-related credibility.

<comment><AUTHOR> And that's worse than Ping not knowing who The Doors are?

<comment><USER19> Or more probably the artist pages are created by the artists.

<comment><USER20> or by labels

</comment></comment></comment></comment></comment><comment><USER21> I'm dumbfounded that they're using iTunes as the platform for this thing. Not having it exist as a website is retarded beyond belief. I really hope this isn't the fruit their Lala acquisition is bearing, because if it is it makes me even more angry that they killed one of my favorite web apps. They should have just rebranded lala as Apple Ping and been done with it. Huge fail so far.

</comment><comment><USER22> Usually, Apple does a very good job of masking when a product is designed purely to sell other products. For example is iTunes or the iPod the razor blade? Ping is very sanitized and sterile. For the huge launch they did, there is almost no content preloaded. Plus there is even less freedom then in the app store.

For posterity, I'd like to record the following message:

These comments were all made when ping sucked. I'm sure that, similarly to the iPod launch, Apple will fix Ping and use it to destroy facebook. 10 years from now, all of these comments will look foolish.

Clearly Apple has gotten so good at making winning products they need a fresh and new challenge. They've set the bar very high for themselves.

</comment><comment><USER23> I'll start off by saying that I personally will probably have little use for Ping. My musical tastes are fairly, shall we say, idiosyncratic.

Having said that, Ping seems to be a targeted product, aimed at a particular audience. It is a sales tool for music. If you fit the demographic it will probably work pretty well. My guess is that computer geeks (include me) are not the demographic Steve is aiming for. If you teenager, and listen to whatever 90% of teenagers listen to these days, then it might work quite well for you.

The product's success will not depend on how well people like the typical Hacker News reader like it...

</comment><comment><USER24> Apple is like graphic artists back in the early days of the web. Only experienced in the controlled print environment, the web pages they designed was just images on static pages, but not web.

</comment><comment><USER25> Anyone else get so annoyed by the flashing little dummy avatars at the bottom of the page that they couldn't finish the article? Shame too, I was liking it.

(is that an ad? or some kind of 'social feature'?? Something incredibly ironic about this article if the latter)

<comment><USER26> Explained here: <http://news.ycombinator.com/item?id=1659814>

</comment></comment><comment><USER27> What is that random bar of faceless people on the bottom of the article page?

<comment><AUTHOR> It's LiveNetLife. They're trying to introduce live chatting features into random websites and I thought I'd give the service a try. Mostly because I personally know the founder.

<comment><USER27> Oh. Seems interesting... although the UI could use a little softening up. If there's one thing I agree with Steve Jobs about it's rounded corners.

</comment></comment></comment><comment><USER28> The biggest problem for me is finding artists and people to follow. Why can the Genius feature look at my library and suggest music to buy but in Ping I get 14 suggestions that are all unrelated? Ok, facebook and apple are sorting things out, but why do i have to enter email addresses? Why can't it look at my apple address book and at least let me pick from that? Very messy rollout and I can't help but think apple's secrecy and control is going to burn them here.

</comment><comment><USER29> My one problem is in lieu of adding indy artists, I really wish Ping would replace the alerts subsystem so I could follow any artist. I finally figured out how to comment on albums and here is a link on how to like an individual song ( [http://www.tuaw.com/2010/09/02/itunes-101-liking-a-song- in-p...](http://www.tuaw.com/2010/09/02/itunes-101-liking-a-song-in-ping/) ).

On the wish side: kill suggested follows, allow comments / like audiobooks, follow but do not display in profile artist (guilty pleasure).

</comment><comment><USER30> >>Fail #4 - obviously commercially inspired music recommendations are obviously lametastic.

Is this the best critique of Ping HN could find, a poorly written, rage- infused, explitive-riddled rant fest that one would expect to be found on digg?

Ping came out _2 bloody days ago_! Who would expect that every niche artist would be on this thing not even 48 hours in? I'm very impressed with the mix they got on board pre-launch. Give it a couple of days.

By the way, how many users did Myspace, FB, or Twitter have 2 days in? Let's use our heads here, folks.

<comment><USER31> Considering they've had the whole Genius recommendations in place for quite some time now, their complete failure at recommending relevant artists is pretty bad. I've heard numerous complaints that the recommended artists were nowhere near the user's taste.

<comment><USER30> That's likely because artists who are presently on board Ping represent 1% of 1% of all of the artist data that exist in Genius. If the recommendation engine is giving poor recommendations, it's probably because there is a lack of variety now, and also because it's still learning based on user behavior. Again, nothing that time can't solve.

</comment></comment></comment><comment><USER32> The only one of these that bothers me at all is the dearth of artists on the network. But that alone is plenty fatal. I guess I'll try it again in a month and see how uptake is then.

I'd say it's extremely premature to say it will fail, though. But I guess tech pundits love to jump to conclusions based on opening day impressions.

</comment><comment><USER33> Here is why ping will fail:

I heard about it a couple of days ago, but never really gave it much thought because, honestly, I don't really even know what it is _for_. Streaming music? Better than grooveshark? Not likely if its run by Apple.

After seeing this article (and the one directly below it as of right now), I decided I should check it out.

Hmmm...do I go to ping.com (no, because I'm pretty sure that ping golf clubs aren't going to sell their domain), or apple.com/ping? No, that says "the page you're looking for cannot be found".

Okay, then, duckduckgo it is! Hmm...apple.com/itunes/ping, that is a lot to type...stupid move, apple, whatever.

 _click_

Annnndddd...nothing? I have to launch iTunes to even see what this is?

iTunes, right, the software that won't let me play half of my audio files because Apple refuses to allow flac?

So I have to get out my laptop, open it, launch itunes, _then_ figure out how to get to ping?

The barrier to entry, at least for me, is way to high.

<comment><USER34> Well, that's nice, but they're not targeting you. They're targeting the millions of people that listen to music through iTunes everyday which are likely wondering what their friends are listening to. If you don't use their product, or have very little desire to in the first place, it doesn't qualify as a failure.

</comment></comment><comment><USER35> This article disappointed me. I was expecting a good hacker's rant about /sbin/ping.

<comment><USER36> Exactly :). One nice Slashdot comment:

"That's gonna be awesome for internet help-desk workers. How about creating a Flickr clone and calling it ifconfig?" (Steauengeglase)

</comment></comment><comment><USER37> Just goes to show how out of the loop I am when it comes to Apple. I read the title, wondered if it was about the internet echo test command, and then wondered, how the heck would they screw THAT up??!

</comment><comment><USER38> That the author more or less admits to confirmation bias in the very first paragraph kind of colors their conclusions, regardless of whether Ping actually sucks or not.

</comment><comment><USER39> the really disappointing thing about ping is that unlike last.fm, apple has access to the binary file for itunes and so could provide even more info about your listening habits.

I assume last.fm's scrobbler works entirely from the unencrypted itunes file which only gives play count.

</comment><comment><USER40> An inflammatory jackass who doesn't know who Yo-Yo Ma is and who thinks Apple would ever consider Gravatar support gets this much interest on news.ycomb? And did you notice it's a self-submit? Classy.

Lately it seems like this discussion group has become increasingly anti-Apple. It didn't use to be this way, originally it was far more neutral. I wonder what's changed?

<comment><USER41> > _Lately it seems like this discussion group has become increasingly anti- > Apple. It didn't use to be this way, originally it was far more neutral. I > wonder what's changed?_

HN is frequented by developers. Probably, the increased hostility is at least partly a reaction to Apple's iOS App Store policies.

<comment><USER40> Really? Is there that much ire? Why don't they get over it and dev for android?

</comment></comment></comment><comment><USER42> So Ping won't be available outside of the U.S.? Well, thank f*+k for that!

<comment><USER36> Huh? I am using Ping without any problems from the Netherlands, with a Dutch iTunes account.

</comment></comment><comment><USER43> Stopped reading when he said he didn't know Yo-Yo Ma.

</comment><comment><USER44> I don't know why Apple thought anybody wanted this.

</comment><comment><USER45> Yeah, well... so is Facebook, so is Twitter, so is Windows, so is pretty much everything. Who cares.

</comment><comment><USER46> your itunes account is "hacked"? pimped out, is it? is it lowered too? hellaflush.

no, ping is not very useful right now. I'm sure they'll figure out how to improve it. apple frequently starts with a small wedge and then innovates on top of it.

<comment><USER47> It is worth noting that said "small wedge" has (historically) been a _good_ small wedge. The point is, people seem unconvinced of the magicality or revolutionariness of this particular wedge.

<comment><USER46> people are frequently unconvinced of a lot of things. and that's a good thing. its the fundamental principle of science.

its the reaction and tone that bother me, not the content.

</comment></comment></comment><comment><USER48> So, that settles it: No scrobbling. Less artists than last.fm. Lame. [1]

Looks like ping is another home run.

[1]With all apologies to Rob Malda: <http://apple.slashdot.org/article.pl?sid=01/10/23/1816257></comment>


My First Day Working at Gowalla - <AUTHOR> http://www.thinkbohemian.com/2010/08/31/first-day-at-gowalla/

<comment><USER2> Having a separate break area is often overlook in office layouts but it is essential. It doesn't have to be anything more than a partitioned area of the office where people can set themselves to 'feel free to have a conversation with me' mode.

In an open plan office, you are most likely to eat at your desk, which means you are distracted by email or news infront of you, and are also probably distracting other people who are trying to work.

In a private-office office, you take your food back to your desk and not talk to anybody.

Having a separate or designated lunch area, even in the smallest offices, sets aside a part of the day where you can mix with your co-workers without distractions and without distracting others. I can specifically recall great features and ideas that teams I have worked with have come up with during these little sessions in break areas.

You can also cut down what would usually take 5-6 emails copied to half-a- dozen people into a 30 second conversation over pizza and red bull. Like informal mini-meetings but without the scheduling, agenda or pressure to say something that makes you sound smart.

<comment><AUTHOR> I completely agree infact Jack Cheng wrote a great article about the type of effects our environment has on our habits.

<http://www.alistapart.com/articles/habit-fields/>

</comment></comment><comment><USER3> Sounds awesome dude. Wish I could say the same things about my job. Enjoy it.

<comment><AUTHOR> Thanks! There's a ton of great companies out there, just keep looking (or start your own) I just got really luck and landed this gig!

</comment></comment><comment><AUTHOR> In case you were wondering...my first day was yesterday Tuesday the 31st.</comment>


SF libraries as sanctuaries for the homeless – Hollywood movie captures reality - <AUTHOR> https://www.sfgate.com/bayarea/article/SF-libraries-as-sanctuaries-for-the-homeless-13674982.php?t=9b0889f47d <comment><USER2> Maybe it's unavoidable, but this is very sad to me. A library cannot simultaneously be a flophouse for the homeless and an institution for learning for kids. And unfortunately, in many cities, we've decided that the former matters more than the latter.

I would have been intellectually destitute as a kid had I not had weekly trips to the library. I lived in the middle of nowhere, and there were no adults around who knew anything about what I was interested in. Perhaps the web would now fill that need. Not sure, though. It was a magical place.</comment>


Ask HN: How do you handle 2-Factor Auth accounts while traveling abroad? - <AUTHOR> I'm planning on traveling to Indonesia in a couple weeks and I won't be able to receive text messages while I'm there. So, I'm wondering how I should go about logging in to certain accounts (Gmail, bank, etc.) that have 2FA enabled.<p>Do you have any advice on how I should go about this while I'm abroad? <comment><USER2> Use an app instead of a phone: [https://help.github.com/articles/configuring- two-factor-auth...](https://help.github.com/articles/configuring-two-factor- authentication-via-a-totp-mobile-app/)

<comment><AUTHOR> Sweet! I'll use Google's Authenticator app. Thanks!

<comment> tony-allan OK, that's Google covered!

What about other websites?

<comment><USER2> It's not just for Google.

Google Authenticator works for any site that supports app-based 2FA. Please read the article I linked to.</comment></comment></comment></comment>


Many mint money from MJ's death, michaeljacksonglobaltributes.com for $9,999,999 - <AUTHOR> http://economictimes.indiatimes.com/News/News-By-Industry/Media-Entertainment-/Many-mint-money-from-Jacksons-death/articleshow/4732394.cms

<comment><USER2> I thnk that should read 'attempt to mint money', only a total loser would buy that domain. For any amount of $.</comment>


Tech Salary Stagnation: You're underpaid. Why aren't you mad about it? - <AUTHOR> http://www.theserverside.com/news/thread.tss?thread_id=81424 <comment><USER2> Robert half salary guide says salaries are going up 5-7% year of year, so someone is wrong about salaries.

</comment><comment><USER3> The reason I'm not mad is because on a logarithmic scale, a 10-20% difference is very small. Wage differences don't affect your lifestyle until you start moving decimal points.</comment>


On Computers: First Rule on Updating Software – Don't - <AUTHOR> https://www.telegram.com/news/20200202/on-computers-first-rule-on-updating-software---dont <comment><USER2> Wow, this "article" is tabloid-tier garbage. Seriously; it's the online equivalent of an opinion column in your grandmother's Sunday church newspaper.

Some quotes:

>> "[don't] click on suspicious links and attachments, like Mark Zuckerberg did recently. He opened a video from a Saudi prince and his computer was immediately infected with malware."

Uh, no. That was Jeff Bezos and it was a mobile phone (via Whatsapp), not a computer.

>> "runaround she got from Uber. For starters, she forgot her Uber password. But when she tapped "forgot password?" they sent the reset link to an email address she no longer uses"

How DARE Uber not magically update her email address when she changes it and doesn't inform them?

</comment><comment><USER3> I'm in Germany, on my home connection. When I try to access the website I get the following:

> www.telegram.com - Access Denied

> Error code 16

> This request was blocked by the security rules

> 2020-02-03 16:54:50 UTC

> Origin Server IP N/A

> Incident ID: <redacted>

> Please Note: We are temporarily unavailable to users from certain countries > while we upgrade our site to implement new methods for data processing as > required by applicable laws.

> Powered by imperva

¯\\_(ツ)_/¯

<comment><USER4> Works here in India... Must be a CDN issue?

<comment><USER5> You are not in the EU and therefore the GDPR does not apply to you.

</comment></comment></comment><comment><USER6> EU folks, you're not missing much.

This article has almost no substance beyond the headline. No information supporting it either. It also abruptly changes to the next topic halfway down.

Also, unless Zuck was recently hacked by a Saudi Prince, they are confusing their billionaires. It was Bezos who was compromised using an WhatsApp, which is owned by Zuck.

</comment><comment><USER7> The page claims it's possible to get a free Windows 10 upgrade with a Windows 7 license but I thought that offer was long gone. Does anyone know if that actually still works?

Edit: Apparently it's possible _if_ you've already got Win7 installed. But what if it's _not_ installed but you possess a retail disk and key?

I only need it for Bootcamp and don't want to install 7 then upgrade to 10 via Bootcamp. (I'd be surprised if that's even possible due to the way Bootcamp works.)

Edit #2: It works just fine after all. My Windows 7 (retail) key was recognized as a valid key in Windows 10.

<comment><USER8> it never stopped working. Run the Win10 iso/exe on a licensed Win7 computer, and your Win10 will be activated with Digital Entitlement.

The "this is ending soon" was a scare campaign to get people to upgrade in a timely manner.

<comment><USER9> Or, even better if you want a clean install, just use your Win7 serial to activate Win10. As long as you match edition (Home/Pro), it should work fine.

<comment><USER7> Really? That's great news. I'm off to try it now.

Added: It worked, thanks! It even automatically upgrading my unlicensed Win10 "Home" to Win10 "Pro" since my license was for Win 7 Ultimate.

</comment></comment></comment></comment><comment><USER10> More people should be supporting Linux and the BSDs knowing that support and updates often lasts much longer. They would be great for systems in Doctor's offices and such as noted.

<comment><USER11> Ubuntu LTS releases lose support after 5 years. Windows 7 lost support after 10 years. You can freely upgrade ubuntu, but you can also freely upgrade windows, and windows feature releases remain supported for about as long as ubuntu LTS releases.

Also, windows has very good backwards compat for binaries, you can run decades-old binaries.

<comment><USER10> You should encourage users to upgrade by not having history of things breaking -- it used to not be free, and now it's not free as in freedom with all the tracking built in to the OS. I upgrade my Linux machine multiple times a day because I'm confident that things will be smooth and even when they're not it's usually one package at a time instead of the UI and all APIs changing on a monolithic release cycle. New versions fix up bugs and security, so we shouldn't be rolling with out-of-date software.

</comment></comment></comment><comment><USER12> Since the linked page made the fans spin up on my laptop. Here is a trimread link [https://beta.trimread.com/articles/4006](https://beta.trimread.com/articles/4006)

<comment><USER13> Also, here's a snapshot (of the original page, which is blocked in the EU):

[https://web.archive.org/web/20200203164738/https://www.teleg...](https://web.archive.org/web/20200203164738/https://www.telegram.com/news/20200202/on- computers-first-rule-on-updating-software---dont)

<comment><USER14> That's weird, anyone know why it's blocked in the EU? Edit: Aha, it's probably GDPR-related.

<comment><USER15> That surprised me, until I realised that this was telegram.COM, not Telegram.ORG (the chat).

</comment></comment></comment></comment><comment> y-c-o-m-b I'm still running Windows 7 on my home PC with no plans to upgrade. I've been using Windows 10 on my work laptop for several years now and I absolutely hate it. For me it's slow, not intuitive, dealing with telemetry is annoying, and takes too long to find familiar options.

I've been meaning to switch to a Linux distro for good, but each time I run into some kind of driver problem that makes me go back to Windows. I'll just have to suck it up one of these days because I refuse to upgrade my home PC to that heap of trash Windows 10.

</comment><comment><USER16> Some software I update. Some I do not. It depends on whether I suspect or have history of updates taking away or breaking features. Generally I update.

<comment><USER17> Yeah, that's pretty much how I roll.

I apply security-only updates pretty much automatically. If an update contains nonsecurity changes, then I wait until enough others have applied the update that I feel I have a good handle on what the update is actually doing. If it seems harmless, then I'll apply it.

If it changes features, functionality, or the UI, then I need to reevaluate the update as if it were new software. That takes me a little longer to do, so that adds additional time before I decide what my response to it will be.

</comment></comment><comment><USER18> Here's a website whose handling of private data is so bad that it's literally illegal in large parts of the world.

</comment><comment><USER19> What the hell is this? This is not the calibre of content I expect from HN.

<comment><USER20> I believe it was posted here and upvoted so that people can mock it. Either way, this is not the type of thing I come to HN for.</comment></comment>


An Empirical Study of Cryptographic Misuse in Android Applications [pdf] - <AUTHOR> http://www.cs.ucsb.edu/~chris/research/doc/ccs13_cryptolint.pdf

<comment><USER2> This is great: interesting systems research (reconstructing CFGs from bytecode, converting to SSA, discovering type constraints for registers, and slicing to find which code influences which registers) and a good starting point for crypto security.

I'm particularly happy to see them pointing out how easy it is to end up with ECB mode, which allows attackers who can merely influence plaintext to decrypt messages a byte-at-a-time, "Hollywood-style". ECB is for Java the de facto default, the one you get when you ask the JCE for "AES" without specifying a block mode. This is no surprise: the other modes all need IVs and nonces, and so libraries give you the one that doesn't need more options when you don't tell it to. It's for this reason that we call ECB "the default mode"; it's a quirk of ours, but a useful one. Don't use the default mode.

Here's the list of things they looked for:

1\. Don't use ECB

2\. Use random IVs for CBC mode (if you don't, you end up with ECB-like properties for the first blocks of messages).

3\. Avoid constant encryption keys (if they're constant, they're trivially discoverable by attackers, and encryption is cosmetic).

4\. Avoid constant salts for password-based key generation (so that attackers can't precompute tables).

5\. Use at least 10,000 iterations for your KDF to slow down brute force attackers.

6\. Don't pass static seeds to SecureRandom, which can have the side effect of turning off cryptographic randomness, destroying the security of your system.

The one thing I'd caution readers about is to understand the limitations of this analysis. The authors are demonstrating the power of a particular static analysis technique, and also providing a useful survey of just how bad app crypto is (over 80% of the thousands of apps they tested flunked these basic tests!).

But that list above isn't "The Six Commandments" of good crypto; it's missing extremely basic stuff, like never encrypting without authenticating, never repeating a nonce or counter, &c. We set out to build challenges to capture things we'd seen going wrong in real cryptosystems we'd tested, and we have more than 64 of them now.

<comment><USER3> One of the many mistakes by Adobe revealed in the recent hack was their use of ECB to encrypt passwords.

The basic problem with ECB is the same input always results in the same output. And this applies not only to the entire input but specific subsections of the input, known as blocks. This leaks substantial information.

In the Adobe leak accounts with identical passwords were easily identified as they had the same encrypted password. Frequency analysis can then be applied to find common passwords ("123456" is often the most common...). Even worse Adoble also leaked the password hints so you often had thousands of different hints to help you guess a single password.

Of course you should not even be encrypting password in the first place (use a cryptographic hash with an individual cryptographically random salt for each password NO! SCRATCH THAT. JUST USE BCRYPT!) but that's another issue...

[http://nakedsecurity.sophos.com/2013/11/04/anatomy-of-a- pass...](http://nakedsecurity.sophos.com/2013/11/04/anatomy-of-a-password- disaster-adobes-giant-sized-cryptographic-blunder/)

[http://en.wikipedia.org/wiki/Block_cipher_mode_of_operation#...](http://en.wikipedia.org/wiki/Block_cipher_mode_of_operation#Electronic_codebook_.28ECB.29)

Edit: Corrected based on tptacek's comment below.

<comment><USER2> Salted hashes are a very poor way of storing password authenticators.

[http://codahale.com/how-to-safely-store-a-password/](http://codahale.com/how- to-safely-store-a-password/)

There are much more significant problems with using ECB than simple frequency analysis suggests.

<comment><USER3> I kinda expected you to correct me. You can't help yourself can you. :) And that is a good thing. Thanks!

Sorry I was not trying to give the entire recipe for password handling. I was assuming a KDF with lots of iterations. But perhaps you could clear up one thing:

Assuming proper implementation (I know a big assumption) how is bcrypt better than PBKDF2 with lots of iterations using a good hash and salt? At some bcrypt cost and PBKDF2 iteration count wouldn't they be equally secure?

<comment><USER2> PBKDF2 is straightforward to accelerate in commercial off the shelf hardware, and bcrypt isn't. But both are fine. Neither are "salted hashes".

<comment><USER3> I guess I had my terminology wrong you would know better. I always thought of PBKDF2 as simply "iterated hashing of a salted password".

<comment> B-Con Your mental model isn't necessarily wrong.

The phrase "salted hash" generally refers to something more plain than PBKDF2. PBKDF2 is technically a "Key Derivation Function", but it can also be used as a "Password Hash Function". Password Hashes generally use a hash function and a salt, yes, but they also incorporate other important factors as well, commonly a work factor and some "hard" computational problem, so it's unfair to call them merely a salted hash. PBKDF2, along with password hashes in general, do indeed do everything a "salted hash" would do, but importantly, they also do more.

</comment></comment></comment></comment></comment></comment></comment><comment><USER4> Their list of Rules is out of order and that may affect Table 3. Mainly I'm wondering it there really are that many programs that use constant keys (e.g. is Rule 3 in the table really Rule 3 from the text since that's called out as rule 3 below.)

Of course it wouldn't suprise me one bit of there really are that number of applications that use constant keys.

</comment><comment><USER5> Excellent study! I know it's not exactly easy to do with their analysis framework but I'd be interested to know how many apps just ignore certificate errors. It's a depressingly common "solution" on Stack Overflow..

</comment><comment><AUTHOR> OK, sorry about the custom title, I got it from there: [https://twitter.com/csoghoian/status/398336912181579776](https://twitter.com/csoghoian/status/398336912181579776)</comment>


Ask HN: Online book of accomplished software engineers writing short programs? - <AUTHOR> Hi, I'm looking for a blog / online book that is a number of well known accomplished software engineers writing pretty short programs of real world applications, i.e. a browser, a net parser, an interpreter. Thanks <comment><USER2> Take a look at 500 lines or less[1] and in fact the entire aosa collection[2] is worth reading.

[1] [http://aosabook.org/en/buy.html#fh](http://aosabook.org/en/buy.html#fh)

[2] [http://aosabook.org/en/index.html](http://aosabook.org/en/index.html)

<comment><USER3> Looks like there's an official free web version as well.

[http://aosabook.org/en/index.html](http://aosabook.org/en/index.html)</comment></comment>


The FCC Just Redefined Broadband So Expect Faster Internet - <AUTHOR> http://gizmodo.com/fcc-redefines-broadband-to-bring-you-faster-internet-1682516928 <comment><USER2> "About half of Americans in rural areas don't have access to 25 Mbps down/3 Mbps up speeds, meaning that they can't take advantage of a lot of the internet's best goodies (read: streaming video)."

I agree with the sentiment. However, you don't need 25mbps to stream Netflix at high quality. My brother lives in a very rural part of the country, has 15mbps cable service, and streams Netflix, Hulu, and Prime perfectly well. In fact according to some threads on HN, people report being able to do that with ~5mbps just fine.

The only thing I'm aware of today that average consumers need, say, 50mbps for is numerous simultaneous streams (gaming in one room, hulu in the next, netflix in the next). This isn't to say the US shouldn't have drastically faster broadband mind you.

So while it's great to shove the telecom companies to higher speeds, there's no sense in gizmodo pretending 25mbps is some magic cutoff point, where below that you just can't "take advantage of a lot of the internet's best goodies." I consider it unfortunate that there are not more services that actually need 50mbps type speeds, to provide _a lot more_ consumer-driven anger about being left out.

</comment><comment><USER3> Where I live (just outside a very small town in Ohio) there are a few options, but they're:

1) The phone company

2) Satellite bundled with TV service, with an absurd data cap and high latency

3) Line-of-sight wireless. If it rains, it stops working

There's a cable company but their lines end just short of this road.

The only one that is both reliable and usable in practice is the phone company.

It's DSL with a possible max of 10Mbps down, but the actual line sync rate is 4Mbps, partly because the copper lines are quite long (it's amazing it can even hold 4Mbps looking at the line stats in the modem).

But it tends to be capable of sustaining that rate 24/7, there's no throttling at specific times etc. There is a soft cap of 250GB buried on their website, but pfSense routinely shows 1.5x-2x that sometimes and I've never heard them complain.

Netflix and Hulu work fine, but they're being prioritized by pfSense. Without it, if someone is watching a short Youtube or Facebook video elsewhere in the house, it will cause Netflix or Hulu to react by cutting bitrate severely (if possible. Apple TV will just pause and buffer).

It costs $120/month, and their breakdown shows only $39 of that being internet related.

</comment><comment><USER4> In my (parents') experience, the problem with the internet connections available in rural areas is not the speed, but monthly data caps. You can get satellite internet service that is fast enough to use Netflix, etc., but you'll hit the cap so fast that it's not really usable.</comment>


These guys are building a startup and Live Streaming it - <AUTHOR> http://ustream.com/channel/backly

<comment><USER2> This is pretty cool. They are coming up with ideas for their tag line and people in the chat room are coming up with some good ideas.

"Team up with your customers"

"Give back to who has your back"

"Who's got your back?"

"Backly is an application that provides a platform for bands, startups and big companies to reward their fans with insider and exclusive info, contests and awesome swag."

</comment><comment><USER2> FYI for everyone who keeps asking what is backly. They seem to be repeating something along the lines of:

"Backly is a way for a business to reward the supporters of their business, by backing us you get an incentive"

<http://backly.tumblr.com/> \- their blog

</comment><comment><USER3> As much as a I could keep up with his fast talking: "Backly is a way for businesses to reward the supporters of their brand and business. It's more of a close connection between a business and a consumer rather than just have them follow them on twitter[...]"

</comment><comment><AUTHOR> Thanks for the awesome comments guys! This has been an incredible experience for us. We had no idea we'd get so much support and great feedback/interaction with our viewers. Amazing! Our viewers have helped shape this product. :)

</comment><comment><USER4> I like this concept. Obviously not the most exciting thing to watch, but observing the thought process of another team valuable. I just have the audio going in a hidden tab at the moment.

<comment><USER5> You're not annoyed by the repetitive ads? I had to close the tab. Anyway, I'm busy working on my own stuff. Was nice to dip in briefly though...

</comment></comment><comment><USER5> It's a way for business to reward supporters of their brands apparently. I like the idea. And this is a great way of gaining a bit of publicity.

</comment><comment><USER6> This is just startup porn. Do something yourself.

<comment><USER7> Honestly, I love it. I have it running in a window adjacent to my work. It's nice to be able to see other people working while I'm working from home too. I have the sound turned down low though to prevent it from stealing my focus.

For the first time I've figured out the value of hacker spaces. I almost wish that hacker spaces would have cams like this, or more people would do something similar to this.</comment></comment>


Samsung's 'Linux on DeX' project shuts down after just 11 months - <AUTHOR> https://www.androidpolice.com/2019/10/18/samsungs-linux-on-dex-project-shuts-down-after-just-11-months/ <comment><USER2> Dupe? [https://news.ycombinator.com/item?id=21298796](https://news.ycombinator.com/item?id=21298796)</comment>


Creating a Bootable USB Drive with UEFI Shell - <AUTHOR> https://github.com/chipsec/chipsec/wiki/Creating-a-Bootable-USB-drive-with-UEFI-Shell <comment><AUTHOR> The idea that led to the above link is as follows:

"Someone has probably written an open-source UEFI/EFI shell by now... Something like that might be interesting for interacting with my laptop's UEFI at a lower level..."

It turns out someone did.

In this case, TianoCore/EDK2's shell (but I'm sure there are others):

[https://github.com/tianocore/edk2/blob/UDK2018/ShellBinPkg/U...](https://github.com/tianocore/edk2/blob/UDK2018/ShellBinPkg/UefiShell/X64/Shell.efi)

Related:

CHIPSEC: Platform Security Assessment Framework:

[https://github.com/chipsec/chipsec](https://github.com/chipsec/chipsec)

Getting started with bare-metal assembly:

[https://johv.dk/blog/bare-metal-assembly- tutorial.html](https://johv.dk/blog/bare-metal-assembly-tutorial.html)

Linux* UEFI Validation Project (LUV):

[https://01.org/linux-uefi-validation](https://01.org/linux-uefi-validation)</comment>


Show HN: Hotspot 3D – Compare Phones with WebGL - <AUTHOR> https://www.hotspot3d.com/ <comment><USER2> Nice touch, especially on two subtle items:

1\. The centers of rotation aren't fixed, i.e. when you see the side profile, they're much closer together. I think this makes it easier to compare them side-by-side, especially when trying to compare thinness.

2\. Rotation is restricted to only two axes (vs. all three). It's surprisingly difficult to control a 3-axis gimbal with only 2 axes on a screen. For those who aren't familiar with 3D CAD/modeling, try orienting this gimbal simulation [0] in an arbitrary angle (or doing a barrel roll). Restricting it to two axes also keeps the models from going into orientations that probably aren't very useful for the user.

I don't know the first thing about "3D UX," but I thought they were good, albeit subtle, interface decisions.

[0] [http://www.ctralie.com/Teaching/COMPSCI290/Materials/EulerAn...](http://www.ctralie.com/Teaching/COMPSCI290/Materials/EulerAnglesViz/)

<comment><AUTHOR> Thanks for the nice words: it is actually pretty tricky to get this right. What works on "paper" often feels very weird in reality. Restricting the navigation in this way allowed us to minimize the chance that you get lost in a weird pose and it also makes sure that the phones will always stay within a certain region of the screen.

</comment></comment><comment><AUTHOR> Hi, I'm one of the team at Binkies3D over in Holland. We just launched Hotspot 3D today. I hope you enjoy it as much as we enjoyed making it. :)

Whilst there are websites that let you compare the specs of phones, we wanted to compare the shape and size. There are currently 19 phones on Hotspot 3D, but we actually have the models for many more. We just chose the most popular ones for now.

It's especially difficult to tell the difference between 'plus' models without a physical reference, so that is where this idea came from.

The phones themselves are around 1.5MB each and are rendered using our own custom engine in webGL. The java-script itself is only 40kb, and works on mobile as well.

Thanks for taking a look, and I would love to hear any feedback or comments you have.

<comment><USER3> I love the lighting effects. Is that a diffuser umbrella showing up in the reflection?

Is it possible that the Hotspot version will ever contain a comprehensive catalog, or would that dig into sales of the main product? Could you add a back-catalog to Hotspot without impacting sales?

Can you handle phones with moving parts? e.g. QWERTY sliders like the Xperia Mini Pro, or addons like "Moto Mods" or the Essential PH-1 360 Camera.

Are you in discussion with any of these "websites that let you compare the specs of phones"? That sounds like a great match.

1.5MB sounds a bit large when most phones have quite simple geometry. Where does the file size come from?

<comment><AUTHOR> That is indeed a diffuser umbrella :) If you count all color separably we currently have over 1500 phones in our catalog. We plan to add these to Hotspot and also make sure that new phones are available on the Hotspot website close after launch. We will probably announce new releases on our Facebook page.

Moving parts is something we have experience with but have not included in the current version.

1.5MB might indeed sound a lot if you compare it to a single image. On the other hand if you look at a regular 360 viewer this takes often about 10MB of data. Also we want the phones to look really (really) good. This means that we need to put quite a lot of detail into things like corners and buttons.

</comment></comment></comment><comment><USER4> I'm confused. I wanted to reply some people I know from college did the same and turned it into a company, Binkies3D [0]. Only to notice the user who shared the article after. This is the same thing? Judging by your Twitter it is. It's been a while! Nice to see you finally managed to find the right market :).

On-topic. Still awesome to flip around. I like how the compare mode is made to smartly position the two phones based on viewing angle so they align best for the comparison you likely want to make for that angle.

[0] [https://www.binkies3d.com/](https://www.binkies3d.com/)

<comment><AUTHOR> We are the same company, although I started working here about 6 months ago. This is a brand new site we have just launched. The phones themselves, we did already have a few of them, but the P20 models just got announced by Huawei today.

The core team is about 10 people, and we do projects like this every now and then. :)

</comment></comment><comment><USER5> Why is this flagged?

<comment><USER6> My thoughts exactly, and what's even more confusing is that I can't vouch for it[1]. Almost as if [flagged] were part of the title. But it isn't, since when viewing it without logging in (through incognito) the [flagged] is a lighter color than the rest[2].

[1]: [https://cl.ly/qTJu](https://cl.ly/qTJu)

[2]: [https://cl.ly/qTHm](https://cl.ly/qTHm)

<comment><USER7> The "vouch" link only appears for [dead] submissions and comments. If you believe a submission has been flagged in error, you can email the mods via the Contact link in the footer.

</comment></comment></comment><comment><USER8> This is pretty cool! I would love it if you could create custom-sized objects by inputting basic dimensions (l x h x w). It's hard to grasp the size of e.g. different powerbanks just by reading the numbers.

<comment><AUTHOR> Have you tried comparing it to the credit card? The size of these kinds of cards are pretty standard internationally.

<comment><USER8> Sure, but that's not as helpful as if you could compare two powerbanks directly, or comparing it to your phone.

</comment></comment></comment><comment><USER9> I'm sooo impressed with the quality of the models! Have you considered showcasing using farious AR platforms, like ARKit or snapchat's Lens studio? I am developing stuff on lens studio and I think it's a great way to advertise!

<comment><AUTHOR> We would love to :)

</comment></comment><comment><USER10> This is done so well. I currently work at a phone comparison company and permalinks would allow us to tweet about the difference in sizes etc. Pictures just aren't as cool. Nice work

</comment><comment><USER11> Loading was really really slow for some reason. I'm in SF, could that have anything to do with it?

<comment><USER12> It's very quick on my phone in Australia, so it has to be your PC, lol!

</comment></comment><comment><USER13> It looks very nice.

Congratulations, one of the few times I see a worthwhile use of WebGL beyond games.

<comment><AUTHOR> Thank you for that very considerate compliment!

</comment></comment><comment><USER12> Great stuff, looks great and works great on my phone too.

Just needs more models in there...

<comment><AUTHOR> We will :) Please follow one of our social channels so we can keep you up-to- date.

</comment></comment><comment><USER14> A nice-to-have option would be switching to isometric perspective.

<comment><AUTHOR> Can you explain what would offer this to you: we are happy to learn and take this into consideration!</comment></comment>


Show HN: Rain Relax – Early Access Beta - <AUTHOR> https://play.google.com/store/apps/details?id=com.redwire.rainrelax <comment><USER2> Why does it need all these permissions?

This app has access to:

Photos/Media/Files

modify or delete the contents of your USB storage

read the contents of your USB storage

Device ID & call information

read phone status and identity

Storage

modify or delete the contents of your USB storage

read the contents of your USB storage

Phone

read phone status and identity

Wi-Fi connection information

view Wi-Fi connections

Location

precise location (GPS and network-based)

approximate location (network-based)

Other

full network access

view network connections

control vibration

<comment><AUTHOR> Hello masonic, I've been checking, permissions are necessary for the following: \- Storage: The application can be shared with friends, for example by whatsapp, facebook, twitter, etc ... \- Phone status: The application is in 2 languages, to know which one to load, need to know what language your device uses. \- Location: Admob needs it \- Netwotk: It's for admob

In addition, the permissions are not activated, because it only uses what is necessary, such as to share the app with friends via twitter if you wish, you can try and see it for yourself in the permissions once installed. The application uses it locally to work, it is not shared, for this I use a privacy policy.

<comment><USER2> If the permissions are "not needed", then remove them.

This is a ridiculous amount of unnecessary exposure.</comment></comment></comment>


After Investing $1B, Solyndra's Backers Finally Lose Their Grip - <AUTHOR> http://blogs.wsj.com/venturecapital/2011/08/31/after-investing-1b-solyndras-backers-finally-lose-their-grip/

<comment><USER2> Wow, and they took $1 billion in VC funding with them. Think of all the startups that could have helped.

</comment><comment><USER3> Taxpayers also lost over $500 million, thanks to the U.S. government's crony capitalist "green" subsidized lending program.</comment>


Show HN: FlipBits, the best random powered AI to take decisions - <AUTHOR> https://maxwellito.github.io/flipbits/ <comment><USER2> Nice. This reminds me of the "Hang the DJ" episode of Black Mirror.</comment>