Bitcoins get physical - <AUTHOR> https://www.casascius.com/ "Each Casascius Bitcoin is a collectible coin backed by real Bitcoins embedded inside.  They come in two denominations: 1 bitcoin, and 25 bitcoins.  Each piece has its own Bitcoin address and a redeemable "private key" on the inside, underneath the hologram."<p>One big weakness is they seem to be "single use" though, as they need to be torn open to be used. <comment><USER2> A private key that someone else printed out and stored in a coin is no longer private.

</comment><comment><USER3> I think they have value for collectors and for playing poker with friends.

I think that at this moment, bitcoins have potential for eCommerce but not much penetration on real shops and retailers.

I don't see people going Scrooge McDuck crazy and piling these coins in huge vaults but still, the inception of physical coins and bills make bitcoin more flexible. For example, they can be traded when there is no connection available.

Maybe in the future you will be climbing the Himalayas and a little monk will be there selling hot tea and enlightenment but he only accepts bitcoins since Buddhists are keen on the "money is an illusion" thing. Unfortunately, your AT&T iPhone 18S will have no coverage and you will be thankful for your bitcoin coins... (and, yes, this is a joke).

</comment><comment><USER4> It's an interesting souvenir and definitely nice to look at, but once you spend your BTC online, the intrinsic value (the BTC) and the store of value (the coin) become separated, and the coin becomes worthless. In fact, I don't even know how money would get exchanged... if you gave someone the coin, it still doesn't confer ownership. It's essentially an anonymous IOU, meaning it has no value.

<comment><USER5> _> if you gave someone the coin, it still doesn't confer ownership_

It does because the coin has the private key. Maybe it's better to think of it as a key to a (public) safe. The key represents the right to open this safe. So, by giving you the key, I give you the ownership to the content of the safe. (However, if I have another copy of the key it get's problematic.)

 _> It's essentially an anonymous IOU_

Which is exactly the same as normal cash. The only difference is that you can destroy them without really loosing the money. So you have a worthless piece of metal. You can do the same with your normals coins (eg. melt them down), but then the worth is just gone ;)

<comment><USER6> except I can't write down the serial number of my hundred dollar bills, give the bills to you and then spend them myself.

<comment><USER7> I think this is why you don't load them yourself. Essentially it is this company backing the coin, not you. When they send you a loaded coin it probably won't be loaded with the coin you bought it with.

Another interesting property is that unlike a bank they cannot issue more money than they have assets, as each coin is linked to a unique private key. (assumes they are not just a one-time scam)

<comment><USER6> Casascius makes no mention of backing the coin whatsoever. You have to verify it upon receiving it unless you don't really care.

</comment></comment></comment></comment></comment><comment><USER8> wow, economics aside, i _love_ the motto "vires in numeris" (= "strength in numbers")

whatever becomes of bitcoins, for the first time in a long time i've felt like i live in the future.

</comment><comment><USER9> Even if you trust the coin issuer 100% to not keep a copy of the private key, these sorts of schemes only work until anyone anywhere counterfeits the first BitBill or Casascius coin.

At that point, it becomes necessary that all of the other physical tokens in the world must then be immediately destroyed on redemption and validated as a normal network spend... Which defeats the purpose of these transferable tokens to begin with.

The tamper seal doesn't help. You might as well just print out your own private keys as QR codes, the person accepting them will need Internet access to verify+transfer them, just as now with these "tamper-evident" systems.

<comment><USER10> What do you mean by counterfeiting? Do you mean selling coins online that don't have real codes? Because you certainly couldn't pay for goods with a counterfeit coin, since they're instantly verifiable.

<comment><USER9> I could buy one of these coins, then make a thousand coins with the public key of that one coin on it, with nothing inside the tamper-seal.

The moment I start circulating them, this now means that everyone who wants to accept these coins needs to destroy them, reveal the private key, and transfer those coins.

That defeats the purpose of the whole tamper-evident system - the idea behind it is so that they DON'T need to be redeemed.

<http://lesswrong.com/lw/ne/the_parable_of_the_dagger/>

They are _not_ instantly verifiable without destroying the coin.

</comment></comment></comment><comment><USER11> Good for casascius (profit), good for bitcoin (new users). Poor choice for meaningful commerce (hassle, dubious, costly).

</comment><comment><USER12> The main problem is that you have to trust the person who minted the coin not to extract the value of the coin while it is in circulation. Eventually it should leave circulation, be converted back to virtual, and transferred to a safe address that minter doesn't have access to.

So, the thing that it is printed on should be really cheap, like card stock or just paper. It shouldn't be considered currency, but more like a check. People accept a check on the assumption it won't bounce because they know the person who signed the check to them.

When you get one, it should be off the person who wrote the check, and you should cash it immediately (transfer it to an address you trust).

I could see keeping a few business cards in my real wallet with public and private keys on them with empty addresses. I can load them on demand from my cell phone, and write the amount and sign them when I hand them to someone. This way I can give them money without them needing a digital device handy. I could even do this in advance in a few denominations for completely offline access, but it would still require the trust of two individuals on the same level as writing them a check.

In this case, obscuring the private key would be pointless since both people would have access to it.

Here is a good resource for printing address: <https://www.bitaddress.org> It has QR codes on it, so you can use the Android app to scan the pub key and transfer money to it. The addresses are generated client side with your browser, so they should be safe from snooping.

</comment><comment><USER13> What's the point? That just defeats the whole philosophy of anonymous cryptocurrency and... 25 physical BTC = 29.50BTC!! You loose money if you buy physical coins...

<comment><USER14> > You loose money if you buy physical coins...

Gold and silver coins also cost more than spot.

<comment><USER13> That's why gold and silver isn't used for coins anymore (except for special limited editions). Nowadays fiat money coins face value is much more than the material of which the coins itself are made.

<comment><USER15> Not always: [http://en.wikipedia.org/wiki/Penny_debate_in_the_United_Stat...](http://en.wikipedia.org/wiki/Penny_debate_in_the_United_States#Arguments_for_elimination)

</comment></comment></comment></comment><comment><USER16> Similar to bitbills.com, but definitely prettier :)

</comment><comment><USER17> It'd need some encryption+verification like a QR code that can easily be scanned with a phone, which would open up a website, contain an encrypted key and then decrypt and run block explorer to verify without revealing the key.

</comment><comment><USER18> The simple fact that "people like to peel stickers" will be this project's demise.

</comment><comment><USER9> I wish he'd invested the time/effort into producing something useful or cool that I could buy with bitcoins instead of these. I like the checkout system - just address and bitcoin payment.

</comment><comment><USER19> This just feels wrong. Physical coins provide peer-to-peer non-anonymous transactions instead of distributed anonymous ones, that is what Bitcoin is about.

<comment><USER20> FYI: Bitcoin is not anonymous unless you are a miner or pay cash. Even then, you can still be tracked and located if necessary.

</comment></comment><comment><USER21> this seems to open a whole new door for double-spending and other forms of counterfeiting. nothing seems to stop me from buying a physical coin, then transferring the digital coin to my mtgox account but still spending the physical "coin".

to guard against this, you need to check block explorer for every coin that you were going to spend with a physical merchant, I think?

<comment><USER7> The private key is stored under a special hologram sticker, which is tamper evident. It should be obvious if the coin was digitally transferred.

<comment><USER21> obvious if you have an internet-connected computer present at every point of sale? -- oh nevermind I was mistaken, I get it now. neat.

<comment><USER22> Obvious if the hologram has been tampered with.

</comment></comment></comment></comment><comment><USER23> I don't get it. If I recieve a physical bitcoin, how do I know it was not previously "redeemed"?

<comment><USER24> To redeem the coin, you have to peel back a sticker. The hologram for peeled coins takes on a honeycomb appearance according to the link.

<comment><USER23> Oh, that makes sense.

So it is sort of "centralized" with the hologram makers, right?

</comment></comment></comment><comment><USER25> Does a pile of eight bitcoins equal a bytecoin? If so, then a single bitcoin would indeed be "a bit", because: "In the U.S., the "bit" as a designation for money dates from the colonial period, when a common unit of currency was the Spanish milled dollar worth 8 Spanish reales. As a way of making change, these dollars were cut into eight pie-slice shaped pieces which were called "bits". (For this reason, the whole coin was known as a "piece of eight".) Each eighth-dollar bit was then worth 12.5 cents, "two bits" was a quarter of a dollar (25 cents), "four bits" was a half-dollar (50 cents) and "six bits" was 75 cents."

<http://en.wikipedia.org/wiki/Bit_(money)#United_States>

</comment><comment><USER26> I don't care about technicalities, the coins look awesome.

Is this really meant to have any practical use? Looking good is the main purpose IMHO. I'm ok with that.</comment>


Ruru: native Ruby extensions written in Rust - <AUTHOR> https://github.com/d-unseductable/ruru <comment><USER2> Interesting. Wonder how it compares to Helix [1].

[https://github.com/rustbridge/helix](https://github.com/rustbridge/helix)

<comment><USER3> I am slightly disappointed by Helix. They pushed an alpha version, made a good and extensive blog post on it and everything it's going to bring to the table, and got us all excited.

More than a month later there are obviously some bug reports and pull requests that have been opened. There hasn't been a single answer or acknowledgement from the team behind Helix. Not a single commit either.

I get that this is open source software and that they might suddenly not have any time to put on it, but at least an acknowledgement of the situation somewhere or getting some help from contributors would have been appreciated.

</comment></comment><comment><USER4> Looks like the repo hasn't been updated in over a month. This project looks interesting. Anyone know if this is still being developed?

In fact, every crate I can find in this category (Helix, ruru, rurust, mrusty, and ruby-sys) is looking a little abandoned. rurust was updated 25 days ago, and that's the most recent.

<comment><USER5> It's summer! People are doing things with their lives.

<comment><USER4> Wait, people have social lives outside of reading HN? I find this information disturbing.

</comment></comment></comment><comment><USER6> I wonder how it handles memory management. I just wrote an article about how memory management is handled with Ruby C extensions. It involves some gnarly platform-specific tricks like scanning the C stack looking for "VALUE" pointers (ie. C pointers to Ruby objects). Also Ruby makes you implement a "mark" function to trace references the Ruby interpreter doesn't know about.

[http://blog.reverberate.org/2016/06/12/native-extensions- mem...](http://blog.reverberate.org/2016/06/12/native-extensions-memory- management-part1-ruby-mri.html)

I wonder if this works the same for Rust.

</comment><comment><USER7> What would it require the whole Ruby to move to Rust from C? What would it bring and would it make sense?

<comment><USER8> Probably a lot of work. It would bring the same things that most rewrites do: Cleaner code in most places and probably some performance due to understanding problems better the second time around. If you were doing the rewrite for performance, it wouldn't be worth it. If you were doing the rewrite for a more modern language to attract more contributors, it might be worth it.

I don't think Ruby as a language has had many issues in the space that Rust tends to solve (safety related to memory). Ruby is garbage collected. I don't know what (if any) performance boost the VM would get by being converted to LLVM IR. It's mostly the semantics of Ruby the language that make it hard to make fast. It seems most of the recent efforts to make Ruby faster have been by making the runtime do less allocations.

<comment><USER9> > I don't know what (if any) performance boost the VM would get by being > converted to LLVM IR

Well you can already convert the VM to LLVM IR today by compiling with clang.

<comment><USER10> This is an interesting idea. If you transpile the Ruby runtime to LLVM-IR you can run Ruby's IR in LLVM's tracing JIT mode.

Theoretically the LLVM will optimize your application as its running.

P.S.: I don't know Ruby so YMMV

P.P.S.: If it works with Ruby it'll work with Python too.

<comment><USER9> We do this to run Ruby C extensions on the JVM - compile the extension to LLVM IR instead of native code, then JIT compile the IR using the JVM's JIT. It's fast!

<comment><USER11> Huh? You use the JVM's JIT to compile LLVM IR? How does that work? Isn't it a bytecode compiler?

<comment><USER9> Well yes but at some point in the pipeline the byte code is long gone. So you can use it for anything by using just the parts beyond that point.

But really we don't directly compile the IR. We have an interpreter for IR, and we JIT compile the interpreter, sort of constant folded with the IR. It achieves the same thing without getting more technical.

[https://github.com/graalvm/sulong](https://github.com/graalvm/sulong)

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> Why is it many of the Ruby Communities have decided to argument Ruby with Rust, rather then something much more similar to Ruby like Swift or Crystal?

<comment><USER13> Likely because people in the Ruby community tend to favor solutions that allow them to continue writing Ruby. In the context of the OP, Rust is being used only to augment Ruby, to complement it, not to outright replace it. Adopting Swift or Crystal would involve rewriting much more code from Ruby into the new language.

Look at it this way: for these programmers, the choice isn't between Rust and Crystal, it's between Rust and C. And for people who've never written systems code before, Rust is enormously friendlier.

<comment><USER12> Sorry I wasn't being clear in the first post. I meant argument Ruby with Rust.

Yes the Choice is pretty much something to replace / use instead of C. Which Swift as well as Crystal can be used in here too.

<comment><USER13>
      > Swift as well as Crystal can be used in here too

Can you elaborate? I don't know of any way to compile Swift or Crystal code into a library that exposes a C-compatible ABI, and I can find no documentation as such.</comment></comment></comment></comment>


Disappearing messages for Signal - <AUTHOR> https://whispersystems.org/blog/disappearing-messages/ <comment><USER2> I love Signal and this seems to be a stab at Wickr since from what I've heard that is the reason people prefer it to Signal sometimes. Having said that, it has a couple of problems:

1\. Images are downsampled without warning. There should be some sort of warning or mini info box for the times when the images are downsampled and there should be information about the changes in resolution.

2\. If one uses it as the main messaging app, one has to search through history sometimes. But there is no chat search feature. I am forced to scroll all the way up and copy the message data to an editor. Even really basic case insensitive search would be great.

<comment> drew-y It'd also be nice if the iOS or Chrome client had a chat history backup feature like they have on android. This is one of my biggest complaint with messaging apps in general. I'd like to be able to preserve and archive my chat history with people close to me.

<comment><USER3> What if the person you're chatting with does not want it archived? (I'm not questioning, but wondering what a protocol would be)

<comment><USER4> Suppose that you are chatting to me. You don't want your messages archived in any way.

I really want to keep records, so I have a second device, and take a picture of the screen every time I get a message of you.

There is no software or protocol that can entirely eliminate this human problem. The two parties have to have some level of agreement and trust.

<comment><USER5> This is also why Data Loss Prevention software is truly useless in an employee environment. Sure it can spot you forwarding email, but I can take a picture of the email with my phone.

</comment></comment></comment></comment></comment><comment><USER6> Signal keeps getting better with each release, great job at everyone from Whisper Systems.

<comment><USER7> I love using Signal and will continue to make modest donations, but I would really appreciate an improvement in audio call quality. I still use Silent Circle for calls because it is so tiring to talk when the bitrate is low.

<comment><USER8> > I still use Silent Circle for calls because it is so tiring to talk when the > bitrate is low.

To be fair, that's a high bar. Our (SC) phone guys are masters at optimizing audio quality. I would be extremely surprised if any other app (encrypted or not) had significantly better audio quality than Silent Phone.

<comment><USER9> Wire's audio quality is quite good, even on cellular and/or VPN. Haven't compared with Silent Circle.

<comment><USER8> Oh, I'll give that a go, thanks! I should try Signal again too, hopefully audio quality has improved from the Redphone days.

<comment><USER10> Yeh it definitely has come on a lot since then

</comment></comment></comment></comment></comment></comment><comment><USER11> > Hexadecimal isn't compatible with all alphabets, so it left a lot of people > out.

Not ... really. Latin characters are available in every locale. Virtually anyone literate enough to use signal is going to distinguish the latin letters A through F. You reading this, I'm assuming you're not literate in Greek, but can you distinguish the letters α, β, γ, and δ, even if you cannot name them? Don't bring up CJK; virtually no one in this day and age is functionally literate in any CJK language that can't read the Latin alphabet.

Let's take the hypothetical person literate in another script who is completely unfamiliar with the letters ABCDEF. They don't use our arabic numerals either. If you need to localize arabic numerals, why on earth couldn't you localize hexadecimal, too?

Obviously, hexadecimal is not friendly to the layperson as a means of representing numeric quantities. But neither is comparing two 60 decimal digit numbers as a means of authentication. I don't think it's inherently easier for a layperson to match 60 decimal digits versus 50 hexadecimal digits.

</comment><comment><USER10> How to donate to Signal!

[http://support.whispersystems.org/hc/en- us/articles/21294015...](http://support.whispersystems.org/hc/en- us/articles/212940158-How-can-I-donate-)

</comment><comment><USER12> I'm not sure that this is a benefit. It gives users a false sense of security. Screenshots or pictures can always be taken on the other end.

Didn't signal used to be explicitly against this feature.

<comment><USER13> If their sense is that -- after configuring 1 week self destruct, the people they're talking to likely won't be keeping months and months of chat logs on their phone anymore -- it's a very true sense of security.

<comment><USER14> At least until the Jailbreak tweak is released with patches out this feature, allowing people to retain everything they want.

I don't disagree that it works for the average user, but I do agree with the sentiment that it is a false sense of security.

Unless maybe you cryptographically verify the deletion (is that possible?) and notify the other party of the successful deletion. But even then a copy could be made beforehand, on-device or with an external camera...

I think it's much better to maintain zero expectation of message destruction with all end users.

<comment><USER15> Yeah: I kind of want to release such a hack just to make the point (even though I do not use this program nor do I know anyone else who does). This is simply lying to users :/.

</comment></comment></comment></comment><comment><USER16> With all due respect, Open Whisper Systems might ought first consider fixing Signal's multiplicate message problem, especially silent (to the sender) group chat spamming.

<comment><USER17> >multiplicate

I'd never heard this word so I looked it up. Google didn't have a definition but merriam-webster was the first result. They showed me an extra concise definition and then this message...

>Wait, there's more! This word doesn't usually appear in our free dictionary, but we've shared just a bit of the information that appears in our premium Unabridged Dictionary. There's more definition detail there. Start your FREE Trial Now!

Umm.. Fuck you Merriam-Webster?

<comment><USER18> There's something weird about that marketing angle coming from a dictionary; it seems somehow at odds with the notion of completeness that we associate with reference materials. Like "there are secret words that only paying customers get to know about", or something?

<comment><USER19> Less- and more-comprehensive versions of dictionaries is a long-standing thing. And you've usually had to pay for all of them—I think it's weirder that you'd expect to have a fully-complete version of something that takes a lot of expert knowledge and time to put together for free.

<comment><USER18> It's interesting to think about it this way. I do have dictionaries of different sizes that I've paid for, yet somehow the differences between them didn't strike me the same way this marketing campaign does.

<comment><USER19> Good point, the internet does make the upsell much much much more in-your- face.

<comment><USER20> It's more than that; I'm old enough to have carried a compact Spanish-English dictionary while traveling. An unabridged dictionary was heavy enough that you couldn't hold it in one hand.

In other words, there used to be such a thing as 'too much dictionary'. Now, like any other information source, it's the size of my phone, except when it's the size of my laptop.

<comment><USER21> They still vary greatly in quality and (accordingly) price.I have several chinese/english dictionaries installed through Pleco (on my phone). With a couple exceptions, they're not free.

When I was taking a formal class in Mandarin, some classmates complained, "the definitions you're getting from Pleco are so much better than ours! What are you doing differently?" They lost interest when I responded "I paid for the better dictionaries".

Different dictionaries have different strengths. CC-CEDICT has entries for standard Chinese versions of western names, and for slang. Then again, it doesn't even have usage examples. ABC has many, many entries, including stuff like technical terms in linguistics. Tuttle Learners' has very few entries (it's a learners' dictionary!), but it does nice things like provide antonyms and, where it might be helpful, character-by-character glosses. Tuttle has my favorite entry for 糟糕 [a mess/very bad/bad luck], headed by "[modif: 糟 messy + 糕 cake]".

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER22> I'm not sure I like the UX for the disappearing messages. Having a little hourglass after every message breaks the flow up. I'd rather see the message bubbles be black instead of blue.

It's also not intuitive to tap on a recipient's name to enable disappearing messages.

Lastly, maybe messaging should default to 1 week disappearing messages...

<comment><USER23> I was thinking that too.

I actually want my messages to just be deleted every month, but w.e. I'll take it.

</comment></comment><comment><USER24> Everytime there is an update, I become more emboldened to continue to push my friends from whatsapp to Signal.

I just wish we had way to see what's going on in their server.

<comment><USER25> [https://www.whispersystems.org/bigbrother/](https://www.whispersystems.org/bigbrother/)

[https://github.com/WhisperSystems/TextSecure- Server](https://github.com/WhisperSystems/TextSecure-Server)

<comment><USER26> The fact that their phone server isn't free makes me somewhat more concerned as time goes on. I used to think it was just because they were busy, then I thought maybe they just wanted more time to refine things, but now it's been nearly two years since they released the current re-vamped Signal 2.0 for iOS and over a year since releasing Signal for Android. At this point I'm running out of justifications for them for why their phone server is still proprietary & closed source.

<comment><USER24> I keep thinking about this concept of a "glass server".

They can run it, but allow developers to somehow see running processes, and write (rate-limited) queries to test things.

I haven't solidified this concept in my head but it seems like a step towards federation without the problems of federation.

<comment><USER26> Hmm that's an interesting idea. I'm assuming their phone server is Java, same as their text server, so the builds should theoretically be identically reproducible for both. It seems like it should be possible to include a field in each response with some sort of signature so users can verify which build is serving requests. It'd have to be in every response so that they can't just reverse-proxy /status to the valid build and serve other requests from a modified build, and it'd have to be somehow dependent on some changing external factor or input so they can't just hard-code the valid build's signature.

</comment></comment></comment></comment></comment><comment><USER27> Now if they would drop the ridiculous requirement of having a phone number and go with usernames and not require access to my contact list like most other services, you could actually be safer and not rely on _their word_ alone.

<comment><USER28> Indeed. It's not just crypto nerds would want to use the service without having to have a smartphone with a phone number.

The phone requirement is beyond ridiculous. How did Signal get the reputation it enjoys in the tech community anyway?

<comment><USER9> Wire ([http://wire.com](http://wire.com)) does not need a phone number (register with email on a desktop browser at [http://app.wire.com](http://app.wire.com), then login to mobile) and does not need a copy of your contacts. Supports text, image, files, audio, video. E2E encryption is based on Signal protocol. Funded by Skype founder.

<comment><USER29> Wire does not use Signal Protocol, they used some of our code to create a protocol of their own devising that we do not recommend.

<comment><USER30> Why do you not recommend? Hopefully you're not just saying that because they aren't Signal..

\</comment></comment></comment></comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment>

I've been using Wire for a few weeks now and I'm absolutely happy. They recently released a linux client [https://medium.com/wire-news/get-your-linux- on-999403a1a4fe#...](https://medium.com/wire-news/get-your-linux- on-999403a1a4fe#.ju81mo5lm) (not a chrome app!) (though I think it's electron).

I'm quite happy with them, give them a try.

<comment><USER31> Correct, built with Electron like our Windows and macOS apps. Glad you're enjoying it.

Possible reason: [https://medium.com/@wireapp/axolotl-and- proteus-788519b186a7...](https://medium.com/@wireapp/axolotl-and- proteus-788519b186a7#.89118rx5s)

</comment></comment><comment><USER32> I don't understand why it still doesn't support landscape mode on iPhone.

<comment><USER25> It's on the roadmap [https://github.com/WhisperSystems/Signal- iOS/issues/937](https://github.com/WhisperSystems/Signal-iOS/issues/937) The iOS version didn't have a dev for a while after Frederic Jacobs went to Apple, but Michael Kirk recently took over so things are happening again.

</comment></comment><comment><USER33> Great. One of the most requested features is finally here. I think all that's left now is video calling (on the desktop, too).

<comment><USER6> I would like to be able to re-register a new number without having to de- activate the account thereby not losing all of my chats.

<comment><USER34> Is there a way from preventing certain contacts from knowing I'm on Signal? Like, it is embarrassing that Jason from college knows I'm on Signal. I know you guys will disagree and say it is not embarrassing, but it seems that a privacy-focused app would respect this notion. Obviously being a member of certain apps (grindr) can be seen as negative. I think I should be able to Whitelist my contacts.

<comment><USER35> I don't disagree with your general point, but I'm curious, why would having a _privacy-focused_ app be embarassing? I'm curious what kind of attitude you have for it, or what you expect some of your contacts to think of it.

<comment><USER34> Because it makes me look like a drug dealer. Which is to say it is easy for me to guess why most the people in my contacts who use Signal, use Signal. Some are journalists. Some are tech researchers. The guys with bad jobs who aren't good at computers make me wonder...

<comment><USER35> Sounds like the image we should move away from, so it gets better for everyone. While I don't disagree with your previous point, I think part of the reason for OWS to do this might be to nudge people like you towards this being mainstream, instead of _okay, so why is this guy using this?_

</comment></comment></comment></comment></comment></comment><comment><USER36> Cool feature, though it'd be nice if Signal fixed the message delay and message dropping problem. But Signal uses the proprietary GCM service (because "it's impossible to do message sending correctly, so let's force people to use proprietary software") so they probably can't fix it...

<comment><USER25> No one is forcing you to use proprietary software. See this comment from moxie [https://news.ycombinator.com/item?id=10665520](https://news.ycombinator.com/item?id=10665520)

Using GCM is only a problem for people running a custom Android ROM without Google Play Services. Using GCM doesn't make Signal less private.

 _Google doesn 't see any data via gcm, it's just a tickle. If you want push messages, you gotta use a push network._

[https://twitter.com/whispersystems/status/695399112833761283](https://twitter.com/whispersystems/status/695399112833761283)

Feel free to help out with code [https://github.com/LibreSignal/LibreSignal/issues/43](https://github.com/LibreSignal/LibreSignal/issues/43) or money [https://www.bountysource.com/issues/35722527-create- proper-p...](https://www.bountysource.com/issues/35722527-create-proper-pull- request-to-add-libresignal-s-websocket-support-to-ows-signal) if using Signal without GCM is important to you.

 _If the only thing that the remaining people here want out of LibreSignal is a websocket-only solution and gmscore isn 't an option for whatever reason, I would consider a clean, well written, and well tested PR for websocket-only support in Signal. I expect it to have high battery consumption and an unreliable user experience, but would be fine with it if it comes with a warning and only runs in the absence of play services. However, I also realize that still won't help people that are trying to build a Google-free experience on Google's platform [https://github.com/WhisperSystems/Signal- Android/issues/127](https://github.com/WhisperSystems/Signal- Android/issues/127) , since we still don't have the things we need [https://github.com/WhisperSystems/Signal- Android/issues/127#...](https://github.com/WhisperSystems/Signal- Android/issues/127#issuecomment-21763521) to be comfortable distributing software outside of Play._

[https://github.com/LibreSignal/LibreSignal/issues/37#issueco...](https://github.com/LibreSignal/LibreSignal/issues/37#issuecomment-226646872)

Considering how a small minority complain about this everytime Signal is mentioned you'd think they'd do something about it, but take a look at that Bountysource link and you'll see 8 backers. Guess complaining is easier.

<comment><USER37> Actually, Moxie has threatened to shut LibreSignal down if they allow LibreSignal users to message normal Signal users, and refused to even discuss alternative solutions.

He also uses the GCM library from Google, which pulls in several analytics libraries into the APK, so "Using GCM doesn't make Signal less private." is objectively false.

(And in addition to that, Moxie even refuses to allow any distribution that doesn't come with full analytics, which is extremely user hostile.)

> Guess complaining is easier.

No, it's easier to use XMPP than to fix a system that's broken by design like Signal.

EDIT: Seriously? Downvotes for criticising publicly documented user-hostile behaviour from Moxie? Fuck this, the discussion culture here really got worse than even Reddit.

<comment><USER29> > Moxie has threatened to shut LibreSignal down if they allow LibreSignal > users to message normal Signal users, and refused to even discuss > alternative solutions.

Please cite this. To my knowledge I never threatened anything, and your comment is a response to a quote from the discussion _about_ LibreSignal, where I suggest that they submit a PR with the functionality they desire to Signal. Is that not an alternative?

> He also uses the GCM library from Google, which pulls in several analytics > libraries into the APK

Could you cite this as well? Here's the entire POM file for the version of the GCM library we use:

<?xml version="1.0" encoding="UTF-8"?> <project xsi:schemaLocation="[http://maven.apache.org/POM/4.0.0](http://maven.apache.org/POM/4.0.0) [http://maven.apache.org/xsd/maven-4.0.0.xsd"](http://maven.apache.org/xsd/maven-4.0.0.xsd") xmlns="[http://maven.apache.org/POM/4.0.0"](http://maven.apache.org/POM/4.0.0") xmlns:xsi="[http://www.w3.org/2001/XMLSchema- instance">](http://www.w3.org/2001/XMLSchema-instance">) <modelVersion>4.0.0</modelVersion> <groupId>com.google.android.gms</groupId> <artifactId>play-services-gcm</artifactId> <version>8.1.0</version> <packaging>aar</packaging> <dependencies> <dependency> <groupId>com.google.android.gms</groupId> <artifactId>play-services- base</artifactId> <version>8.1.0</version> <scope>compile</scope> <type>aar</type> </dependency> </dependencies> </project>

A single dependency. If you follow it, the only transitive dependency is the supportv4 library. Where are the "several" analytics libraries?

> (And in addition to that, Moxie even refuses to allow any distribution that > doesn't come with full analytics, which is extremely user hostile.)

What do you mean by "full analytics?" Is there something user hostile about having an aggregate count of the number of users you have on what platforms, so that you can develop and deploy software accordingly? About being able to receive crash reports when users choose to submit them so that you can fix their problems?

<comment><USER37> > Please cite this.

I'm sorry, what was this entire discussion then supposed to mean? [https://github.com/LibreSignal/LibreSignal/issues/37#issueco...](https://github.com/LibreSignal/LibreSignal/issues/37#issuecomment-217211165)

If they can't fork it while still using your servers, and you refuse to allow federation, how the FUCK is it open in any way?

How are users supposed to be able to verify the software running on their own systems when you only allow binaries compiled by yourself to communicate with your users, abusing the lock-in effect?

> Could you cite this as well?

Have you actually read the code that gets compiled in when you depend on play- services-base and play-services-gcm?

As I happen to have reversed all of it to write an open source library for GCM, I have. And let me tell you, most of the code in there is "measurement"-code.

> What do you mean by "full analytics?"

Distributing through any means where the user can get the app without being required to be fully tracked by the Google Play Services?

You only distribute through the Play Store, which doesn't fully work with microG at the moment, requiring users to install spyware on their devices.

<comment><USER25> > _If they can't fork it while still using your servers, and you refuse to > allow federation, how the FUCK is it open in any way?_

What makes you think you have a right to demand federation? Run your own server if you don't like how they're doing it. You have access to the source under a Free Software license [https://github.com/WhisperSystems](https://github.com/WhisperSystems) but of course you don't want to actually do any work, you want to complain about what other people do because they don't do it in the exact way you want it done for free.

> _How are users supposed to be able to verify the software running on their > own systems when you only allow binaries compiled by yourself to communicate > with your users, abusing the lock-in effect?_

[https://whispersystems.org/blog/reproducible- android/](https://whispersystems.org/blog/reproducible-android/)

> _You only distribute through the Play Store, which doesn't fully work with > microG at the moment, requiring users to install spyware on their devices._

[https://news.ycombinator.com/item?id=12689352](https://news.ycombinator.com/item?id=12689352)

<comment><USER37> Also, regarding

> but of course you don't want to actually do any work, you want to complain > about what other people do because they don't do it in the exact way you > want it done for free.

Nah, I don't spend months of my own free time maintaining an open source IRC app, and working on creating tools to make IRC easier for users to use.

I don't actually spend time making open chat systems more useable to users, sure.

That accusation from you doesn't belong at all on HN, and is not only a personal attack, but also wrong.

I could just run a Signal fork with my own servers tomorrow, but one of my goals is to allow users to have one single place where they can send a message to a user, and it will arrive. No matter what service the other user uses, what app, what chat system, if they're on an obscure 20 people IRC network, on Signal, WhatsApp, etc.

My ideal goal would be a universal, federated protocol, but even having libraries for each protocol with a unified API would make things already easier.

And Moxie is fighting for the opposite.

He fights against any compatibility, and suggests I tell my mother to install yet another chat app, ignoring that her phone can't even install Signal in the first place because it only has 3MB of useable memory, left.

You and Moxie actively tell people to create more, and less interconnected, chat networks.

How the fuck is that going to help?

If everyone uses a different secure app, that doesn't help at all! People will just use the systems everyone has (case in point: usage of SMS in the US, or WhatsApp everywhere else), and thereby you ensure no one gets any security.

So stop insulting people you don't know, and claiming untrue motives to be theirs, just so you can justify your actions.

<comment><USER25> > _My ideal goal would be a universal, federated protocol, but even having > libraries for each protocol with a unified API would make things already > easier.

And Moxie is fighting for the opposite._

Yet here you are, pissed off that your goals don't align with someone elses. Use your open source IRC app to talk to your mom and I'll use Signal to talk with mine. No one is forcing you to do anything. Considering your goals and ideas are superior surely whatever you're suggesting will become the one service everyone uses, problem solved.

<comment><USER37> > surely whatever you're suggesting will become the one service everyone uses, > problem solved.

That shows even more how much you misunderstand the entire market even worse than Google does.

An app can't win because it is the best, but only through network lock-in effects (which Moxie tries to use for Signal, too) and marketing combined.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER38> I've been receiving a bunch of "Bad encrypted message..." lately. Wonder what's up with that.

<comment><USER39> Tons of those, plus repeats, and "random" delays. Sometimes it takes a few minutes for messages to go through (single check). Last week was really bad. I don't know how multiple messages can happen; shouldn't they have a unique ID?

<comment><USER25> Last week was due to server issues [https://whispersystems.discoursehosting.net/t/intermittent-m...](https://whispersystems.discoursehosting.net/t/intermittent- message-send-failures/537/7)

<comment><USER38> I saw the mailing list post, then got the bad messages a day later. Probably the same issue, still curious about the technical details though.

</comment></comment></comment></comment><comment><USER40> > They're relatively compact. Users compare 12 groups of 5 digits with each > other, which is half the size of our previous hexadecimal format.

60 digits have 199 bits of security, so I suppose that's mostly okay, right? Does the birthday paradox apply here, reducing it to 98 bits?

<comment><USER8> No, since you presumably want to match a specific user's key, not just find two users with the same key.

<comment><USER41> It is a similar problem, however: [https://en.wikipedia.org/wiki/Birthday_problem#Same_birthday...](https://en.wikipedia.org/wiki/Birthday_problem#Same_birthday_as_you)

<comment><USER42> That's still not the problem considered here. You're not asking "does anyone have the key I'm seeing here", you're asking "does this person next to me have the key I'm seeing here". No birthday paradoxes of any kind involved.

<comment><USER41> Forgive me, as I haven't used signal, but I don't see how whether they are sitting next to you or not changes the problem.

If I can generate a key that hashes to the same value as your key, I can convince anyone I am you. If I can generate a second collision for a third party's key, I can convince you you are talking to that third party, as well. Generating hash collisions is, as I understand it, pretty well modelled with the birthday paradox (and variations like the one I linked). Physical proximity seems entirely unrelated.

<comment><USER42> Right, sorry, I misunderstood. A preimage attack (that's the technical term for this) could indeed be modeled as a birthday problem with a fixed day ("someone with the same birthday as me"). This is much harder than finding a normal collision (two objects with the same hash, two people with the same birthday), though.

</comment></comment></comment></comment></comment></comment><comment><USER43> How do they make money?

<comment><USER6> From wikipedia:

"The group is funded by a combination of donations and grants, and all of its products are published as free and open-source software."

[https://en.wikipedia.org/wiki/Open_Whisper_Systems](https://en.wikipedia.org/wiki/Open_Whisper_Systems)

<comment><USER43> Why isn't this on their site? ... this is just thinking out loud, not directed at you.

</comment></comment></comment><comment><USER44> Signal is not anonymous.

Antox from the tox.im people is a better more secure and anonymous messaging application.

Ring.cx is also better.

<comment><USER42> Signal does not claim to be anonymous, nor does it try to be. Your recommendation misses the point.

</comment></comment><comment><USER45> Who exactly uses Signal? Why do you think it's secure?

<comment><USER25> Edward Snowden, Bruce Schneier, Matt Green and a few more. I think it's secure because it's been audited, because I trust the experts who say that it is secure, because of [http://support.whispersystems.org/hc/en- us/articles/21247776...](http://support.whispersystems.org/hc/en- us/articles/212477768-Is-it-private-Can-I-trust-it-) and because of [https://whispersystems.org/bigbrother/](https://whispersystems.org/bigbrother/)

</comment></comment><comment><USER46> SIgnal is basically getting the full feature set of TigerText.

</comment><comment><USER47> I had an idea a few days ago where you authenticate your identity (i.e. numeric fingerprint) on-demand by sending a pic of yourself where the QR code is overlayed as blacked-out pixels before being transmitted. Then the recipient can look at the photo to see it hasn't been manipulated, and use the app to verify the QR codes match.

I'm sure there are issues with this, but it seems like a nice feature for when secure out-of-band communication is not possible.</comment>


Oracle refuses to accept pro-Google "fair use" verdict in API battle - <AUTHOR> https://arstechnica.com/tech-policy/2017/02/oracle-refuses-to-accept-pro-google-fair-use-verdict-in-api-battle/ <comment><USER2> Oracle is set to repeat the trajectory of SCO. Their primary product (the Oracle DB engine) is being displaced by the NoSQL and things like Postgres. The "next generation" of developers equals SQL engines with "old and bad", and when forced, it ends up with Postgres anyway.

Oracle used to survive in significant part by the support of the "database administrators" class. This layer of support is also becoming thinner and older.

There's essentially no way forward for Oracle. They can use hostage tactics to squeeze money out of exiting customers for a few more years, but otherwise they are irrelevant in the tech landscape.

Except for Java, that is. The current tech is powered by Linux and there isn't really anything as big as Java on Linux. Python has been pretty significant and Go is making inroads, but the default is all Java. It is going to be interesting to watch how this will play out.

<comment><USER3> Maybe for startups, on the enterprise space I am yet to see any customer move away from Oracle, SQL Server, DB2 and similar.

<comment><USER4> When I worked government contracting they had broad goals handed down which they must work toward without it being an explicit requirement. One of these goals? Get on top of an open source only stack for security, cost and future interoperability between other groups.

I worked on several projects where they were originally using Oracle or MarkLogic and we transitioned them to Postgres or various other, open source tech.

If the slow moving government is moving various projects away from Oracle, I would be shocked if some businesses weren't doing so as well. Now I don't know if moving away from proprietary is a trend or the more frequent than moving to them.

<comment><USER5> If you are allowed to and comfortable with it, could you share which country was that? Over the years I have looked at government projects in Western Europe, SE Asia and Australia, Europeans seem to be the ones that care the most about open source, while at the other end of the spectrum SE Asian governments are interested in it just as much as it lets them save money (much less because of "free as in freedom"). Australia seems to me kind of a mixed bag, it boasts about using Drupal because it's open source but I know that some projects are based on proprietary technology. Please note that much of the information I gathered is second-hand and may be inaccurate.

<comment><USER6> I can say from experience that in the U.S., the procurement people are definitely incentivized to look for solutions built on open standards and open source because of the ability for the government to have the option to not ever have to upgrade again, but to continue servicing this specific procurement (and this specific version) forever and ever and not be beholden to a specific vender or solution provider.

I've even seen cases where one company will sell a solution into the government and lose the maintenance contract the next year to some entirely different company who underbid the original provider -- and there's minimal slowdown in technical execution because the entire stack is open to some degree.

The government is starting to develop an allergy to vendor lock-in because of this.

</comment></comment></comment></comment></comment><comment><USER7> Although Oracle denied they bought Sun just to sue Google you have to wonder since they are claiming "billions" in damages and only paid $7.4 billion after IBM dropped their $7.0 billion bid.

This purchase was such a seminal moment for the industry you have to wonder what an alternative history would look like if say IBM or Google made the purchase not to mention some dark horses like Amazon or Red hat.

<comment><USER8> They absolutely bought Sun just to sue. I used to know someone personally involved on the case. Oracle is a horrible company.

To be fair, Google's "don't be evil" is also a bunch of crap. They've done their fair share of shady and exploitive things.

<comment><USER9> Google wasn't evil, at least not before the IPO (which is when I worked there). People took the slogan seriously and based decisions on it. I don't know what happened.

<comment><USER10> The people that intended to do evil merely waited until those who didn't intend to do so finished implementing the things they were implementing.

Then they used that sound infrastructure to do evil with, as they had intended to do all along.

Those people that took the slogan seriously were used.

<comment><USER11> Those are very damning accusations. Care to give some examples?

<comment><USER12> I think Google's quiet transformation from a search company to a data company that is trying to learn everything about everyone is the prime example.

Google buzz was also one of the early moves that showed this, opting everyone who uses gmail into a social network was pretty evil if you ask me.

<comment><USER13> I am troubled by your expansive definition of the word "evil".

</comment></comment></comment></comment></comment></comment></comment><comment><USER14> I wish intent and end result counted more strongly. Andoid's compatibility isn't transitive: once code goes through the Android build pipeline to produce an Android Application it cannot be meaningfully used in the context of Oracle Java; it's a one-way transformation to remain "talent-compatible" with a large pool of Java developers and reuse the base of Java libraries.

Projects like OpenJDK and WINE are efforts to provide an alternate execution environment for code that is mutually beneficial to the ecosystem, although perhaps not the wallets of the original owner. A commercial venture ought to qualify here if the intent is to compete on equal footing -- code targeting OpenJDK can run unmodified on Oracle Java, code targeting WINE can run unmodified on Win32, thereby not limiting the original creator's rights.

However, Android Apps contain unrelated _public_ APIs as part of the exported code, and a full packaged Android App cannot meaningfully run on Oracle JDK, despite portions of the standard library looking and behaving alike. This fragments the ecosystem and essentially allows Android to benefit from the works of the Java rightholders without making those contributions equally as useful to Oracle Java itself.

<comment><USER15> _once code goes through the Android build pipeline to produce an Android Application it cannot be meaningfully used in the context of Oracle Java_

Android apps typically have an MVC-like structure where the UI uses Android- specific APIs, but the model is straight Java. As an example, I created an Android game and later decided that I wanted to make a level editor as a desktop Java application. I was able to reuse the model code in Oracle's JDK with no changes, even though I didn't have that use in mind when I originally wrote it.

 _a full packaged Android App cannot meaningfully run on Oracle JDK_

That's true of any platform-specific Java API.

<comment><USER16> Right: and if you remember, the entire concept of a "platform-specific Java API" is what was at stake when Microsoft lost this very similar lawsuit when Sun sued them over J++. Either what Google is doing is horrible or what Microsoft did shouldn't have been a problem :/.

<comment><USER17> > _Either what Google is doing is horrible or what Microsoft did shouldn 't > have been a problem_

Maybe go reread about the case? It was basically breach of contract and thus quite different.

The basis of Sun's lawsuit was that Microsoft had a license to implement Java™ and part of that license was the requirement that their version would be compatible as defined by the compatibility test suite.

In their attempt to "kill cross-platform Java" they failed to be compatible and so Sun sued and won.

<comment><USER16> Huh! So, there were multiple rounds of lawsuits, and I will admit I missed this (very important) detail of the part that Microsoft actually lost. I think it is still important to note, however, that the main reason any of these companies actually ended up in contracts with Sun was due to Sun's claims to ownership over the language standard itself, and there is some really great phrasing about Sun's feelings on this in this contemporary article from the Wall Street Journal. But again: you are absolutely right about what is different, and I am sorry for not noticing this before :(.

[https://www.wsj.com/articles/SB876241941809073500](https://www.wsj.com/articles/SB876241941809073500)

</comment></comment></comment></comment></comment><comment><USER18> Oracle is such a shit company. There are still some great hackers there but Larry Ellison is an asshole, and I don't envy anyone who has to work for him even indirectly. "Left Oracle's Java business in tatters" eh? Where was their mobile OS? Their Dalvik?

The wounds to Java have all been self-inflicted. If they succeed in copyrighting the API then where does this leave OpenJDK? Operating at the mercy of Larry fucking Ellison, which means not at all.

I've got 17 years of Java experience under my belt, but frankly with Docker + Kubernetes for deployment and new system languages like Rust and Go I'm thinking it's time to jump ship. Or even to C# since apparently MS got the memo on Open Source (not to mention the need for integrated platform modularization - no more Maven hell! Yay!).

<comment><USER19> >Or even to C# since apparently MS got the memo on Open Source

Actually Microsoft was with Oracle on the whole 'API's should be copyrightable' and lobbied on their behalf during the case.

Microsoft claimed that: "If Google's position that APIs can't be copyrighted stands, it will "destabilize" the entire software industry"

[https://arstechnica.com/tech-policy/2013/02/microsoft- forese...](https://arstechnica.com/tech-policy/2013/02/microsoft-foresees- chaos-if-google-v-oracle-result-stands/)

<comment><USER20> One wonders where they stand now that they've reimplemented the Linux kernel APIs in Windows 10.

<comment><USER21> Or considering they became such a large company selling a product that targeted IBM compatible systems. In that case, they were a consumer of what was essentially an API, but one wonders whether Microsoft would be in the position it is in today if IBM had been able to prevent Compaq and other vendors from creating clean-room implementations of what was essentially the IBM PC API.

IBM would have been in a much better position to push OS/2 and supplant Microsoft's OS offerings if it would have had a monopoly on the PC's supporting it's PC interface.

</comment></comment></comment></comment><comment><USER22> Oracle is at that stage where they didn't invent or do anything right in the last 5 years but try to get money from lawsuits.

<comment><USER23> This is actually not true. Their cloud offering is doing really well. There's some impressive figures here:

[http://realmoney.thestreet.com/articles/09/15/2016/oracles-c...](http://realmoney.thestreet.com/articles/09/15/2016/oracles- cloud-business-doing-well-older-businesses-arent)

<comment><USER24> Growth rate is a nonsense metric. If you're starting from nothing and invest a shitload of money in sales you'll have an amazing growth rate. IBM and Oracle are both way behind azure, google and aws.

<comment><USER25> I have a friend who works at IBM he tells me that IBM uses Google cloud for some of their stuff. The irony when you are a cloud provider but use another service.

<comment><USER26> I mean, that in and of itself ain't really ironic. Lots of cloud providers out there just resell abstractions around / improvements upon other cloud providers. Cloud66 is one with which I'm familiar; their whole business model revolves around wrapping AWS with CloudFoundry-like deployment mechanisms specifically for Ruby codebases (and Docker containers, but I never interacted with them in that capacity).

<comment><USER27> Yes, and note that IBM do a lot of Oracle support.

</comment></comment></comment></comment></comment></comment><comment><USER28> The entire software industry should be boycotting Oracle over this case. If they win it will ruin software development in the US.

<comment><USER29> Except that Oracle has become so successful because they've captured the largest customer(s) of all: the US federal government.

<comment><USER30> Well isn't that a coincidence. Extracting money through state granted limited monopoly rights and lobbying for big government contracts at the same time. Oracle is really living the crony capitalist dream.

</comment></comment></comment><comment><USER31> Let's slap a great big IANAL on this before I start:

The fair use decision was wrong. It relied on a fundamental misunderstanding of the term transformative where the use of the code was considered rather than merely the implementation. So Oracle has a huge case here.

Moreover, practically it doesn't matter. Even if fair use is established in this case, the door has been left wide open to hordes of API copyright trolls. If you thought patent trolls were bad, you ain't seen nothing yet.

If you care about the economy, the only sensible outcome would be that API surfaces aren't subject to copyright. Sadly the horse has bolted a long time ago.

<comment><USER32> If implementing an interface is against copyright, then every Java program is infringing on Oracle's copyright.

<comment><USER33> No because the Java license lets you do that.

<comment><USER32> If having your lawyers read the license is the requirement to using any programming language...

</comment></comment></comment></comment><comment><USER34> Okay, either I'm crazy or everyone else is. Assuming the court isn't trying to set a new precedent with regards to software it seems like Oracle should have easily won this case. There is an argument to be made that APIs shouldn't be copyrightable but surely it's not _fair use_ \-- Google's use of Java doesn't even come close to meeting the criteria.

<comment><USER7> This is tricky because if you declare any API no matter how trivial copyrightable then the first guy to copyright a function to compute sqrt, tan, atan, etc wins. And if you can't copyright trivial interfaces then the question becomes where the line is drawn.

There's far more at stake than Oracle trying to squeeze money out of Google.

<comment><USER34> I completely agree, but I don't really know what to do about it. Surely a document describing a useful software interface (GUI, CLI, API) is a creative work and takes effort to produce. Unless we just agree that it's a necessary exception for the purposes of interoperbility I'm not sure how I would argue that it shouldn't fall under copyright protection.

<comment><USER35> _Copyright_ would apply to the documentation itself, or the published header files themselves, as works; it wouldn't apply to the API itself.

Mind you, Oracle was suing Google for using the header files themselves; since Google could have easily just typed up their own versions that did the same thing, it's almost more of a "plagiarism" case than a "copyright infringement" case: they shipped something that was _exactly_ from Oracle, rather than just paraphrasing it. Oracle was probably in the right to sue over that.

But re: APIs—there's much more well-resolved case-law for this, coming from the gaming vertical: games have copyright, but _game designs_ (including things like their network protocols) do not. It has both pros (Microsoft can't use the Minecraft IP to sue Terraria or Factorio; people can advance AI by writing bots that play Starcraft) and cons (the iOS and Android stores being saturated with mechanical clones of each successful game) but it's very certainly "the way things are."

<comment><USER36> >it's almost more of a "plagiarism" case than a "copyright infringement"

Do you know what the definition of plagiarism is? Google it, "copyright infringement" is listed as a synonym.

<comment><USER37> Actually, plagiarism and copyright infringement are different things. For example, it is possible to plagiarize something that is not copyrighted, and many forms of copyright infringement wouldn't fit the definition of plagiarism.

<comment><USER36> True, but the parent seems to think they wouldn't have been plagiarizing if they had "paraphrased" the declaring code so to speak, which makes the relationship here explicit. If they had paraphrased the declaring code, it would have been much harder to say they were infringing on copyright, but instead, they copied it verbatim.

Of course, in academia paraphrasing is still plagiarism, but it is likely no longer copyright infringement especially in this case.

<comment><USER38> > Of course, in academia paraphrasing is still plagiarism, but it is likely no > longer copyright infringement especially in this case.

That seems an odd thing to say. A significant portion of academic writing is paraphrasing, with attribution. What is a review article, other than attributed paraphrasing?

<comment><USER36> With attribution, definitely ok, but some think paraphrasing is enough to make it wholly new. Hell, you can quote verbatim if you attribute.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER39> I'm really looking forward to the next 5 or 6 years, when all of the software patents created in the 90s and 2000's expire. It can't come soon enough.

<comment><USER40> If only this had to do with patents. Oracle is claiming breach of copyright - which lasts over a hundred years.

<comment><USER41> They originally claimed patents too, which is why this keeps going to the federal circuit instead of the 9th, who would have ended this silliness

<comment><USER42> Huh? "The 9th [circuit]" is a Federal circuit court...

<comment><USER43> The terminology's confusing, but there's a court named the Court of Appeals for the Federal Circuit [1], even though the term "federal circuit court" also colloquially means the Courts of Appeals in general. This Federal Circuit is a non-geographical Court of Appeals, separate from the 11 numbered, geographically based Courts of Appeals, and has exclusive jurisdiction over patent cases (among a few other things). They also have a reputation of being very pro-IP-plaintiff compared to the courts in general.

[1] [https://en.wikipedia.org/wiki/United_States_Court_of_Appeals...](https://en.wikipedia.org/wiki/United_States_Court_of_Appeals_for_the_Federal_Circuit)

<comment><USER42> Ah, so the "Federal Circuit" is another court at the same level as the other circuit courts that doesn't have a number associated with it. The choice of abbreviation is confusing to say the least.

</comment></comment></comment></comment></comment></comment><comment><USER44> Is Oracle the biggest troll in Silicon Valley right now? Can't think of anyone else that would claim the title. Maybe Theranos.

<comment><USER45> > Is Oracle the biggest troll in Silicon Valley right now? Can't think of > anyone else that would claim the title. Maybe Theranos.

I'm not aware of Theranos being a troll. Fraudster for sure, but troll has a different meaning.

</comment></comment><comment><USER46> I got a sales call from Oracle out of the blue a few weeks ago. I have no idea what brought my company to their attention.

I explained to the sales person that I am an Oracle-certified DBA with years of experience managing Oracle servers. I then told him there was absolutely no chance I would ever recommend switching to Oracle. In answer to his questions, I explained that I could not trust Oracle. I don't mean Oracle the RDBMS, I mean Oracle the company. He should be able to understand the need to trust your RDBMS. It would be crazy to use RDBMS software with you data if you didn't trust it. I think it would be crazy to trust a developer with your RDBMS if you don't trust the developer.

I don't want to make sure I have the right lawyers and all my legal ducks in a row to battle Oracle for the heart and sole of my company (what company doesn't have data at its core these days?). I want to solve problems and create great things. I want partners in that effort who I trust. I don't trust Oracle. They do not want what is best for me. I don't want to end up as roadkill on there quest to be more profitable. I'd rather work with those who think that my success is their success.

</comment><comment><USER47> Oracle should stop that, in my opinion. That attitude could kill Java in the long term.

<comment><USER48> One wonders how much the taint of Java factored into the decision to invent Go.

<comment><USER49> My impression is that the Go team had two targets, both based on languages in common use at Google: C++ programmers, and programmers using languages like Python who wanted more type safety but didn't want to use a language with a massive ecosystem.

<comment><USER50> I might have misunderstood the last part. Why would anyone _not_ want a massive ecosystem with their language? You can always ignore the ecosystem while retaining the option to change your mind later.

</comment></comment></comment></comment><comment><USER51> Oracle is starting to remind me a lot of SCO:

[https://en.wikipedia.org/wiki/SCO/Linux_controversies](https://en.wikipedia.org/wiki/SCO/Linux_controversies)

That hasn't worked out well for them.

IMO, successful technology companies do not correlate with the value dollarsSpentOnLitigation/overallRevenue.

I think selling ORCL and buying QQQ will be a profitable trade in the next 5 or so years.

</comment><comment><USER52> Another thought too: Oracle kicking the hornet's nest on this may end up being a "good thing". Their verdict was dubious at best, they might get overturned and lose even more ground and $.

</comment><comment><USER45> Is there anyone that's not on Oracle's payroll that sides with them on this case?

<comment><USER53> Microsoft probably wouldn't mind Oracle winning.

<comment><USER54> Someone made a great point about the WSL (Linux) layer in Windows in this thread.

</comment></comment></comment><comment><USER55> The sequence, structure and organization of those method signatures, in those 37 Java packages, were all GPL'd in the OpenJDK in 2007 by Sun. Regardless of whether API's can be copyrighted or not, Google had every right to use the code Sun GPL'd.

<comment><USER56> Google didn't use OpenJDK, they used Apache Harmony implementation

<comment><USER57> That's true, but the availability of OpenJDK (which, after all, Google have now switched to) weakens Oracle's argument on the "Effect on the market" factor.

<comment><USER58> But OpenJDK is GPL. If Google licensed their Android Java as GPL, I guess they'd be OK. However, Google's Java is NOT GPL.

<comment><USER59> If the "structure, sequence, and organization" of APIs is a copyrightable work in its own right, then couldn't Google make a GPL-licensed derivative SSO (Android's API) but put their implementation under a separate license? Has anyone done a legal analysis of how the GPL's copyleft provisions would apply to this new kind of copyrighted work?

<comment><USER58> No. Everything that gets linked to GPL has to be GPL.

<comment><USER55> That's not true. OpenJDK is licensed under the GPL v2 with the Classpath Exception.

<comment><USER50> The Lesser GPL exists solely to allow linking to non-free programs.

[https://www.gnu.org/licenses/why-not- lgpl.en.html](https://www.gnu.org/licenses/why-not-lgpl.en.html)

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER60> I hope google just abandons java altogether if this is gonna continue.

<comment> Jean-Philipe It might put off not just Google, but also other companies using Java.

<comment><USER61> And I sort hope it does.

</comment></comment></comment><comment><USER62> Maybe, this is a little bit off-topic.

But anyone, who tried to use JetBrains IDEs on Ubuntu, might have faced the problem uglier font rendering with OpenJDK and the fix to it is to use the JDK from Oracle.

I thought the different with OpenJDK was largely about the licensing. Anybody with some insight on it ?

<comment><USER3> The closed source JDK has quite a few components that aren't the same as the OpenJDK.

For example OpenJDK 9 will get a new Java 2D render, due to the differences between the two that were in use [http://openjdk.java.net/jeps/265](http://openjdk.java.net/jeps/265)

</comment></comment><comment><USER63> This is turning into the _Bleak House_ of copyright cases.

</comment><comment><USER64> Just as I thought this is over, Oracle just threw another curveball. I feel this will be upheld but never know with these courts.

</comment><comment><USER65> How does OpenJDK stay out of violation if Oracle wins? Doesn't OpenJDK basically copy the API as well?

<comment><USER66> Code for OpenJDK can run unmodified on Oracle Java.

Code for Android Apps contain unrelated public APIs so cannot run on Oracle Java.

<comment><USER59> What does copyright law care about software compatibility?

</comment></comment></comment><comment><USER67> Some just never learn. Oracle is a massive troll.

</comment><comment><USER68> I really hope they win just because I hate using java for android development. Maybe if they win we'll swift will become the native language.

<comment><USER69> Agreed, but I do find Kotlin[1] to be a good compromise in the meantime.

1 - [https://kotlinlang.org](https://kotlinlang.org)

</comment></comment><comment><USER70> Fuchsia can't some soon enough.

</comment><comment><USER71> I hope Oracle wins. The sooner Java dies, the better.

<comment><USER72> I still don't understand why Google did not buy Sun Microsystems. They hired a lot of the staff anyway, and could have avoided the lawsuit.

<comment><USER73> Hiring the staff and handling the lawsuit - Google has their own in-house law firm anyways - has likely worked out to be cheaper for them than buying Sun Microsystems would have been.

<comment><USER74> Yes, but the downside on a lawsuit if Oracle prevails will be much worse.

Imagine, if you will, all that Sun IP in the hands of Google instead of Oracle. ZFS might have gotten a license friendlier to Linux, Solaris could have stayed open source, and I would put money on Google having spun Java out into a completely open foundation that wouldn't have done what Oracle has done with new EE versions.

</comment></comment></comment></comment><comment><USER75> Curious to hear your reasons for calling Red Hat a dark horse. (Which I presume is some kind of slur/holds a derogatory meaning)

<comment><USER76> my goodness, this is probably not a native English speaker, or perhaps never heard the expression before... why be so harsh?

<comment><USER77> Not understanding is fine: assuming that something one doesn't understand must be a slur is not fine.

<comment><USER78> He didn't assume but presume. And I think that's quite understandable for a non native speaker, given the connotation of the word 'dark'.

<comment><USER79> Actually in this case presuming is not understandable, there is no evidence or reasonable grounds to support his statement.

</comment></comment></comment></comment></comment><comment><USER80> Who has better connections with Trump?

Sadly to say, that is not an irrelevant fact anymore. Trump is clearly the kind of president that would reach in to legal rulings he's paid not to like.

<comment><USER81> Why would he care about two companies he doesn't own? I don't think this is a big concern.

<comment><USER82> Oracle's CEO is on his transition team, and Oracle is one of the few big tech companies to not publicly support the legal challenge to the travel ban.</comment></comment></comment>


Mixing Signals - <AUTHOR> https://samgentle.com/posts/2015-10-02-mixing-signals <comment><USER2> If equipment would enter active state instead of standby state when power is applied, all devices left in standby mode in the house would be turned on after a power glitch, wouldn't it?

So, you might wake up in the middle of the night with all your devices blaring, or coming home from a trip finding the neighbors mad about you having your sound systems turned on 24/7.

This might be one reason that standby is the initial state of devices.

<comment><USER3> I think the argument is more that devices shouldn't have a standby state in the first place.

<comment><USER4> They can't be remotely activated of they don't. You just can make the standby state more efficient: a phone on standby consumes much less than a TV.

</comment></comment></comment><comment><USER5> The article states this - "Well, it turns out that all this environmental friendliness is starting to trip over itself, because most devices now start up in standby mode."

Is this the best way for energy efficiency or should there be a different standard?

<comment><USER6> I'm of the opinion that devices that have a standby mode should either have an option to power on in standby mode, or remember the mode they were in when powered off. Many computer firmwares have a setting like this.

Though I think what's really missing is a reputable general standard for device control. The master/slave power board thing is a kind of hack using the most primitive kind of signalling we can manage at the moment.

In my ideal world I'd have a control panel somewhere where I could set up rules like "the sound system needs the TV to be on". Maybe the TV could even know that it should turn on the sound system it is connected to, though that's crazy optimistic for the current state of home automation.

<comment><USER7> In theory HDMI-CEC could do this, well if all your devices support CEC. You would have got chances with your homecinema though. They even have an opensourcelib now [http://libcec.pulse-eight.com/](http://libcec.pulse- eight.com/) .Saw this for the first time, haven't done any AV-Projects in the past years, but maybe I give it a try

</comment></comment></comment><comment><USER8> WOOOOOOW thats an awesome hack!

</comment><comment><USER9> I used to do the power strip on/off dance for my devices until I had a PSU just straight blow up. Now I'm not so sure the 1W standby power is worth the increased risk of failure.</comment>


Software that writes the front end so you can focus on the back end - <AUTHOR> As a backend developer, I do not want to dabble so much in the frontend but have some template/builder I can modify/create and let it talk to my backend api to fetch data and render results. Is anything like this available? <comment><USER2> I have something like this you could try out - it separates your application into two distinct servers one half providing all user account and session stuff and the other is your application. When users request whatever URL my software will proxy your application, or serve its own content. Whenever your server is proxied it includes account and session identifiers.

The user and administration interfaces are boring HTML without client-side JavaScript, and it is totally API-driven. The API can be accessed via NodeJS within the same server or via HTTP from your application server which can be in any language. There are modules for subscriptions and organizations that add hundreds more API routes and pages to your frontend.

[https://github.com/userappstore/dashboard](https://github.com/userappstore/dashboard)

My goal with this software is to make writing web applications as simple as blogging is when you use WordPress.

Some illustrations of how it works:

[https://raw.githubusercontent.com/userappstore/userappstore-...](https://raw.githubusercontent.com/userappstore/userappstore- application-server/master/src/www/public/2-powered-by-dashboard.png)

[https://raw.githubusercontent.com/userappstore/userappstore-...](https://raw.githubusercontent.com/userappstore/userappstore- application-server/master/src/www/public/3-what-dashboard-and-modules- provide.png)

[https://raw.githubusercontent.com/userappstore/userappstore-...](https://raw.githubusercontent.com/userappstore/userappstore- application-server/master/src/www/public/4-how-dashboard-works.png)

</comment><comment><USER3> Why not just call your api through something like postman?

<comment><AUTHOR> No I am referring to building an application</comment></comment>


Ask HN: How to analyse the real-time Web? - <AUTHOR> This seems to be one of today's extremely interesting problems:
How can we process an enormously high rate of incoming data such that processing latency is minimal?
What are your thoughts?
Some points to consider:
1. High rate of inserts
If the incoming rate of new data is very high, and if we store this data for any length of time, then databases tend to struggle. Why? Because, as we know, inserting individual datapoints becomes a significant bottleneck when the database is large, and the rate of inserts is high.
2. Computation across full dataset
Any cleverness on our part, to discern patterns in the data, may require our regularly crunching sequentially through all (or, at least, significant amounts of) our data. Databases are optimised for random access. To achieve this, they have overheads which mean that they are not optimised for sequential reads.
It is because of points 1 and 2 that industry folk are loudly singing the praises of Hadoop when they consider high rates of incoming data which requires persistent storage - (HDFS, with its low-overhead chunk archiving) and its corresponding MapReduce computation framework.
So, problem's solved? Not so fast.
Let's consider:
A. Inherent latency in HDFS and MapReduce
We know also that HDFS has an associated latency which prevents real-time analysis. This is for four reasons: i) Data is inserted into the HDFS in chunks. Until a chunk is formed, it cannot be inserted - and, accordingly, it cannot be analysed. ii) MapReduce has a synchronisation lock after the map function, so no reduce outputs can be given until maps are all complete. iii) Reduce pulls output data from Map, so pipelining is made inherently difficult - even without the synchronisation lock. iv) Hadoop processing only occurs after data is written to disk,
B. Order
We also know that whilst HDFS with MapReduce is great for unstructured data, many data streams are ordered - at least chronologically. This order can (and often should?) be exploited when processing. Exploiting this order across HDFS is not trivially done.
It is because of points A and B that we should probably be thinking of in-memory stream processing in addition to Hadoop - if, indeed, we believe that the community is correct in thinking that Hadoop is the perfect fit for archived data which comes in at high volume, and which also needs processing.
What are your thoughts? <comment><USER2> Can I ask a non-technical question about analysing the real-time web...

What's the business benefit? I don't think enough happens 'real time' for it to make much of a difference - reading a few blogs, news websites, digg / reddit & trending topics on twitter is enough to catch up on what happened in the world in a day.

Has anyone actually thought of anything that could make this useful?

<comment><USER3> _Has anyone actually thought of anything that could make this useful?_

Yes. This is part of what we are doing at <http://causata.com/>. Understanding the actions of people in near-real time is important if you want to target them with the right information, ads, offers, etc.

<comment><USER4> But why does this have to be real time and not, say, 4 hours delayed? If a person is interested in soccer at 8am, then they probably still are interested in soccer later in the day.

I'd be interested to hear any counter examples.

<comment><USER5> it means you can display a soccer-related ad at 8am and know that he will be watching it.

<comment><USER4> But this occurs already with ad networks and has been going on for years, they track your previous behaviours and delivery 'relevant' ads.

</comment></comment></comment></comment></comment><comment><USER6> Hadoop is designed as a batch processing framework not a real-time analysis framework. If your analysis functions are idempotent with regard to future data in the time domain simply compute summaries for each "block" down to the resolution supported for that age of data such that your summaries fit in memory. Save ALL the data to hadoop in case you need to replay it later. The answer to your question depends very much on whether you can summarize your data in the time domain. eg. if computing an average store block summaries as the average AND the number of items so that future summaries can be easily integrated. There is no one answer that will solve any possible analysis function, you'll need to optimize your system around the analysis function you want to perform and perhaps have a few different systems purpose built for different types of analysis.

<comment><AUTHOR> Let's consider a particular problem domain: analysis of global financial data - fixed income, stocks, derivatives, etc.

Agreed, Hadoop is a batch processing framework across a chunked archive. Work has been done recently to bring Hadoop "out of the past" - [http://www.eecs.berkeley.edu/Pubs/TechRpts/2009/EECS-2009-13...](http://www.eecs.berkeley.edu/Pubs/TechRpts/2009/EECS-2009-136.html). However, even with these latest amendments, the latency can prove more than a little troublesome for trading strategies which require rapid execution.

It is for this reason that companies like Truviso and StreamBase - both born out of highbrow academic research - have built in-memory stream-processing frameworks in addition to persistent data stores.

If we assume, for the sake of argument, that analysis of historical data is important, and that Hadoop is fit for purpose. And if we assume also, for the sake of argument, that a distributed in-memory processing facility is also important. Then which in-memory solution ought we to employ, and how ought we to relate this to the Hadoop solution which we'll also be using?

<comment><USER7> you should try a few of them and see which one actually works better. Probably more importantly, you should figure out more specifically what you're trying to accomplish.

</comment></comment></comment><comment><USER8> Have a look at what the financial industry use, they've been tackling high volume low-latency realtime data feed analysis problems for the last couple of decades. Time series databases (such as kx/kdb) are popular as are propriety in-memory databases (often based on something like BerkleyDB).

</comment><comment><USER9> What's the objective? We need to decide on what we want "analyze" to mean before we can evaluate/debate the merits of different techniques.

</comment><comment><USER10> Although I haven't really delved into it that much, HBase (and other "NoSQL" databases) supposedly address the latency and structured data points. I brought up HBase as opposed to Cassandra or Redis because HBase sits on top of HDFS and has a Hadoop/MapReduce API.</comment>


Ask HN: Give Us A Try - <AUTHOR>

After the past few months The Tech Block has grown to be, what we believe as a great source for finding great tech-related articles.
The process of finding articles varies from using social networks like Twitter to receiving links from everyday readers. We've been working really hard and we think we offer something that you all might enjoy.
I'd love if you guys wouldn't mind giving us a try. Follow us on Twitter at http://twitter.com/thetechblock, or visit the site itself http://thetechblock.com
If you don't like what we're doing, that's cool too. I'd love to hear what you think we can do to improve. <comment><AUTHOR> [http://thetechblock.com](http://thetechblock.com)

[http://twitter.com/thetechblock](http://twitter.com/thetechblock)

</comment><comment><USER2> awesome site great content keep it going and if you get a chance check my site out as well www.reematch.com

</comment><comment><USER2> www.reematch.com</comment>