When Refrigeration Was Controversial - <AUTHOR> http://daily.jstor.org/when-refrigeration-was-controversial/ <comment><USER2> Refrigation also put good, hardworking ice dealers out of business in NYC. Of course, the ice business was controlled by the mafia, but that's just market forces at work.

<comment><USER3> If that had happened in 2016, MA would be taxing GE to pay off the ice mafia.

</comment></comment><comment><USER4> Eggs are rarely sold refrigerated in France, so I don't see why they're taking eggs as an example. Definitely not a seasonal thing in France :D

<comment><USER5> Refrigerating eggs is not 'ubiquitous' as mentioned in the article, the US is more then exception than the norm[1] here.

[http://www.npr.org/sections/thesalt/2014/09/11/336330502/why...](http://www.npr.org/sections/thesalt/2014/09/11/336330502/why- the-u-s-chills-its-eggs-and-most-of-the-world-doesnt)

<comment><USER6> Here in New Zealand it's abut 50/50 whether a household refrigerates eggs. I don't think it's a requirement for restaurants to do so either.

Apparently all eggs in Australia and New Zealand are pasteurised [0]. <edit> looks like I need to work on my critical reading, only egg _products_ like egg whites need to be pasteurised, eggs don't.

Personally, I don't refigerate my eggs, but I tend to go them pretty quickly. I've had them out in the kitchen for over a month before, and they've been fine (it was the middle of winter and a very cold kitchen).

[0]: [http://www.foodsafety.govt.nz/industry/sectors/poultry- eggs/...](http://www.foodsafety.govt.nz/industry/sectors/poultry- eggs/eggs/food-standards-code-requirements.htm)

<comment><USER7> Definitely no requirement to refridgrate eggs in NZ, they're sold unrefrigrated.

After laying eggs are lightly brushed clean, date stamped and packaged, there is no other treatment.

Shelf life is around 3 months, normally about a month beyond the best before date.

</comment></comment></comment></comment><comment><USER8> My grandparents have chickens and they don't need "artificial light" to be tricked in to laying eggs.

</comment><comment><USER9> Here in Europe we still keep them eggs at room temperature, which is a bit of an interesting cultural trivia itself [http://www.latimes.com/food/dailydish/la-dd-heres-why-we- nee...](http://www.latimes.com/food/dailydish/la-dd-heres-why-we-need-to- refrigerate-eggs-20140714-story.html)

<comment><USER10> Europe? Really?

Here in Germany, all people I know put their eggs into the fridge.

<comment><USER11> If you bring them home. In the supermarket eggs are not refrigerated normally where I live.

<comment><USER10> Indeed, they are in the fridge only at home, not in the supermarket.

</comment></comment></comment></comment><comment><USER12> It's fun to be reminded of controversy that happened outside of modern memory.

</comment><comment><USER13> You don't need to refrigerate eggs. They will last for months unrefrigerated.

I'm in the US and I haven't refrigerated eggs in years. Yes, you can buy them refrigerated from the store and just leave them out - absolutely nothing bad will happen.

The only risk is salmonella and that is solved by buying a brand that vaccinates their chickens. (About 50% of US chickens are vaccinated against salmonella so it's not hard to find a good brand.)

<comment><USER8> I didn't know there was a vaccine for that! If we vaccinated all the chickens would it kill off salmonella the way human diseases have been eradicated?

<comment><USER13> Salmonella can infect all animals, so you can not eradicate it this way.

But you can stop it being a problem in human food. Which happened in Europe already and would happen in the US if consumers would demand only vaccinated eggs.

<comment><USER14> SMH To think with our agriculture we use too many antibiotics and not enough vaccines. How backwards is that...

<comment><USER15> Most antibiotic use in animals is not for treating disease, it's for weight gain.

<comment><USER16> In fact, when they first came out the salesmen would use them and get fatter, then have a weigh-in at annual sales meetings! What a vivid demonstration of the benefits of antibiotics. Imagine trying that today.

</comment></comment></comment></comment></comment></comment><comment><USER17> Man time travel would really suck when you find out about 'the controversy' of the day</comment>


IPv4 vs. IPv6 Performance Comparison – Part 2 - <AUTHOR> https://blog.sucuri.net/2016/11/ipv4-vs-ipv6-performance-comparison-part-2.html <comment><USER2> Interesting, because based on these statistics, IPv4 seems to be a better choice. Faster and stable. Curious, not sure if I would expect that.

<comment><USER3> I think that the main reason is exactly what the author mentioned on his conclusion:

"Perhaps the way IPv6 deals with additional headers in contrast to IPv4 may be influencing this difference. This stability is observed most evidently on sucuri.net and cloudflare.com. Interesting, as both domains deal with web security."</comment></comment>


Ask HN: Does anyone have any resources for turning a pastry shop around? - <AUTHOR>

I have a friend that has been running a 'seemingly' successful business. On the outside, their brand holds cachet, and their customers love their products.
They are running a pastry store.
However, for the longest while they have been barely breaking even or running a loss some years. A good deal of it is because they have taken on loan financing in years past to fuel expansion, but things have changed and haven't always panned out like they anticipated.
Bakeries/pastry shops tend to have high overhead because of the many hands it takes to do the actual baking every day.
It's a small shop, with no distribution partners.
Does anyone have any advice/resources that I can use to help them turn their situation around? Perhaps case studies of other turn arounds? Regular resources about how to establish distribution partnerships, etc.
Btw, the founder has a good marketing/product eye, but not so much for the business side of it.
The business is not based in the US.
Look forward to your feedback. <comment><USER3> It's tough to say without seeing the actual financial statements to get an idea of what needs to happen.

Usually, in the restaurant industry when management makes the mistake of taking on debt and opening up break-even/not profitable stores the way to reverse it is to basically close those locations down and cut costs (without impairing the brand) while paying down the debt.

<comment><AUTHOR> So you would say that the best bet is to focus on paying down debt, then trying to grow organically?

<comment><USER3> It's difficult to say without figuring out what their big problem is.

If they have always been struggling to break even then there is either an issue with volume/pricing (depending on the structure between fixed and variable costs).

If they were doing well and then took out a loan + executed the expansion strategy, which caused costs to rise (esp. due to the fixed costs of new locations + increased interest expense) then maybe that is where they need to focus their attention.

<comment><AUTHOR> Another issue has been their pricing strategy. Do you have any resources on how to figure out pricing? i.e. how to calculate COGS - from both variable + fixed costs.

The more I think about it, is the more I think pricing/volume is the bigger issue.

<comment><USER3> Well, let's think about it.

So a bakery is basically a big box where people visit and purchase bread (which is usually made on site).

So the price per loaf * number of loaves sold = Revenues The food costs (flour, yeast, ingredients) and packaging costs = Cost of Goods Sold.

But then restaurants have a whole host of other costs which might be somewhat fixed.

Interest expense, Restaurant Wages, Rent, Restaurant Operating Expenses (utilities, maintenance of the building, repairs), General/Administrative (corporate level costs), Advertising/Marketing expenses.

So the key is to figure out what is going wrong. If you have a bakery housed in a location where the rent is just really high, you'll either need to raise prices on bread (could hurt volume), increase volume, or reduce rent.

If the interest expense is the issue then you need to either restructure the loan or pay the loan off asap.

If they are not profitable, they will want to determine how to become profitable. That's either going to come from increasing volume, increasing prices, or reducing costs. But any of those strategies could have their own drawbacks. Price hikes can reduce volume.

If you switch to inferior ingredients you might reduce volume if it alters taste. If you increase volume you will be baking more bread which will require more by way of labor.

They need to first establish what their problem is, then they can analyze potential solutions.

<comment><AUTHOR> Thanks for the feedback and this feels so simple on paper. Yet when I dive in, the problems just feel insurmountable. But I guess taking it one step at a time.

Perhaps rather than trying to decode their existing pricing, it might be best for us to come up with a brand new pricing strategy that includes profitability from the get-go.

<comment><USER3> What I would say is that if they aren't figuring out a way to keep basic financial statements (which seems to be true) then you should get them to start.

I think it is important to understand what got them into the mess before coming up with a profitable pricing strategy.

Figure out how much bread/baked goods they typically sell. Is is trending up/down/sideways?

Figure out how much it costs to produce that much bread (ingredients + any packaging).

Then the other costs (wages, utilities, advertising, rent) should all be fairly easy to find out since they are typically paid once a month or so.

Get that into a spreadsheet and then start figuring out what the problem is and how to solve it.

For example maybe the bakery has been producing too much bread which has forced them to have a lot of waste. So it could be a leakage problem.

Maybe the prices are set so low that after COGS, there isn't enough left to pay for those operating expenses such as rent, wages.

It's best to think of a business like an organism where every change will have some kind of effect in response.

<comment><AUTHOR> You are right. That's what we had initially set out to do, but I think what happened is we went in and rather than coming up with our own numbers, we were trying to make heads and tails of theirs.

But perhaps we should have gone in, and used a clean slate to start analyzing everything - for a month say.

Then go from there.

Thanks for talking this through with me. It really helped.

Out of curiosity, what do you do? Have you run a bakery/restaurant before? Where'd your experience come from?

<comment><USER3> I research and analyze distressed companies for investment purposes. I spend a lot of time looking at restaurant businesses and they tend to have managers that make the same mistakes over and over.

Here's one of my favorite restaurant turnaround stories. This is probably not applicable to your problem, but I like telling it:

A couple of years ago Steak N Shake (a fast food hamburger chain) was on the brink of bankruptcy because starting in 2002 or so, the management team decided to take on debt and rapidly expand their store-base. So they entered into markets where there was not enough demand for their products and in order to keep up with interest payments, they began raising the prices on all their menu items.

When the recession hit, the sales volume plummeted (for good reason - <USER2> though people liked the food, it was costing too much for them). The management team was in a tough spot because if the company could not pay, they would have to file for bankruptcy.

So they allowed a guy named Sardar Biglari (30 year old from San Antonio, TX) to take control of the company. He started a hedge fund right after graduating from undergrad (sold an ISP he founded back then near the top of the dot com bubble).

Biglari came in and tried to find ways to lower the prices of the menu items in order to increase sales volume and store traffic.

He changed a lot of little things which had inconsequential impacts on taste. He opted for a different kind of styrofoam cup which cost less money, switched from grape to sliced tomatoes in salads (salad sales were very low anyway), picked a different (cheaper) type of napkin they gave, and was able to reduce expenses overall by cutting costs in areas where most people didn't notice. Then he lowered prices a little bit and used coupons to increase traffic, while reminding people why they like the brand so much.

In addition he reduced management salaries and paired the menu down to items where they felt they had an advantage and sold well (do less, but make it your best).

They sold off some of their unprofitable locations and redirected cash flow to completely pay off their debt. The company never had to file for bankruptcy and performs well now.

<comment><AUTHOR> Nice! That's a pretty interesting story, and there can potentially be some parallels to my situation.

I am going to do exactly what you suggested.

I am going to recommend, starting next month, we record everything. All the revenues for all the items (there are more than 60), and all the expenses. Then, from there we see if the 80/20 Pareto principle applies (to both costs and revenues) - I suspect it does.

Then from there, figure out how to allocate costs (because I don't think it is being done properly now).

Then we will see how it goes from there.

Would you mind if I reached out to you via email, if I had any additional questions? I promise not to badger you too much :) If not...no worries.

<comment><USER3> postalservice at gmail.com</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment>


Suit accuses Google of trade secret theft - <AUTHOR> http://news.cnet.com/8301-10784_3-9976405-7.html

<comment><AUTHOR> Here is the press release by the plaintiff's lawyers: [http://www.businesswire.com/portal/site/google/?ndmViewId=ne...](http://www.businesswire.com/portal/site/google/?ndmViewId=news_view&newsId=20080624006035&newsLang=en)

They are seeking $1 billion in damages for stealing their trade secrets.</comment>


The Loneliest Frog in the World - <AUTHOR> https://www.thedodo.com/community/LeilaniMunter/the-loneliest-frog-in-the-worl-773480703.html <comment><AUTHOR> An even more powerful and touching video clip of this frog, as captured by Joel Sartore in his Photo Ark project, can be found in this video (starting around 6:00): [https://www.youtube.com/watch?v=49lzBOB4HB4](https://www.youtube.com/watch?v=49lzBOB4HB4)

</comment><comment><USER2> I wonder... What is the state of the art for cloning amphibians?</comment>


How A Nerd Decides To Get The H1N1 Vaccine - <AUTHOR> http://www.unlimitedmagazine.com/blog/?p=1360#comments

<comment><USER2> I'd much prefer percentages to the flat number of deaths in the article; it's much less misleading.

Assume your chance to contract swine flu is in the upper bound stated in the article, 35%. Multiply that by the pneumonia chance of one in a thousand, .1%. Finally, multiply again by chance of death from pneumonia (20%) and you get a minuscule .007% chance of swine flu death, or seven people out of a hundred thousand.

That's how a nerd decides _not_ to get the swine flu vaccine.

<comment><USER3> Let's review your calculation here:

Odds of getting the flu, feeling like absolute crap for a week, losing a week of work, being shunned by everyone I know for two or three weeks because I'm a carrier of the swine flu, but accidentally giving some of my acquaintances the flu anyway, thus prolonging the epidemic: 35%.

Okay, stop. I'm going to the pharmacy for my vaccine right now. [1]

My only fear is that I'm already too late. I'm not feeling so well today.

\---

[1] Not that I think it's in stock yet, or anything. But maybe I'll call them.

<comment><USER4> _Odds of getting the flu, feeling like absolute crap for a week_

The few people I know that have had H1N1 reported that they actually felt like crap for more like a month, The initial 'flu symptoms' passed after a week, but they were left feeling weak and 'drained' for another 3-4 weeks beyond that.

Personally, I'm tempted to get the shot, and I've never bothered with flu shots in the past out of fear of the side effects (I have a barely functioning immune system).

<comment><USER5> _I have a barely functioning immune system_

That is why you should ask your doctor if you should get the vaccine. Immunosuppressed are on the high risk list and are encouraged to get the vaccine.

</comment></comment></comment></comment><comment><USER6> Well, last time I had an immunization, I went into a coma, so it's a pretty easy choice for me. Otherwise though, I'd have though it'd be a no brainer.

<comment><USER7> Presumably a true nerd would discount personal experience as anecdotal and get the shot anyway. ;)

</comment></comment><comment><USER8> The article is entirely free of side-effect data. Reducing my H1N1 infection probability from 25% to 2.5% might be worth a poke in the arm, but more severe side effects have been reported. If I had to guess, I'd say the benefits outweigh the costs, but without data for both, that's nothing more than a guess.

<comment><USER7> There is also research that suggests that getting a regular flu shot may increase the chance of getting H1N1, so it's possible that the interaction between the various flus and vaccines is more complicated than we thought.

[http://www.theglobeandmail.com/news/technology/science/study...](http://www.theglobeandmail.com/news/technology/science/study- prompts-provinces-to-rethink-flu-p%3E%20lan/article1303330/)

<comment><USER9> Mayhaps or not... via twitter @aetiology (epidemiologist) -- seasonal + H1N1 vaccine: good or bad? New study contradicts unpublished Canadian data: <http://bit.ly/6FP2g> (sounds like both are preliminary)...

</comment></comment></comment><comment><USER10> This is some interesting analysis, but it only considers the negative effects of not getting the flu and neglects the negative effects of _getting_ it.

Consider this poor woman who got dystonia after receiving a flu vaccine: <http://www.youtube.com/watch?v=cEN5KGwNGeo>

She was a cheerleader and how she can't walk.

The nerd logic also neglects the probability that the flu vaccine will actually help. In the lab, 50-80% of the vaccinated resisted the exact same strain, however in the wild, only 10% did not get the flu and the number of hospitalizations was not affected at all.

To do a proper analysis, one must use proper probabilities and statistics and consider the probabilities of outcome with the benefit/harm that could be caused by that outcome.

<comment><USER11> Sometimes I get the feeling that if I got a needle and was hit by a car two weeks later, I could convince people it was a side-effect.

I had my ribcage sawn open by the medical system so they could cut out a piece of my heart and replace it with a chunk of a pig's. I'm still around and doing just dandy. My suspicion is that the people who can do that sort of thing probably have a better notion of what this vaccine will do than I do.

Not that any of this invalidates any of your arguments, of course; I'm just talking.

Edit: Perhaps another way of looking at it would be: I don't really want a doctor who has never written a line of code in his life to tell me how to write a program. I suspect that modern medicine is not quackery and does involve actual expertise, and (equally significantly) that the medical system has a greater amount of medical expertise than I do.

</comment></comment><comment><USER12> I'm not scared of H1N1, I'll take a chance of the flu over the shot. Since I work mostly from home the odds of contracting the flu are lower for me anyway.

</comment><comment><USER13> This nerd will simply wait for his (non-US) government to take that decision for him. I don't have any insight into the current state or effects.

<comment><USER14> That might work for your, but I have the interesting problem of not being in the risk group in my country but for some reason being in the risk group in the US. So which government should you trust?

</comment></comment><comment><AUTHOR> I haven't seen any side effect data aside from the oft-quoted 1 in a million instance of GBS and occasional anaphalactic reactions.

<comment><USER5> Is that statistic based solely on the 1976 vaccine? If so, I'm not sure it's relevant today.</comment></comment>


Can Paul Graham Mass-Produce the Start-up? (video) - <AUTHOR> http://www.inc.com/ss/can-paul-graham-mass-produce-start

<comment><AUTHOR> This inc article is painfully light on details and writing. It also doesn't mention what year (2010 or 2011?) for the June cover. All the same, some might like the pictures.

<comment><USER2> I assume 2011, given: <http://www.inc.com/magazine/20100601/>

Also, it seems more like an "audio/video slideshow" than an article.

<comment><AUTHOR> It might be a pre-publishing announcement for a yet-to-be-released article? I'm really not sure. On the other hand, PG on the cover of inc seemed noteworthy. Congratulations!

<comment><USER3> Monthly print magazines love to name their issues by the month after the one you'll be reading it in, so usually 1-2 months later than the publishing date. It's supposed to make it seem more newsy or something - I assume this is the intended reader reaction: "A message from the future? For me? What an honour!"

That said, the images and the cover look familiar. It also says ©2010. Pretty sure it's from sometime last year.

</comment></comment></comment></comment><comment><USER4> Does anyone know where I can see a larger version of PG's "Famous Whiteboard"?

<comment><USER5> A quick Google image search turns up this:

<http://adam.heroku.com/past/2008/4/23/the_startup_curve/>

The quality isn't great unfortunately. Should be turned into a sculpture or something!

<comment><USER6> I've been looking for that image, and unfortunately haven't found anything higher-quality than that.

If anyone has a large, high-quality version of that image, I'd really appreciate they give us the link.

<comment><USER7> I'm just curious - why do you need one that's higher quality?

You know what's exactly on it and I mean it's a white board drawing... you could go out and buy your own white board and some markers and make the exact same diagram yourself!

<comment><USER6> I'd like to print it out and hang it up.

And of course I can just reproduce it, but it's not the same as hanging up the "original" one.

</comment></comment></comment></comment></comment><comment><USER5> Minor quibble: please put [video] in the title.

<comment><AUTHOR> fixed. I can't actually get to the video, so I didn't notice it.

</comment></comment><comment><USER8> just an FYI: I recorded this video as a compendium to a June 2009 cover story on YC. That article is here

[http://www.inc.com/magazine/20090601/the-start-up-guru-y- com...](http://www.inc.com/magazine/20090601/the-start-up-guru-y-combinators- paul-graham.html)</comment>


Receiving a Telugu character causes CoreText to crash iOS - <AUTHOR> http://www.mobileworld.it/2018/02/14/carattere-indiano-crash-iphone-mac-ipad-144881/ <comment><AUTHOR> "The error we are talking about presents an Indian character that, if received or simply pasted in a text field, can lead to crashes of applications or the entire operating system.

To be precise it is a character of the Telugu language , a Central-Southern Dravidian language spoken in India by about 70 million people."

" the Telugu text bomb when sent to an Apple device causes a malfunction in the CoreText, which is a library of software routines to help apps display text on screens.

The malfunction then causes CoreText to access memory that is invalid, which forces the operating system to force shut down any affected application or even the SpringBoard – a core part of the iOS – if the character finds its way to the notifications screen."

"When converting the Telugu character to HTML entities, it is broken up into 5 different unicode characters.

However, one of those characters is &#8204: a zero-width non-joiner. This is the cause of the crash."

Telugu Script :

[https://en.wikipedia.org/wiki/Telugu_script](https://en.wikipedia.org/wiki/Telugu_script)</comment>


One Smart Cookie - <AUTHOR> http://www.hackerfactor.com/blog/index.php?/archives/708-One-Smart-Cookie.html <comment><USER2> I have no clue why there hasn't been much talk about this. Or is it that the people who know are busy monetizing this information?

I see that this has been in practice since the last few years. [http://stackoverflow.com/questions/8428422/detect-an- msisdn-...](http://stackoverflow.com/questions/8428422/detect-an-msisdn- mobile-number-with-the-browser)</comment>


My first year without social media - <AUTHOR> https://herman.bearblog.dev/quitting-social-media/ <comment><USER2> Doesn't HN count as social media?

Other than HN, I maintain a very light social media presence. Like smoking, in moderation it is fine but in excess it can be fatal.</comment>


Freeze Frame File System – From Cornell - <AUTHOR> https://fffs.codeplex.com/ <comment><AUTHOR> Research paper: [http://www.cs.cornell.edu/projects/quicksilver/public_pdfs/f...](http://www.cs.cornell.edu/projects/quicksilver/public_pdfs/fffs.pdf)</comment>


Telegram - secure, free messaging - <AUTHOR> http://telegram.org/ <comment><USER2> The reason that cryptographers laugh at people who advertise "military grade cryptography" or "we use AES256" is because the choice of crypto primitives is often less important than how they're composed. Those phrases tend to reflect a critical misunderstanding of that, and often mean that a project is using secure primitives in a way that completely undermines their security.

At a glance, while this project is using secure (if aging) primitives, they've made some extremely unusual protocol choices that they need to publicly justify rather than simply describing in an API doc. Just at a glance, the use of modes like Infinite Garble Extension (a failed mode for Kerberos) is troubling, they made up their own KDF (with no proof), and they make what appear to be some amateur mistakes with how they use RSA.

I'm obviously biased, but if you want a mobile-oriented asynchronous messaging protocol, at this point I think the Axolotl ratchet should absolutely be its basis: [https://www.whispersystems.org/blog/advanced- ratcheting/](https://www.whispersystems.org/blog/advanced-ratcheting/)

If Telegram folks are on this thread, I'd encourage you to take a look at the TextSecure protocol. If you think it's interesting, you can federate into our network, get a provably secure asynchronous forward secrecy protocol, and also have access to an existing 10MM user base.

<comment><USER3> Two questions for you:

1\. Kindly be more specific about our RSA implementation. Please note, that we only use RSA with public keys, not private. If you are aware of any possible attacks on this setup, please let us know.

2\. And what problems with IGE are you aware of? Any known attack? As far as we know, it is the ubiquitous CBC that has had issues. And by the way, Kerberos had to abandon PCBC - not IGE.

Thank you for the offer to join in the project you represent. However, we feel that what we are doing is going in a somewhat different direction and has its own potential.

The team behind Telegram, led by Nikolai Durov, consists of six ACM champions, half of them Ph.Ds in math. It took them about two years to roll out the current version of MTProto. Names and degrees may indeed not mean as much in some fields as they do in others, but this protocol is the result of thougtful and prolonged work of professionals.

The basic copy on telegram.org rightfully appears as simplistic to the Hacker News resident. It was written for the general public, since we want to bring secure messaging to the masses — not just to the security geek, who has it already (in oh so many forms).

But for the technically minded we provided rather detailed documentation for our protocol: [http://core.telegram.org/mtproto](http://core.telegram.org/mtproto) and API: [http://core.telegram.org/api](http://core.telegram.org/api)

We would be glad to respond to criticism, but not on the level of "I looked at it for 4 minutes, maybe they didn't think about X" (as another guy in the comments below put it), or "why didn't you just use this?".

If anybody here can identify a specific point and prove that it is vulnerable and can be hacked a certain way, we are ready to respond and\or fix, if neccessary. Gentlemen?

<comment><USER2> _> 2\. And what problems with IGE are you aware of? Any known attack? As far as we know, it is the ubiquitous CBC that has had issues. And by the way, Kerberos had to abandon PCBC - not IGE._

IGE was the first attempt at an "authenticating encryption mode," originally for Kerberos. It was a failed attempt (it does not provide integrity protection), and had to be removed. That was the beginning of a 20 year quest for an authenticating encryption mode that works, which recently culminated in modes like OCB and GCM. I don't see any integrity protection documented anywhere in your protocol spec, so if you're relying on IGE, it's broken.

What's more, any "problems" with CBC (I assume you're referring to padding oracle attacks) are not specific to CBC, and are endemic to IGE as well.

 _> The team behind Telegram, led by Nikolai Durov, consists of six ACM champions, half of them Ph.Ds in math. It took them about two years to roll out the current version of MTProto. Names and degrees may indeed not mean as much in some fields as they do in others, but this protocol is the result of thougtful and prolonged work of professionals._

I don't think their academic credentials or the amount of time they spent on this are the important metrics. If you're trying to suggest that they're thoughtful, the best metric for demonstrating that would be something like a proof for the (honestly naive-looking) KDF they made up.

In essence, the protocol seems to reflect many choices that anyone familiar with the field can immediately identify as suggesting a lack of understanding. It could be that these are simply brilliant moves that we non-ACM champions are too primitive to understand, but if that's true, you need to justify them with proofs in order to support them. Otherwise we're going to interpret them for how they appear.

 _> Thank you for the offer to join in the project you represent. However, we feel that what we are doing is going in a somewhat different direction and has its own potential._

Could you describe how your projects objectives are inconsistent with a protocol ratchet like Axolotol or the full TextSecure protocol?

<comment><USER3> 2\. A passing look at the docs would reveal that we do not use IGE that way, and instead use SHA1 for integrity check (see 'message key' here: [https://core.telegram.org/mtproto/description](https://core.telegram.org/mtproto/description)). The problems you mentioned as endemic to IGE used for integrity verification, are therefore irrelevant in this case.

As for KDF, going for slower provable algorithms used for each incoming\outgoing packet may be a preferred solution for projects aimed at the relatively small security crowd. But we don't really compete in this area, our competition is WhatsApp and other mass market messengers.

<comment><USER4> _As for KDF, going for slower provable algorithms used for each incoming\outgoing packet may be a preferred solution for projects aimed at the relatively small security crowd. But we don 't really compete in this area, our competition is WhatsApp and other mass market messengers._

What's this mean? You've created your own KDF, and the questions were: why is it secure, and why didn't you use an already-proven KDF? Unless I'm misreading something, it sounds like you've responded, "It's not that important, because our target market isn't people who care about their security." Is that correct?

EDIT: Judging by the upvotes, at least 5 other people are interested to hear your thoughts on this. Considering this submission is almost off the frontpage, that's a lot. As a security product, you should consider clarifying your position on this, because your statement currently sounds like, "We don't think security is a big deal since it's not a big deal to our target market."

<comment><USER3> No. What we mean is, as I've just noted in the reply to tptacek, that so far no attack was named that could harm the setup as described in our docs. And since this setup also delivers the performance that we require in terms of speed, we do not see why it would be necessary to change our approach to KDF.

<comment><USER5> > so far no attack was named that could harm the setup as described in our > docs

Even as a complete newbie in cryptography I can see a problem in your reasoning. "Guilty until proven innocent" is the default when judging on a system. "No attack was named" because Telegram uses algorithms combination that was not proven with time. Nobody used them like this before. Why would anyone try to break it if it wasn't used?

As a potential user of Telegram I don't trust it enough to use it. It's more likely that someone with resources (e.g. government) could eventually break your system than it could break another - time-proven - system.

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> I have not run the app, but from the Android source code it looks like this "secure" app is uploading your contacts including full names and all their phone numbers into the "cloud":

MessagesController.readContacts() [0] is called on creation of the MessagesActivity. When invoked for the first time, it collects first names, last names and phone numbers from the Android Contacts interface, creates a table containing the data, and passes that to importContacts() [1], which performs an RPC call to "the cloud", passing the contact list upstream and obtaining a server-processed list as a reply.

For me this is a major trust breach, and makes all the fuzzy claims about the app's security absolutely worthless.

[0] [https://github.com/DrKLO/Telegram/blob/master/TMessagesProj/...](https://github.com/DrKLO/Telegram/blob/master/TMessagesProj/src/main/java/org/telegram/messenger/MessagesController.java#L555)

[1] [https://github.com/DrKLO/Telegram/blob/master/TMessagesProj/...](https://github.com/DrKLO/Telegram/blob/master/TMessagesProj/src/main/java/org/telegram/messenger/MessagesController.java#L1323)

<comment><USER3> That is correct, Telegram does upload names and numbers — naturally, after receiving permission to do so. (see also: [http://telegram.org/privacy](http://telegram.org/privacy))

Apart from identifying Telegram users among the user's friends, this also enables us to use proper names in notifications on the iPhone, as well as facilitates moving between devices.

But you have highlighted an important issue. Our android developer relied on the system prompts when it comes to uploading contacts, which is definitely not enough for the issue at hand. We will add another prompt in the coming version. (As well as update the GitHub code to the current generation soon, it's been becoming a little stale.)

<comment><USER6> _naturally, after receiving permission to do so._

This is not quite true. I never gave anyone (especially not the users of WhatsApp or Telegram) permission to upload my personal information to any cloud services. You can not actually imply that permission from all contacts merely by asking the user.

 _this also enables us to use proper names in notifications on the iPhone_

I do not know enough about the iOS internals, but my naive assumption would be that after receiving a push notification, you can run code locally (like get the contact name from a local database), not merely get the notification displayed by the OS.

 _We will add another prompt in the coming version._

This is an improvement, but unfortunately does not tackle the first issue I mentioned, with implying consent from the actual contacts.

<comment><USER7> _" I never gave anyone (especially not the users of WhatsApp or Telegram) permission to upload my personal information to any cloud services."_

On Android you do by granting rights to access your contacts and give full network permissions. So you never know what a program will do with your contacts and a network connection.

<comment><USER6> But in the real world,your contacts never told you "feel free to upload my name and all my phone numbers wherever you want, so we can be linked by some cloud service to improve their click-through rates". An app that uploads your contacts is violating the privacy of your friends, even if it asks _you_ about it.

</comment></comment></comment></comment></comment><comment><USER8> From their FAQ:

> _Q: How secure is Telegram?_

> _Very secure. We are based on a new protocol, MTProto, built by our own > specialists from scratch, with security in mind. At this moment, the biggest > security threat to your Telegram messages is your mother reading over your > shoulder. We took care of the rest._

Oh good, a bunch of randoms have rolled their own crypto. I stopped reading at this point.

<comment><USER9> "Oh good, a bunch of randoms have rolled their own crypto. I stopped reading at this point."

An ad-hominem attack. This is Hacker News and their work is open, how about making a statement after researching the actual code instead?

<comment><USER10> In this case, even if you remove the ad-hominem attack (a bunch of randoms), a valid point remains: implementing crypto is already notoriously difficult, let alone designing cryptographic protocols.

<comment><USER3> Still, there are sometimes valid reasons for not re-using existing solutions.

In our case, we needed something that is both secure and competitive in comparison to mass market solutions in terms of speed, working on weak connections and usability.

Disclaimer: I work for Telegram.

<comment><USER6> It is a really bad idea to compromise security for speed and connection stability. Processing power is a question of scaling the hardware, communication speed is hardly affected by a proper encryption scheme, neither is reliability of the application-layer protocol.

Usability, however, is a different beast. You must compromise security to make a chat application appeal to "regular" users. Still, this is a trade-off that can be clearly communicated to the user and to developers, and does not require a custom crypto protocol. You can achieve the same effects with using existing and tested libraries.

 _Edit:_ Disclaimer: I am the developer of the yaxim Android XMPP client and the operator of the public yax.im XMPP server (both available at [http://yax.im](http://yax.im)).

<comment><USER11> Thank you for the plug for yaxim. I've been searching around for a "good enough" jabber client for android, and while yaxim isn't there yet (for me: no otr support, single server) it looks like it's headed in the right direction!

<comment><USER12> Have you looked at ChatSecure? It has OTR, multiple servers, all that good stuff. It's not wonderful but it ain't bad (curious to hear what others have to say, I haven't really used much else)

<comment><USER11> I have it installed, but not really looked at it. My last "burst" use of xmpp was via facebook -- as most of my contacts don't use "plain" jabber right now. Before that I used it a bit for work -- but then rarely on my phone.

Now that google is killing talk in favour of proprietary hangouts, I predict it'll be a while before I'm a serious xmpp user again.

Sadly it's very hard to push process changes when one are in the minority in a group... Thanks for the reminder though, it does look like it full-fills most of my needs (and fixes annoyances I've encountered with other android clients).

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER13> Looking at [1], it has several red flags.

The replay protection is overly complicated and doesn't kick in _after_ the message is decrypted. This makes it possible to DoS the server with forged messages.

Key derivation uses a custom scheme. Typically there's no reason NOT to piggy- back on existing schemes and there's plenty to choose from - from TLS to IKE.

Also, as already mentioned, there's again NO reason not to use TLS in Anonymous DH mode with an app-level authentication of the session handshake.

Designing your own crypto protocols is a very interesting challenge, but for practical purposes you just _have to_ recycle existing designs. There's really no other way about it. A custom crypto doesn't make any difference for those who doesn't know/care about it, but it certainly will not make you any friends between those who does. Unless, of course, you can explain and prove why your design is better than those that exist already, and these guys don't do this.

[1] [http://core.telegram.org/mtproto/description](http://core.telegram.org/mtproto/description)

<comment><USER3> The reason for designing something new was this: in order for really secure messaging to catch on among the masses today — it needs not only be secure. When you want to compete with the likes of WA, you also need be fast and reliable on weak mobile connections.

TLS/HTTPS is slow and takes a lot of time to restore connection on fragile networks.

MTProto was born as a result of an experiment: whether it would be possible to create something that is both secure and fast.

Disclaimer: Unfortunately, I'm not Nikolay. But I do work for Telegram.

<comment><USER13> This is all great, but it reads like a marketing speak. There was this imperfect world full of idiots, slow, ugly and dim lit and then we came along and lifted the gloom.

Sorry, you have to do better than "TLS/HTTPS is slow". _Anything_ over TCP is slow on congested and lossy networks. That's given, but that's hardly a reason to reinvent the whole crypto stack.

How is your protocol superior / faster / better than DTLS with session resuming? Is it faster than IKE in Quick Mode or IKE v2, which are both datagram protocols designed to work over lossy networks? What are the inherent problems with adopting DTLS or IKE to your purposes? This is dead easy to do without touching original crypto design _and_ it instantly removes all questions pertaining to the quality of your crypto design. So why not?

I'm not a professional cryptographer, but I know applied crypto well and I've seen my share of custom crypto designs. Virtually ALL of them are is a result of thinking that it's better and easier to invent something new than to diligently learn what exists and understand how it works. It's fine for some areas, but it is decidedly not a way to go in the cryptography domain.

</comment></comment></comment><comment><USER14>
        The important thing to remember is that all Telegram messages
        are always securely encrypted. The difference between messages
        in Secret Chats and ordinary Telegram messages is in the
        encryption type: client-client in case of Secret Chats,
        client-server/server-client for ordinary chats.

Where "securely encrypted" means that the Telegram server has full access to message contents for ordinary chats. All chats should be "Secret Chats", not the other way around.

<comment><USER15> Came here to say this. I also don't understand why "secret chats" can't be kept in the cloud. Why can't they store encrypted messages and give them to me to decrypt when I want to?

<comment><USER16> My guess is that it's a security thing. Even if they don't know the security key, I would prefer if they kept no record of the message.

The real issue is that they could just make a lever that would still store "secret chats," unless if they're being delievered p2p.

</comment></comment></comment><comment><USER17> So many dubious claims on just the front page:

* 'delivers messages faster than any other application' \- _any_ application? Hmmm. They must be using magic.

* 'messages are heavily encrypted and can self-destruct' \- but like every system, the self-destruction is not assured since it's impossible to enforce.

* 'keeps your messages safe from hacker attacks' \- a bold claim. Maybe they do some stuff to protect messages, but it's not the perfect safety that this statement implies.

<comment><USER18> Have you tried the app? I've moved my top-5 chats from WhatsApp just because of speed! The messages are sent really fast. But if you know any other messenger apps for iOS, which are just about so fast, I'll definitely give them a try.

Anyway yep, these marketing stuff is a bit too dubious, but what should they write?

* is rather fast, faster than some applications

* can self-destruct, but sometimes can not (Ha!)

* etc

That's not the thing that happens in real world nowadays.

<comment><USER19> > Anyway yep, these marketing stuff is a bit too dubious, but what should they > write?

How about some benchmarks to support this claim?

</comment></comment></comment><comment><USER20> > Telegram is decentralized!

Great. Then...

> Telegram servers are spread worldwide for security and speed.

So this is what they mean by decentralized....

> As a result, Telegram is the fastest and most secure messaging system in the > world

And this has exist for how many years?

I can probably say everything except private message, google hangout or Facebook chat is already doing it. They have some of the top-notch security, network and distributed system developers and they have their own cable delivering more volume than your new service can combine together. and if I want true privateness? I'd one-time pad everything. in reality, I guess PGP is good enough.

<comment><USER21> > _I can probably say everything except private message, google hangout or > Facebook chat is already doing it. They have some of the top-notch security, > network and distributed system developers_

... and they are based in US of NSA - no thanks.

<comment><USER20> As an American I fear the NSA but at the same time to be fair, NSA is not the only intelligence doing this sort of work. Let's be fair, every other governments are doing similar things anyway, so maybe we should say no thanks to every other website.

</comment></comment></comment><comment><USER22> People here are complaining a lot about this app, and rightfully so. However, this is definitely the best encrypted communications app there is for ios and therefore also the only app that is cross platform and able to reach a wide audience. I know they didn't do it completely right, but it definitely seems to be the best option that is currently available.

<comment><USER6> An "encrypted communications app" that is not using secure encryption is worse than an unencrypted one - the users get a fake feeling of security, and might reveal sensitive information to whoever is listening.

Regarding real security, have a look at ChatSecure, which is available for iOS and Android, uses standard encryption protocols (XMPP with TLS, OTR), is open source, and was developed by the Guardian Project (who have a track record of developing security software):

[https://itunes.apple.com/de/app/id464200063](https://itunes.apple.com/de/app/id464200063)

[https://play.google.com/store/apps/details?id=info.guardianp...](https://play.google.com/store/apps/details?id=info.guardianproject.otr.app.im)

<comment><USER22> Yes, I have been using chatsecure and I know it is much more secure but it is almost unusable on ios because it can not run in background.

As for the false sense of security, you're probably right.

<comment><USER6> _but it is almost unusable on ios because it can not run in background_

Unfortunately, the only way around that is to integrate with Apple's Push Service, which means you need to run a server-side component which notifies Apple (and which in turn notifies your app). This is not specified for XMPP, so most "XMPP clients" for iOS instead store your credential on the app developer's infrastructure. However, this problem is being worked on:

[http://legastero.github.io/customxeps/extensions/push.html](http://legastero.github.io/customxeps/extensions/push.html)

<comment><USER23> I am working on a protocol-agnostic, federated push messaging layer for ChatSecure-iOS but it will be interesting to see if anything else pops up in the meantime.

</comment></comment></comment></comment></comment><comment><USER24> Is HTTPS not secure channel for communication between client-server? What is the reason behind using an entirely different protocol for client-server communication[0] over HTTP?

[0] - [http://core.telegram.org/mtproto](http://core.telegram.org/mtproto)

<comment><USER25> I also don't get this. If we stopped trusting HTTPS, how are we supposed to make sure that we get an unmodified app from the play store, or the original source code from GitHub in the first place? Am I missing something?

<comment><USER26> The fact that we have to trust TLS to deliver software doesn't automatically mean that we should trust it for secure messaging.

Also, I think App Store software delivery doesn't depend on only TLS, but also on Apple's signature. And you can visually verify that the source code downloaded from GitHub doesn't contain backdoors.

<comment><USER25> My knowledge on cryptography is next to nothing. Would you mind explaining to me what makes the case for secure messaging different than any other transfer through a secured HTTP connection? I also read a bit on OTR Messaging and the "Socialist Millionaires' Protocol" but just got even more confused.

<comment><USER26> It's not that messaging can't use TLS, of course, it can. I'm objecting to the absolute (if we don't trust TLS for messaging, we shouldn't trust it one-time download), e.g. see [https://en.wikipedia.org/wiki/Threat_model](https://en.wikipedia.org/wiki/Threat_model)

</comment></comment></comment></comment></comment><comment><USER27> A lot of haters in this thread. To be expected.

I've been following this space for a while and telegram is the best app out there right now. The usability is great and they are trying to do the right things when it comes to security.

The apps are open source and can be audited. I fully expect there to be bugs, that is part of the process! You would be insane to trust your life to a crypto app thats been around a few months. So yes, there will be bugs. But that doesn't mean they should just give up. In a few years this could turn into a really nice , secure app.

I think their big competition will be: Textsecure, also a great app and better for security due to OTR. But the iphone app is still in development as is their data channel. Once those are complete, they could take the #1 spot.

Also, hemlis is one to look out for. But they take about the same security approach as telegram but seem to be less open so far.

<comment><USER28> They are making a lot of bogus claims using marketing speak, and they are very low on details, while saying the app will be opensourced "eventually".

For a "security" app, hell yeah you should be skeptical. Right now I think the most interesting and most trustworthy secure messaging projects are TextSecure v2 and Dark Mail (granted, that one isn't even out yet, their ideas so far sounded quite good).

<comment><USER29> But the clients are open sourced: [http://telegram.org/source](http://telegram.org/source)

</comment></comment></comment><comment><USER30> Where's the desktop app? I guess I'm old fashioned, because I'm looking for the next msn/icq.

<comment><USER31> Mac [https://itunes.apple.com/us/app/messenger-for- telegram/id747...](https://itunes.apple.com/us/app/messenger-for- telegram/id747648890?mt=12)

Win [https://tdesktop.com](https://tdesktop.com)

</comment></comment><comment><USER32> To whom it may concern: Pavel Durov, one of the authors of Telegram, announced he will pay $200K (or 200 BTC) to decrypt his traffic [http://tjournal.ru/paper/durov-decifer- telegram](http://tjournal.ru/paper/durov-decifer-telegram)

<comment><USER5> Yes, but not yet. He _plans_ to announce the reward in a week. No encrypted traffic published yet.

</comment></comment><comment><USER33> >Q: Who are the people behind Telegram?

>Telegram is supported by Pavel and Nikolai Durov.

I would not trust social network owner with my messages.

<comment><USER34> This is what the wikipedia says about Pavel[0]:

>Durov holds libertarian economic and political views and says he is a vegetarian and identifies as a Taoist. He published anarcho-capitalist manifestos describing his ideas on improving Russia. On his 27th birthday, he donated a million dollars to the Wikimedia Foundation.

Well, I think I'd rather trust them than Google or Facebook, after all, you've got to trust somebody.

[0] [http://en.wikipedia.org/wiki/Pavel_Durov#Personal_life](http://en.wikipedia.org/wiki/Pavel_Durov#Personal_life)

<comment><USER35> > you've got to trust somebody.

Better the devil you know?

</comment></comment></comment><comment><USER36> Their HTTPS server isn't configured with the right certificate :(

Firefox gives me "The certificate is only valid for the following names: *.stel.com , stel.com" for [https://telegram.org/](https://telegram.org/)

<comment><USER26> Looks fine [https://www.ssllabs.com/ssltest/analyze.html?d=telegram.org&...](https://www.ssllabs.com/ssltest/analyze.html?d=telegram.org&hideResults=on)

</comment></comment><comment><USER37> The authors' education credentials are impressive, and I admire their initiative. However, they do not seem to have employed a cryptographer to review their design and protocols, so I expect that serious security problems will be discovered.

Personally, my expertise is rather in application security, so I will review some of the source code over the holidays. At first glance the C client is not bad.

The real metric of this project's success will be how they react to criticism, harsh as it may be. I hope they learn from their inevitable mistakes and succeed in the long term.

</comment><comment><USER38> And it's based/hosted in the US: will not use.

<comment><USER39> Other countries are doing wholesale spying too and analogues to NSLs exist elsewhere, albeit without a gag orders, e.g. RIPA in the UK.

</comment></comment><comment><USER40> why does HN comments have to be so negative all the time? its very depressing to read through HN comments.

<comment><USER41> Because intelligent, educated folk don't blindly accept the claims of others without scrutinizing them?

I don't see it as negativity. People are bringing attention to the details that marketers typically omit (perhaps intentionally). If anything, these are positive discussions as we're sharing our own views and experience to give others more information to allow them to make more informed decisions. (i.e, whether the claims of security can be trusted in this case.)

If you want comments that are always happy and positive about every claim made by marketers, there's plenty of other places on the web for that.

</comment></comment><comment><USER42> Everybody is so negative here. Ok rolling your own security protocol might not be the best move. However, they want to be competetive with whatsapp.

Most people who try to make a whatsapp killer suck in uix. But this app is really good and fast. I think its better than whatsapp in a multitude of terms.

Okay, there are improvements. But I can submit a pull request to the android app and improve it myself! How Awesome!

<comment><USER43> I fully agree. Everybody can surely agree this is vastly better that WhatsApp despite it's shortcomings.

</comment></comment><comment><USER44> [http://telegram.org/privacy](http://telegram.org/privacy)

That such a policy even exists should suggest that "secure" is the wrong way to describe this. Reading through this, it looks like _yet another attempt_ at what Lavabit and Hushmail were trying to do. In other words, snake oil.

</comment><comment><USER45> "How is Telegram different from WhatsApp? Unlike WhatsApp, Telegram is cloud- based"

Yeah, ok. Decided not to use it right there.

</comment><comment><USER46> More info about their secure protocol is here: [http://core.telegram.org/mtproto](http://core.telegram.org/mtproto)

technical description here : [http://core.telegram.org/mtproto/description](http://core.telegram.org/mtproto/description)

</comment><comment><USER47> Devs of this app: Don't be disappointed by these harsh comments because most of them contain technical fixes you need to do asap!

These suggestions, if implemented/fixed will surely get you some really dedicated early adopters!

</comment><comment><USER48> tptacek should write up a block like [http://craphound.com/spamsolutions.txt](http://craphound.com/spamsolutions.txt) for everytime somebody rolls up their own crypto solution.

</comment><comment><USER49> Awesome Fallout-style icons.

<comment><USER50> Open Api hasn't been this sexier !

</comment></comment><comment><USER51> Like Threema, they use the PGP model, instead of OTR...

<comment><USER52> What do you mean exactly? According to the FAQ, Threema offers perfect forward secrecy:

Yes, Threema provides forward secrecy on the network connection. Client and server negotiate temporary random keys, which are only stored in RAM and replaced every time the app restarts (and at least once every 7 days). An attacker who has captured the network traffic will not be able to decrypt it even if he finds out the long-term secret key of the client or the server after the fact.

<comment><USER51> Oh, I thought Threema crypto is based on RSA+DH, but according to the FAQ they use the NaCl library. That's quite nice!

</comment></comment></comment><comment><USER53> If this is closed source (and the source seems to be only implementing API calls to a closed system) then it's fair to assume that this application is probably insecure or has backdoors.

Also if the private key is stored in the cloud then it's likely to be subject to requisitions.

<comment><USER3> Private keys for secret chats are only stored on the two participating devices.

As for server code — open sourcing the server code wouldn't really do much to improve trust. You would still have to trust us that we are using THAT code, not something different.

<comment><USER54> Depending on your definition of "decentralised", open sourcing the code would enable _other_ people to set up servers that they can trust is running that code.

</comment></comment></comment><comment><USER55> Looks like they kept the interface exactly the same as What's App to attract users. The smiley selection has the entire list of What's App smileys in exactly the same order. What's App is going to be upset, but it might help users.

<comment><USER46> I always that it was just the order of the emoji unicode range

<comment><USER56> I think it is, the default android keyboard is using the same emojis

</comment></comment></comment><comment><USER57> I see source code for clients, but nothing for the server side.

Are they using something standard or do they want to lock-down users to their own proprietary servers ?

</comment><comment><USER58> Not sure how uploading all of your contact information to their servers counts as "taking back our right to privacy."

</comment><comment><USER59> I don't understand, how is this thing on top of hacker news, while it's being deconstructed like it's a toy ?

<comment><USER60> My suspicion: peoples with little idea on the topic vote it up, while the knowledgeable vote it down.

</comment></comment><comment><USER61> How can this be free? They're not Wikipedia. I'm not sure how they can pay for multiple servers...

<comment><AUTHOR> [http://telegram.org/faq#q-how-are-you-going-to-make-money- ou...](http://telegram.org/faq#q-how-are-you-going-to-make-money-out-of-this)

The brothers do have some money, I suppose, from their company. However, I'm not sure if they are using the data gathered from this service, thus resulting in revenue somehow (maybe in their social network).

</comment></comment><comment><USER62> Random observation. What's with the crossed out "h" in chats on the landing page?

</comment><comment><USER63> This is not distributed at all. IRC is distributed.

Messages stored on cloud! Big privacy problem.

Just tall marketing claims.

</comment><comment><USER64> How about desktop clients? Being restricted to mobile devices is not very practical.

<comment><USER65> Mac OS X desktop client is available in the App Store

</comment></comment><comment><USER66> If this get popular and the people behind it can be trusted, this could replace sms and e-mail. The iOS, Android and CLI clients are open source, but I they need to open source the backend too. I also like the idea of giving the noun "telegram" a new meaning.

<comment><AUTHOR> Replacing SMS I can see, since whatsApp/GroupMe/iMessages/whatsoever is already doing so, but replacing e-mail? Why would it replace e-mail in your opinion? I think IM/chats have a completely different purpose compared to e-mail, which unfortunately is often times used wrongly imho.

</comment></comment><comment><USER67> "Cloud based" eh? Very secure.

<comment><USER67> and apps on iOS and Android - no possible way data could leak there.

</comment></comment><comment><USER68> Where have I seem this logo before...

</comment><comment><USER69> How does this operation make money?

</comment><comment><USER70> Snake oil

</comment><comment><USER71> Open != API

<comment><USER71> sorry... did not see that the source code is available for all platforms including iOS.

</comment></comment><comment><USER72> nice

</comment><comment><USER73> How does this compare with Wickr?

</comment><comment><USER74> Wow, there are so many cryptography experts with world names in this thread!

And interesting why you think that it's not possible to read most of cryptography/cryptanalysis books and check common mistakes of implementation afterward? Do you really think that this is _THAT_ hard?

Your scepsis would be understandable if they used _OWN_ cryptoalgorithm. However their protocol is based on well known strong crypto.

<comment><USER75> Yes, it's THAT hard. I'd read many good books and still feel bad looking on my first attempts in protocol design.

BTW, IGE cipher mode isn't well known for being strong.</comment></comment>


Show HN: Procrstn8 - A Reddit client app for Windows 8 PCs and Tablets - <AUTHOR> http://apps.microsoft.com/windows/en-US/app/procrstn8/3281101b-3774-4700-b5e8-6c78550d36cc

<comment><USER2> I am currently at work. Will download your app and take it for a spin once I am back home. However, a couple of remarks based on the screenshot: \- Please offer a light theme. \- Indicate the domain hosting the content. \- Differentiate videos from other content.

You can take a look at how Reddit ET does it. I think that's a layout that can scale really well on tablets and desktops.

</comment><comment><USER3> Because I need more ways to waste time. The name fits perfect though :)

<comment><AUTHOR> :)

</comment></comment><comment><AUTHOR> thanks for comments. I am adding more features, will consider your feedback. BTW, the app already shows the domain at the top of the post page.

</comment><comment><USER4> Sorry, hackers don't like Microcrap.

<comment><USER5> I think we're well past the days of Microsoft being the evil empire[1] and I'm happy someone else is building an alternative to Android and iOS.

Whether that alternative will actually take off is highly questionable but more choice is better for consumers and hackers alike.

[1] For one thing Steve Ballmer seems too incompetent to make an effective villain.

<comment><USER6> It has nothing to do with being an evil empire and all to do with being evil. It doesn't matter if they're ruling or dying. Just because they're not alone in sucking badly doesn't mean they don't, and if we need Microsoft of all companies to provide an "alternative", that's an argument against the current situation; not for Microsoft.

That said, the word "hacker" has so many definitions it's completely useless anyway, it describes nothing. So don't take this as an agreement with the post you replied to, I would have said "people with dignity" instead of "hacker" haha.

In my books, lack of vowels is the real deal breaker.</comment></comment></comment>


New U.S. Visa Fees Would Hit Indian Firms.com - <AUTHOR> http://online.wsj.com/article/SB10001424052748703988304575413011107101860.html?mod=rss_whats_news_us&utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+wsj%2Fxml%2Frss%2F3_7011+%28WSJ.com%3A+What%27s+News+US%29 <comment><USER2> Mostly Indian ones, but the provisions apply to any firm with >50 employees and >50% of whom have H-1Bs. Probably doesn't affect many people here.</comment>


The Firefox Browser is a privacy nightmare on desktop and mobile - <AUTHOR> https://www.privateinternetaccess.com/blog/the-firefox-browser-is-a-privacy-nightmare-on-desktop-and-mobile/ <comment><USER2> An overstatement.

> [...] then that telemetry data all of a sudden becomes the most personal of > data.

> What does Firefox telemetry data include? According to the Mozilla wiki, > telemetry data includes all the information needed to answer the following > questions:

      How long does it take Firefox to start?
      How long does it take Firefox to load a web page?
      How much memory is Firefox consuming?
      How frequently do the Firefox cycle collector and garbage collector run?
      Was your session successfully restored when you last launched Firefox?</comment>


Gates, Bezos invest in cancer blood test - <AUTHOR> http://quadrangleonline.com/2016/01/11/gates-bezos-invest-in-cancer-blood-test/ <comment><USER2> Serum nucleic acid sampling to screen for malignancies has a few problems. One issue is that it runs into the realities of Bayes theorem.

You may want to consider what happened to Pathway Genomics. Their screening test claiming to detect 10 cancers in healthy people drew the ire of the U.S. Food and Drug Administration past year, which sent the company a letter saying:

"We have [...] examined published literature and have not found any published evidence that this test or any similar test has been clinically validated as a screening tool for early detection of cancer in high risk individuals," the letter states.

... We have reviewed the information presented on your website in the white paper, entitled "Liquid Biopsy for the Detection and Monitoring of Cancer: Analysis of 96 Hotspot Mutations via Plasma Derived Circulating Tumor DNA," dated September 2015. It is unclear how the literature that you cited, addressing the presence of circulating tumor DNA (ctDNA) in already-diagnosed patients, is adequate to support the expansive claims of screening for early cancer detection using ctDNA in undiagnosed patients for up to 10 different cancers with the CancerInterceptTM Detect...

We believe you are offering a high risk test that has not received adequate clinical validation and may harm the public health.."

For the full letter from the FDA, see [http://www.fda.gov/downloads/MedicalDevices/ResourcesforYou/...](http://www.fda.gov/downloads/MedicalDevices/ResourcesforYou/Industry/UCM464092.pdf) ( it is a pdf )

<comment><USER3> According to the Warning Letter, Pathway never registered with the FDA, never received clearance, and never performed any (reported) clinical trials. The key sentence from the letter is:

"We have conducted a review of our files and have been unable to identify any Food and Drug Administration (FDA) records reflecting the approval, clearance, or listing of these devices."

They were seeking to fly under the radar as a "lab-derived test" or LDT, using an FDA loophole that the FDA is increasingly seeking to close (also see Theranos). The "we've reviewed the literature" part is just the FDA's attempt to dig into what's been published to see if they can find ANY support for their marketing claims — even if there were volumes of papers on their method, they still would have been sent the warning letter (which is a Very Serious thing to get from the FDA).

The issue wasn't that "this test is too risky for us" it's that they were 100% out of compliance. If you sell a medical device, it must be classified for risk and at the very least registered with the FDA. In the case of a cancer diagnostic, there is zero chance it would be a Class I (lowest) device, so they (at least) would have needed "clearance" requiring a submission of something called a 510(k) documenting tests they've done on their product, audits of suppliers, etc. etc. In addition to the 510(k) submission itself, they would need documented evidence of having put in place a "quality management system" that puts standard operating procedures around 100% of product development from cradle to grave. This is why health tech/biotech companies need to raise so much money, as this is a lot of overhead.

If their test were classified as Class III (highest risk), they would need "approval" rather than "clearance," the bar for which is even higher (although this is primarily limited to ingestibles/implantables). Just the FDA submission itself costs something like a quarter million dollars.

GRAIL, on the other hand, is raising a huge amount of money partially because they know how much it costs to run proper trials and earn a clearance or approval. It's apples and oranges to compare the two.

<comment><USER4> Some example of Class III devices from Wikipedia :

> Examples of Class III devices that currently require a premarket > notification include implantable pacemaker, pulse generators, HIV diagnostic > tests, automated external defibrillators, and endosseous implants.[19]

I don't see how an cancer test can not be less than Class III. A misdiagnosis is potentially lethal.

<comment><USER5> A CBC (complete blood count) test is a class I...

<comment><USER6> There are also major medical training systems, for technicians and pathologists, who perform and interpret them.

The devices are class 2. Putting a QBC Star in every primary care clinic improves the quality of care delivered across the board and they are designed toward sensitivity: an automated counter has to have a low threshold for abnormal, which then kicks it to a human for review.

And the techs are trained to kick anything that looks like a blast to a pathologist. And it's not a one-time, in the school house tid-bit of education: every time they do a manual diff, they can't get from their cell counts to the signature block without acknowledging they need to show blasts to a pathologist.

</comment></comment></comment></comment></comment><comment><USER7> I think people will be having monthly or weekly blood tests in the future. It will require just a drop of blood and many more conditions will be detected much cheaper and faster than now

<comment> nommm-nommm I think that is an awful idea! Overdiagnosis and overtreatment is a huge problem right now! Here is a basic overview: [https://www.sciencebasedmedicine.org/screening-for- disease-i...](https://www.sciencebasedmedicine.org/screening-for-disease-in- people-without-symptoms-the-reality/)

<comment><USER7> You are right, my brother is a doctor and he has been telling me about this.

I do think though that this is due to our lack of understanding of health on many levels, and will be alleviated by better understanding of how these complex systems work. Machine learning will help a lot here

</comment></comment></comment><comment><USER8> Are there stored sources of testable blood (blood banks?) that would be suitable? I would imagine that making predictions where we already know the outcome would be useful.

<comment><USER6> This is the idea of the deep freeze biorepositories that have been funded (and defunded). One of my friends is a molecular pathologist who does the MaterniT21. The data is quite tantalizing, because you're just going along looking for trisomy 21 and, wham, there's this case with tons of cell-free DNA that doesn't align, you call the provider, and the woman's been having constipation, the GI doc does a colonoscopy and she's got a fungating mass in her cecum.

But that's a long way from detecting small tumors. Which is something I'm not sure people understand: you need a big tumor to spill enough cell-free DNA to detect.

</comment></comment><comment><USER9> First step is remission monitoring.

<comment> c-slice For cancer screening? That doesn't make much sense.

<comment><USER6> No, in the regulatory pathway, it's easier to start with people who are already terminal and work your way back toward less sick people.

</comment></comment></comment><comment><USER10> I've often wondered about things like this, I've wondered if improving medical technologies like this end up disadvantaging the poorer countries. If by increasing the life span of the wealthy west we pull more resources away from the rest of world? It seems as we get better at keeping ourselves alive we require more and more to do so.

I have no idea if I'm even close to correct in my speculation, but I bring it up as the Gates foundation investing in this seems to go against my hypothesis.

<comment><USER11> WTF? You don't think that cheaper technologies are going to be available to other countries?

How much do we spend on cancer in the US alone? It's astronomical. If a simple blood test can catch it faster, that's going to save us a bunch of money, and increase productivity (people living longer). Why would this not also benefit third-world nations? It'll probably have a _bigger_ effect there because instead of people dying because they can't afford expensive treatments for later-stage cancers, they'll be able to get cheap treatments early on and live.

This complaint of yours sounds like someone in 2006 saying "we shouldn't have these smartphones because people in poorer countries can't afford them, and it'll give us too many productivity and economic advantages over them". Meanwhile, here in 2015, everyone and his brother in India and China has a smartphone, and in fact third-world nations in general have done a much better job of pushing cellular technology to the masses than the US has, thanks to our telecom cartel which keeps service plan prices absurdly high.

<comment><USER10> I'm sorry I didn't mean to offend. My comment was not meant as a complaint, or a statement of fact, but as wild speculation. It was my hope that by voicing such wild speculation I'd learn something, and I have.

In no way do I think it's a bad idea to seek better medical treatments ever, I just worried that it might further the gap between the haves and the have nots. If one solution creates another problem sometimes best solution can be to fix the new problem.

<comment><USER11> Sorry if I was a bit harsh, but it just seemed to me that your comment seemed a bit like some schools of thought which basically amount to "no one should have any advantages over anyone else because it's not fair, so we should handicap everyone to the same level", but with nations instead of individuals. Or maybe "we shouldn't implement any new technologies until we can make them equally available to everyone worldwide".

The thing is, if you look at new technologies, they've revolutionized things not only here in first-world nations, but in thirld-world nations too. Phones are a prime example of this: a few decades ago, there were lots of 3rd-world nations where they didn't have widely-deployed telephones. The US and Europe had them of course, because they had spend oodles of money over many decades installing twisted-pair copper lines everywhere, giving us 1950s-level phone tech. Then along came cellphones, and they were expensive at first, so only businesspeople (like realtors) and rich people bothered to pay for them. Should the US have held back deploying cellular infrastructure, in order to wait for the 3rd world countries to deploy basic twisted-pair POTS? Heck no. Because after a decade or so, the costs came down so much and phones got so cheap that the 3rd-world nations just went ahead and installed cell towers everywhere, and skipped landlines altogether. There's a lot of 3rd-world nations with _better_ cellular coverage than a lot of places in America! It's a lot cheaper to install a cell tower to service hundreds of people than it is to install twisted-pair wiring to hundreds of homes, so that's exactly what they did: they took advantage of superior and less-expensive technology to catch up with the developed nations faster. It would have been stupid and wasteful for them to deploy the older POTS technology.

It's like that with all technologies: costs get driven farther and farther down, and people in developing nations are able to take advantage of that, so those economies are improving rapidly, and the quality of life in those nations is rising greatly.

The way I see it, this "gap between the haves and the have nots" is not a problem, and doesn't even exist, if you're looking at a worldwide scale. It _is_ a problem here in the US because things are so corrupt and broken, but that's an entirely separate issue. For the most part, things are improving a lot for people in developing nations, with some obvious exceptions in the Middle East.

</comment></comment></comment></comment><comment><USER11> In light of today's news, I think it really sucks that they didn't have this technology available earlier so that David Bowie could still be with us, and also Lemmy from Motorhead who also died of cancer just a week or two ago.

<comment><USER12> Indeed. Moreover, if you consider the number of people who die every day, it's almost - no, it's _precisely_ cruel our civilization is mostly ignoring the problems of aging and death. We should be pouring _much_ more resources and people into this.

<comment><USER13> Meh, humanity is pretty good at producing more humans.

<comment><USER14> Would you maintain that attitude when confronted with your own or your loved one's diagnosis for something terminal and agonizing? Or is that cavalier, pretentiously "utilitarian" stoicism reserved for the young and invincible?

And even if you don't value your own health, substituting another warm body in place of a cold one does not undo the suffering caused by disease and death. All those people you don't care about deserve better than your "meh." And thank goodness we have so many people who disagree with it.</comment></comment></comment></comment>


Redwood Robotics wants to do for robot arms what Apple did for PCs - <AUTHOR> http://www.xconomy.com/san-francisco/2012/05/04/redwood-robotics-aims-to-build-next-generation-of-robot-arms/

<comment><USER2> This is really good news. Robotics can be a lot of fun, but rolling around and avoiding walls gets some people interested, balancing on 2 wheels others, but the gap has been reaching out and touching things.

I built a LynxMotion arm [1] when they came out and it was great for kinematics but its ability to lift things was very limited. My goal of a robot that would go to the fridge and fetch me a Diet Dr. Pepper eluded me for a quarter century. The Willow Garage PR-2 can do that now, its truly awesome, but as with other things there is so much custom stuff its hard to make it accessible to 'regular' folks.

I really hope these guys, and Heartland (Rod Brook's effort) are successful.

[1] <http://www.lynxmotion.com/c-130-al5d.aspx>

</comment><comment><USER3> I think this is great. With hardware like robots, modularity is a missing link right now. So many labs have to create the chassis, materials, locomotion, vision system, control software, wireless stack, everything either from scratch or form scattered resources. That totally integrated approach just doesn't work well in electronics as sophisticated as this. I look forward to seeing more organ and limb and "brain" specializations in robot labs.</comment>


Launching Version 12.1 of Wolfram Language and Mathematica - <AUTHOR> https://writings.stephenwolfram.com/2020/03/in-less-than-a-year-so-much-new-launching-version-12-1-of-wolfram-language-mathematica/ <comment><USER2> If they could also make the Mathematica software free to use... now that would be a win.</comment>


KGI: Apple to Discontinue iPhone X When Second-Generation Model Launches - <AUTHOR> https://www.macrumors.com/2018/01/22/kgi-apple-will-discontinue-original-iphone-x/ <comment><USER2> Pretty amazing a new iPhone is not super popular. Guess there is a price that is just going too far.

<comment><USER3> I'm not sure if price is the only thing here. This is really anecdotal, but most people I know who are always first in line to get the newest iPhone sat this one out, citing sort of a "new device" fatigue as their reasoning. Maybe this is wishful thinking on my part, but it seems people are finally realizing that a new iPhone really doesn't make peoples' lives _that_ much better.

<comment><USER4> I'm very happy with the 6s hardware, no desire for face scanning, and prefer my simple third-party headphones for now.

Not only that, ios11 is bad enough I've contemplated getting an android next time. Something I thought I'd never do.

<comment><USER5> i'm still on the iphone 6 and very happy. had a battery change in 2017 august and the phone felt as good as new.</comment></comment></comment></comment>


Wikibeautiful - <AUTHOR> http://www.producthunt.com/tech/wikibeautiful

<comment><AUTHOR> please leave feedback -- you can try it at [http://gyan.biz/wikibeautiful](http://gyan.biz/wikibeautiful)

<comment><USER2> What makes the wikipedia not readable? the blue links?</comment></comment>


Ask HN: Start-up friendly banks in San Francisco? - <AUTHOR>

Who should I bank with in San Francisco? Square1 and SVB both seem to have forgotten that San Francisco represents a key start-up market. I don't want to spend an hour on Caltrain to deposit a check or get a sit-down with my account manager.<p>I am leaning towards First Republic now that BOFA is selling them and won't be destroying them, plus  my old consulting company maintains a great relationship with them. Before I do that, I was wondering what bank(s) San Francisco based start-ups are happy doing business with? <comment><USER2> Be wary of JPMorgan Chase or Wells Fargo, and I'd outright recommend never banking with Bank of America. I've had business accounts over the years with all of them.

If you have a smaller, regional bank or credit union with good capital adequacy, little/no exposure to construction loans (the next "shoe to drop"), no exposure to sub-prime loans, and strong reserves, consider using them. You'll get better customer service. Just make sure the bank/credit union can provide all the services you need before moving your balances.

The big banks have dramatically raised fees, reduced customer service, and if you ever have a problem you're a nobody unless you have a $100M account.

</comment><comment><USER3> Hi Michael - I manage Northern CA for SVB. We've had an office in SF for many years now - 1999 to be specific (down at China Basin, but moving to 555 Mission in Q1-ish 2010). Sorry we have not reached-out to you. We have a number of tech, lifescience, VC/PE clients in SF and we are very bullish on the region. Let's talk about how SVB can help technology start-ups. You would never have to leave SF to bank with SVB.

I am in Palo Alto, but I can introduce you to our SF team at your convenience. Call me at 650-320-1113. If I am out, that will forward to my cell phone. \- Mike Selfridge, Head of Northern CA, SVB

<comment><AUTHOR> Will somebody actually call me back? I've been shuffled off to two people so far, none of whom have returned calls .. I can be treated like that at BOFA, and know that they have a branch every 10 feet ...

</comment></comment><comment><USER3> sure - what is your phone number?</comment>


How to Start a Successful Bootstrapped Web App Business (12 hours of audio) - <AUTHOR> http://justinvincent.com/page/960/how-to-start-a-sucessful-bootstrapped-web-app-business

<comment><USER2> Q: How do you Start a Successful Bootstrapped Web App Business?

A: Don't spend 12 hours listening to podcasts.

<comment><USER3> As someone seriously considering giving this a go (our consulting business is about to complete it's first year, we have built up a good war chest in the bank without any investment, and we're planning our web app right now), I would be foolish not to listen to the advice and experience (with a grain of salt) of those who have come before me and succeeded. Anything that helps me avoid mistakes that others have figured out is a _good_ thing.

The comment above - while maybe tongue in cheek - is short-sighted to say the least.

Thanks for putting these together!

<comment><USER4> I don't think it was short-sighted. I think his point, while partly intended to be funny, of course, was that spending 12 hours to inject a certain amount of information is inefficient if the same substance could have been gleaned much more quickly in the form of concise, curated chunks of text.

<comment><USER5> On the other had, you don't have to listen to the podcasts in one session or one day.

<comment><USER3> And really with the amount of time you will be spending building your startup, 12 hours is nothing. :-)

</comment></comment></comment></comment></comment><comment><USER6> I downloaded all the mp3 file for listening later. Here is the list of direct download hope it may help to someone

<http://traffic.libsyn.com/techzing/techzing-056.mp3>

<http://traffic.libsyn.com/techzing/techzing-076.mp3>

<http://traffic.libsyn.com/techzing/techzing-087.mp3>

<http://traffic.libsyn.com/techzing/techzing-079.mp3>

<http://traffic.libsyn.com/techzing/techzing-068.mp3>

<http://traffic.libsyn.com/techzing/techzing-004.mp3>

<http://traffic.libsyn.com/techzing/techzing-034.mp3>

<http://traffic.libsyn.com/techzing/techzing-012.mp3>

<http://traffic.libsyn.com/techzing/techzing-070.mp3>

</comment><comment><USER7> I made an RSS feed of just these episodes, that way you can download them all with one click in iTunes:

<http://files.pierrespring.com/techzinglive_bootstrap.rss>

I have also added instructions on how to add an RSS feed to iTunes on my blog, if you don't know how to do that:

[http://pierrespring.com/2010/11/19/techzing-compilation- boot...](http://pierrespring.com/2010/11/19/techzing-compilation- bootstrapping-a-web-app-business/)

Enjoy and let me know if you like it ;)

</comment><comment><USER8> Of course we know the real reason for this post is to beat Jason in the battle of the blogs :)

<comment><AUTHOR> Doh! You got me!!! ;)

</comment></comment><comment><USER9> Well put together. I've been catching up with techzing shows for the past few months (while commuting), and this brings together some of the better podcasts (not sure why you don't have Pelti there from balsamiq, it was the first best interview on techzing in my opinion)

<comment><AUTHOR> Sure! Which section would you like Peldi to go in?

<comment><AUTHOR> Ok I've put Peldi in there in the marketing section

</comment></comment></comment><comment><USER8> The techzing podcast is great easy listening for startup hacker types.

For those who don't know the techzing format is two developers having a regular chat about the startup projects they are working on, their consulting work and the stories they found interesting on hacker news.

There are also guest interview shows, sometimes with tech / startup people and sometimes with more exotic guests (one interview was with a geologist about peak oil and helium 3 fusion. Another was about the evidence behind alien sightings).

If you like startup podcasts I recommend you check out a few episodes of techzing and see if it's too your liking.

</comment><comment><USER10> _Deciding on and Idea_

I think you meant "Deciding on _an_ Idea." Right?

[EDIT] Also... _Derek Sivers muses this question_ should properly be written, "...muses on this question."

<comment><AUTHOR> Done. Thx :)

</comment></comment><comment><USER11> Step 1: self promote with how-to-start-a-successful-startup books, podcasts, and blog posts.

</comment><comment><USER12> Files are missing!

<comment><AUTHOR> Which ones? They all work for me...

<comment><USER13> Probably if people use a flash blocker, they don't see them.

</comment></comment></comment><comment><USER14> nice

</comment><comment><USER15> You see, Justin? We _are_ paying attention.

<comment><USER16> This is the second comment of this form that I've seen made for a submission from this website. What's the context?

<comment><USER15> Heh -- Justin is the guy who coined "luck surface area" and apparently thinks no one knows it. I had answered a question in another thread about who made it up, and someone followed that up with "see Justin? they are paying attention" -- so I thought I'd be funny and repeat that.</comment></comment></comment>


Is It Okay to Stereotype? - <AUTHOR> https://outlookzen.com/2019/04/14/is-it-okay-to-stereotype/ <comment><USER2> Yes, stereotyping is incomplete. Fortunately

(a) (roughly) everyone knows this

(b) (roughly) everyone replaces stereotypes with actual information about the person once available

(c) stereotypes are largely accurate.

See: [http://www.spsp.org/news-center/blog/stereotype-accuracy- res...](http://www.spsp.org/news-center/blog/stereotype-accuracy-response)</comment>


Visual problems besetting Android's Lollipop - <AUTHOR> https://shkspr.mobi/blog/2014/12/do-all-google-employees-have-perfect-eyesight/ <comment><USER2> The contast point of the article is so true. The light gray text on white background which is so trendy nowadays is terribly uncomfortable, especially outside in brighter light.

I really hate black on white, it has something to do with my eyes and white on black is much more comfortable. Desktop can be set, desktop browsers can be styled using userscripts or addons but mobile hardly.

So I would love to have the option to render light text on dark backgrounds independently of the page CSS on mobile browsers and I don't mean the silly Chrome invert mode that inverts the images as well.

Mobile apps would be better with this especially at night with lights off it is much more comfortable than the white background no matter how much dimming or redshifting you use. Some have dark themes but lot of them don't.

</comment><comment><USER3> This season, watching family members struggle with new devices, it struck me that even if empowered tech enhancers don't have poor vision (or other suboptimal abilities), they should at least identify with the struggles of their parents and people they know, and this will increasingly be reflected as cohorts grows older. My dad has always been involved in technology and he eagerly explores new features, but he's very often tripped up by poor usability choices. But in general with open competition things have been getting startlingly better each month.

Worth mentioning Lasik doesn't help here, it only helps with far vision, it can actually make near vision worse because it can cause other visual aberrations.

<comment><USER4> After Lasik my preferred font size more than doubled and my tolerance for low contrast text went way down.

<comment><USER3> That's my experience too, in addition to noticing "floaters" a lot (distractingly) more and also having moisture problems with my eyes. So clearly laser eye surgery is not helpful for typical tech workers. The rest of the article is great though. (=

</comment></comment></comment><comment><USER5> Firefox also used to have text reflow when zooming, but they removed it for some reason[1][2]. This is the sole reason I use Opera on mobile.

[1]: [https://bugzilla.mozilla.org/show_bug.cgi?id=710298](https://bugzilla.mozilla.org/show_bug.cgi?id=710298)

[2]: [https://www.reddit.com/r/firefox/comments/1mkqry/firefox_24_...](https://www.reddit.com/r/firefox/comments/1mkqry/firefox_24_released/cca7taf)

<comment><USER6> Thanks! I just installed Opera and it's fantastic.

</comment></comment><comment><USER7> I wholeheartedly agree with the author here, but I also think Apple is even worse in some regards. Ever since iOS 7 I don't even trust their UI guidelines anymore. Look at this picture of the Music app on my iPhone: [http://imgur.com/6ADrt9U](http://imgur.com/6ADrt9U)

What does the text on the bottom mean? Oh you can't read it? Yeah it's Chinese. These are the "buttons" for Repeat, Shuffle, etc. I have no idea what kind of designer thought it was wise to use text instead of icons there, especially since most icons in a music player are easily recognized most of the time.

It all started with this "trend" to go flat, now I can't even see what are supposed to be buttons and what not.

<comment><USER8> I can't read it because I can't read Chinese. Since people speak mostly English on this website, why wouldn't you post a screenshot of the app running in English? I don't think people would have a hard time deciphering the text in their native language.

Also, my parents (both new iPhone users) would have no idea what the shuffle and repeat icons mean. They're not tech-savvy at all and don't recognize those icons. However, they've seen play, pause, and skip buttons their entire lives on radios. I think Apple deliberately chose to make certain buttons text.

Seriously, why would you use a Chinese screenshot as an example? I'm so confused as to what your thought process was... of course nobody can read it...

</comment></comment><comment><USER9> This Christmas they couldn't get the kids to watch Arthur on pbs because the little ones were running around with Nintendo 2dses and playing with smart phones. I saw my cousin tony who is a PlayStation enthusiast and asked him why he didn't buy a Vita and he said that close focusing wrecks your eyes.

I learned to read at 3 1/2 and by the time I was in school I couldn't see the blackboard. I felt wearing glasses isolated me from people and made it harder to fit into school. At least I got good at reading so I put up good numbers in high school and college and went on to get a PhD.

It is so ironic that mobile technology will make people's vision get worse except then all you know about is Mario and Yoshi.

<comment><USER10> Correct me if I'm wrong but I don't think eyestrain has any long term effects. Mobile technology won't make people's vision worse.

<comment><USER9> My optometrist tells me the same thing as tony, although my opthalmologist never did.

</comment></comment></comment><comment><USER11> The contrast problem is indeed true in some screens. I don't know how much of it is due to the .0 version rush.. Many things are still rough around the edges in material and I expect the platform to really start to shine with the .1 version.

The text wrap problem is pretty weak though. As far as I can see, this 'bug' report was well managed. It is not a bug, just somebody disagreeing with a change in the platform. It is well explained in the 4.4 release documentation, along with the reasons behind it. Unless the author explains why the Chrome team is mistaken, this is entirely pointless.

</comment><comment><USER12> After a brief stint on Windows Phone, I recently switched back to Android and was mildly amused that, thanks to the lack of word wrap, the browsing experience on mobile Chrome was somehow worse than mobile IE.

</comment><comment><USER13> Similar bad design decisions prevent my father from using Chrome on Linux, at least as of when I set it up a year ago. I couldn't make the text in tabs bigger, something Firefox has no trouble with.

</comment><comment><USER14> The zoom is why I have always used dolphin on android and probably always will. Can we call these set of bugs Mac Retina Blindness?

</comment><comment><USER15> My solution for this is to hold my phone in landscape mode.

<comment><USER16> s/solution/workaround

Text reflow was/is a killer feature of the original Android browser (which cyanogenmod still uses, fortunately).

Reading the HN front page is a PITA without it.

</comment></comment><comment><USER17> It's a little _unsporting_ to whack Google over the head with it's own (very recently) released design guidelines[1], but hey, Google is a _corporation_ and so basically has the feelings of a psychopath, and compassion and empathy is wasted on it, right? :)

Of course the OP is correct when he says those contrast ratios (nice tool[2] for calculating that, BTW) are way too low.

[1] [http://www.google.com/design/spec/material- design/introducti...](http://www.google.com/design/spec/material- design/introduction.html)

[2] [http://leaverou.github.io/contrast- ratio/#%23389088-on-%2300...](http://leaverou.github.io/contrast- ratio/#%23389088-on-%23007166)

<comment><USER18> Like the author says, Google isn't a startup any more. Android is a huge ecosystem, and releasing something with these many problems, is not really up to standard. "Google started it", if you will, when they offered me this update OTA. Now my experience is severely downgraded.[1]

I've been intending to do my own bugs&annoyances writeup - my overall experience with 5.0 and 5.0.1 has been bad enough that I'm dumping L for cyanogenmod 4.4. I tried to do it yesterday, in fact, but adb backup with the -shared option seems to hang forever with 5.0.1 :/

[1] I kinda see that I may be coming off as a whiny, change-resistant douche here, but I don't think that is the case: I was actually very excited about the 5.0 release - both for the material design update (i felt it looked great on paper) and for the new runtime. I was prepared for UI/X changes, obviously. I was prepared to forgive bugs as well, but not at this level. ("How excited?" \- "Manually-checking-for-updates-several-times-a-day-for-weeks excited. Plenty")

<comment><USER17> Heh, apparently the tone of my post wasn't clear - I don't normally use the word "unsporting", or smileys, in my post. :)

I'm a big fan of complaining, actually. It's a good cost/benefit potential, the only downside is when the target becomes alienated. The _upside to psychopathy_ is that criticism is just data, and not alienating. I hope that, if and when I release some software into the world, I will be able to treat complaint as data.

Cheers.</comment></comment></comment>