Signal Foundation - <AUTHOR> https://signal.org/blog/signal-foundation/ <comment><USER3> This is freakin' awesome:

A non-profit foundation with $50 million in the bank dedicated to providing usable encryption to the general public, with no other agenda other than the public good.

Go read the blog post by Moxie and Brian Acton (who is joining Signal). Very exciting!

<comment><USER4> I hope they eventually develop a _federated_ , privacy oriented messaging protocol, once the rapid technological evolution settles down.

I know Moxie's position on federated protocols [1], but I think we must eventually agree that an open environment with a multitude of providers and implementations is the only way to provide long term privacy - any single provider is vulnerable. It would also be a very useful tool in the context of regulating communication platforms and breaking up monopolies.

[1] [https://signal.org/blog/the-ecosystem-is- moving/](https://signal.org/blog/the-ecosystem-is-moving/)

Edit: emphasize federated, not open, Signal is indeed an open protocol.

<comment><USER5> Users don't want federation.

See also: Adoption failure of Google Talk XMPP, massive adoption of Facebook Messenger and Whatsapp, and AIM before it.

I wish it were different, too.

<comment><USER6> I think users would prefer federated systems. Who wouldn't? Even though most people have probably never heard the word before, they almost certainly use and appreciate federated systems like phones and email.

Do people want federation enough to have to take a principled stance in order to force change? Heck no. And that's the problem: there's no reasonable way for their desire to impact the producer side of the market. Can't vote with your wallet since public IM service is universally free, plus network effects are strong.

Users are being worn down, too. I remember when Pidgin, Adium, Trillian, etc were rather popular. Now most people don't even use those kinds of consolidation apps either, and resign themselves to literally running many separate apps.

This is a crazy mess we got ourselves in, and there is no easy fix. Time machine to 1980 to get a standard out before ICQ, maybe.

<comment><USER7> > Now most people don't even use those kinds of consolidation apps either, and > resign themselves to literally running many separate apps.

IMO that is really one personal hell for me. I blame android and apple for this. I was happy with my N900 where you got one chat application that supported SMS, Skype, XMPP, AIM, ICQ, whatever. The world was so simple back then. Now everything has to be a separate "app", where previous there where just plugins. Such a decline in usability.

<comment><USER8> Pidgin (formerly known as GAIM) and its subproject libpurple is the one to thank for. Telepathy [1] and Bitlbee [2] are based on that. I used all of these throughout the '00s. Before the Nokia N900, I used a Nokia E71 with Nimbuzz (basically proprietary but it runs something like Bitlbee under the hood on their servers).

Some of these protocols are open, some are reverse engineered. Problem with the current generation is that they're focussed much more on security features such as E2EE. Although before GAIM, we had other applications which did multiple protocols we also had loads of single purpose applications for all these protocols you mentioned and a whole lot more. Back in the end of '90s if you wanted to run MSN and ICQ and AIM on Windows, you had to use a client for each of these. Its basically a cat and mouse game. Look at the history of the Skype support for an example of that.

[1] [https://telepathy.freedesktop.org/](https://telepathy.freedesktop.org/)

[2] [https://www.bitlbee.org](https://www.bitlbee.org)

</comment></comment></comment></comment></comment></comment><comment><USER9> This is very very good news.

As a heavy Signal user, from where I sit I personally see the following clear needs:

-Better group support. Right now, to do a group in Signal you have to name the group, which makes it kind of a pain to create ad hoc quick groups. I'm forever naming them "John Sue Bill" or "Jane Roger Amanda". iMessage, by contrast, just automatically makes a group without a name. You get a thread for that group, so you can follow the discussion clearly, and you can leave the group, but it hides the nuts and bolts of the fact that a group has been formed. Also, Signal has no per-group notification settings, so if you're in a "noisy" group your only option is to turn off notifications universally (including one-on-one messages and other groups) or live with it. Lastly, you cannot form a group from Signal Desktop.

-Better support for long messages (or a new product using the same network and security). Signal was clearly designed for short session lengths — brief messages that are composed quickly. But as it has become the catch-all app for encrypted comms — "just use Signal! PGP email sucks!" — many people, at least that I deal with, are trying to use it for email-type purposes. Long messages with arbitrary attachments. It would be nice if, like, putting a line break in a long message didn't mean hitting Control-Enter or Command-Enter. It might even be nice if you could have multiple threads with the same recipient. You know, like email. I am not holding my breath on this one. But if people could email as securely as they chat, using Signal protocol, it would be a huge leap forward in keeping the NSA out of our business. Not to mention Google/Gmail's ad clients etc.

-Ability to search. I can't full-text search my messages, even within Signal. As I use it more and more, this is a hindrance.

-Group video chat. This is very pie in the sky. But a lot of sensitive comms involve groups — think of people organizing a protest, or a corporate takeover, etc. And right now there are few private options.

<comment><USER10> I'd love to use Signal, but in order for me to do so there's a lot that has to be added.

\- Real multi device support. I want my messages on all my devices, without having to have my phone on.

\- An iPad app.

\- A desktop app. I'd pay for a native one, without Electron.

These things are basically table stakes for competing with Facebook Messenger, Telegram, and iMessage. If Signal's goal is to bring encryption to the masses they have to solve things like this, since regular people care less about security and more about convenience.

<comment><USER11> > \- A desktop app. I'd pay for a native one, without Electron.

I'm working on a native app that supports Signal, Slack, Twitter etc. It's only 90 KB (!).

[https://eul.im](https://eul.im)

*edit Signal support is coming in early March.

<comment><USER12> Although you claim Wireshark, etc. can be used to verify the lack of external communication, the fact of the matter is that it only verifies you aren't sending data to third-parties all the time. It does _not_ mean that it won't do so occasionally, or that (say, if triggered via a message in an existing platform) it won't suddenly send your credentials to someone else and then erase its tracks, or do anything more sophisticated than the naive approach you illustrated. The reality is that open-source really _is_ necessary to prove that nothing nefarious is going on, as unfortunate as that is. I hope you can open-source it in the future so that it enjoys full adoption.

<comment><USER11> It will be open-sourced at some point within the next 2 years without a doubt.

Like I explained in the FAQ, the plans and the potential are huge, and it would be really silly to risk it all just to become another data miner. Even if it's very sophisticated, and there's a 0.01% change it's found out, why risk everything? Besides, it's simply illegal. All the information about me and the company is public.

I wonder if you have the same concerns about other closed source software like Sublime Text.

<comment><USER12> > I wonder if you have the same concerns about other closed source software > like Sublime Text.

This was an unnecessary personal jab, but I'll respond. Sublime? I don't use it. Software that deals with my credentials just like you do? Yeah, I definitely do. That's why I don't trust closed source password managers either. Text editors? Mine are open source so the thought has never crossed my mind. Other random software like my OS or Visual Studio? Depends; e.g. Microsoft is a huge corporation that has nothing to gain and a lot to lose from keylogging my passwords, but e.g. I wouldn't trust Facebook not to record my audio or fish out my contacts behind my back. Smaller utilities? Yeah, but again, they don't have my credentials at their fingertips, or need Internet access at all for that matter (I turn off auto updates so I can just block internet access for them entirely).

All of which is to say, yeah, I'm not picking on you specifically, but this isn't about me, or about you. I'm just a messenger. Verifiability is the requirement many people have for software that manages their credentials; pinkie promised aren't enough. For some of them, you can make up for some of it by having a big enough reputation to lose, and criminal history to jeopardize in their jurisdictions. For others, you can't. In your case, you don't seem to have that going for you either.

<comment><USER11> This was not meant to be a jab, sorry if it came out that way. English is not my native language.

I was genuinely interested, and I expected this answer. This is a very valid point of view. I hope you'll use it once it's open-sourced.

</comment></comment></comment></comment></comment></comment></comment><comment><USER13> > Over the lifetime of the project, there have only been an average of 2.3 > full-time software developers, and the entire Signal team has never been > more than 7 people.

This is awesome. Amazing what an excellent small team can build.

<comment><USER14> Don't tell SV!

<comment><USER15> When WhatsApp was acquired by Facebook for $19B they only had a little over 50 people.

<comment><USER16> is it known how many of those 50 were devs?

<comment><USER17> "When WhatsApp was acquired by Facebook for $19 billion, the popular messaging app had about 35 engineers and 450 million users." [http://www.businessinsider.com/facebook-f8-whatsapp- engineer...](http://www.businessinsider.com/facebook-f8-whatsapp- engineering-2016-4)

<comment><USER14> 35 still seems high to me

<comment><USER18> You forgot the /s

</comment></comment></comment></comment></comment></comment></comment><comment><USER19> Congratulations to moxie and the Signal folks from the Matrix.org team :) The world wouldn't have the increasingly pervasive E2E encryption we enjoy today if not for the double ratchet algorithm, and it's fantastic that they can continue that work as a 501(c)(3)!

<comment><USER20> >The world wouldn't have the increasingly pervasive E2E encryption we enjoy today if not for the double ratchet algorithm

Too bad the Signal Protocol doesn't actually implement the double ratchet algorithm but a derivative of it that fails to protect metadata making the Signal Protocol leak metadata. Granted, it only leaks metadata leaked by the transport layer anyway, but this makes it pointless to implement the Signal Protocol over something like Tor, i2p or GNUnet.

</comment></comment><comment><USER21> Moxie is and will continue to go down as a legend of the digital age. He carved his spot way back with work like sslsniff/sslstrip, and has proven himself to be a real philanthropist. Kudos to him.

</comment><comment><USER22> This is a bit of a tangent, but I first heard of Intel SGX (Secure Guard Extensions) via Signal's blog post about secure contact sharing[0], so it's almost relevant :p From what I've read[1][2][3], Intel SGX is vulnerable to Spectre exploits. Does anyone know if this has changed Signal's approach to security at all? Granted, contact sharing was a technology preview, but I'm curious if SGX is still considered a feasible, "good enough" security measure for Signal Foundation.

[0]: [https://signal.org/blog/private-contact- discovery/](https://signal.org/blog/private-contact-discovery/)

[1]: [https://software.intel.com/en-us/forums/intel-software- guard...](https://software.intel.com/en-us/forums/intel-software-guard- extensions-intel-sgx/topic/754168)

[2]: [https://github.com/lsds/spectre-attack- sgx](https://github.com/lsds/spectre-attack-sgx)

[3]: [https://security.stackexchange.com/questions/176635/how- does...](https://security.stackexchange.com/questions/176635/how-does- meltdown-spectre-impact-intel-sgx)

<comment><USER23> Regarding the SGX enclave and contacting sharing, the blog post announcement dated 26 Sept 2017 says 'deploying into production...over the next few months'. Can we assume that's happened already? Or are contacts still being exchanged in a way that would allow a middle man to reconstruct an individual's social graph?

<comment><USER24> Given that it now takes an order of magnitude more time than it used to for newly added contacts to appear in my list of Signal contacts, I assume /something/ has changed with the way they exchange contact data.

</comment></comment></comment><comment><USER25> Since you are in the US how do you keep the US government from interfering with your mission because Signal uses strong encryption?

How do you address the EARs (Export Administration Regulations) and ITARs (International Traffic in Arms Regulations)?

These regulations look like a tar pit to me.

<comment><USER26> Why do you think strong encryption will have an export problem now when it hasn't for decades? Keep in mind that Signal is already open source and the algorithm is already widely distributed. Any restriction on export at this time would be closing the barn doors after the horses have all escaped.

<comment><USER25> Quora article on issues in US export of products using strong encryption => [https://www.quora.com/What-regulatory-issues-have-to-be- cons...](https://www.quora.com/What-regulatory-issues-have-to-be-considered- when-exporting-or-building-products-that-heavily-use-cryptography)

I hate these regulations but EAR and ITAR with respect to crypto seem to be concerned with the key length and algorithm. Over a certain strength the software using the encryption seems to be still treated as a munition!? I've heard of people who ignore this getting huge fines.

And any export to Cuba, N. Kora, Sudan, Syria, and Iran is banned by OFAC (Office of Foreign Assets Control). Yes, the very countries that need Signal the most are banned!

Hopefully I'm wrong and we are free of regulatory issues in the US so I'm asking a serious question here - how does Signal solve this problem?

<comment><USER27> I think the US still requires cryptography products to be registered with the Department of Commerce, but that's about it for non-military products.

<comment><USER25> I've tried reading the regulations (but IANAL) and am almost certain that over a key-length for given algorithms its a munition and an export license or similar is required with regular updates.

And then still there is the issue of the OFAC banned countries list.

I'm hoping Signal's compliance can show other hackers how to also comply without hassle or fear.

<comment><USER28> I think this is the one: [https://www.bis.doc.gov/index.php/documents/regulations- docs...](https://www.bis.doc.gov/index.php/documents/regulations-docs/federal- register-notices/federal-register-2014/951-ccl5-pt2/file)

> You must submit a classification request or self-classification report to > BIS for mass market encryption commodities and software eligible for the > Cryptography Note employing a key length greater than 64 bits for the > symmetric algorithm (or, for commodities and software not implementing any > symmetric algorithms, employing a key length greater than 768 bits for > asymmetric algorithms or greater than 128 bits for elliptic curve > algorithms) in accordance with the requirements of § 740.17(b) of the EAR in > order to be released from the "EI" and "NS" controls of ECCN 5A002 or 5D002.

</comment></comment></comment></comment></comment></comment><comment><USER29> Any reason Signal isn't available through F-Droid? It may be unjustified but I'm not a big fan of installing privacy conscious apps through Play.

Edit: Wait, haven't installed anything yet, but I read the getting started guide. I have to sign up using a phone number? That throws all expectation of anonymity and thus privacy out the window.

<comment><USER30> Telegram is available on F-Droid. It's similar to Signal with more functionality and greater ease of use - [https://f-droid.org/packages/org.telegram.messenger/](https://f-droid.org/packages/org.telegram.messenger/)

You need a phone number that can receive texts for the initial setup, but once you're set up people can add you by @username and never need your number. Stuff like [https://www.textnow.com/downloads](https://www.textnow.com/downloads) works just fine for the initial text. Once you have a single device set up, it messages your existing devices rather than sending SMS when you try to connect another device.

One of the main people behind Signal actually tried to spread a bunch of FUD about Telegram years ago, saying the crypto was weak, but it's really not. No working POC code was provided to decrypt anything, just FUD.

Protocol details here: [https://core.telegram.org/mtproto](https://core.telegram.org/mtproto) They just released MTProto2 in the last year.

<comment><USER31> Telegram isn't remotely similar to Signal. Telegram communications aren't encrypted by default, and Telegram group chat messages aren't encrypted _at all_.

<comment><USER30> This is 100% false. EVERYTHING that goes over the wire is encrypted, always, just like when you're on a TLS website such as your bank.

Group chats aren't end-to-end encrypted, and 1 on 1 chats are only end-to-end encrypted if you make it a Secret Chat.

<comment><USER32> Did you really think they were talking about SSL in this context? Of course they meant E2E.

<comment><USER30> To say there's no encryption AT ALL when it's fully encrypted over the wire is still false. Not having E2E encryption is different than not having encryption AT ALL.

<comment><USER33> They are encrypted in the same sense that the Sesame Street website is encrypted.

</comment></comment></comment></comment></comment></comment></comment><comment><USER34> I hate to be the one naysayer, but it seems to me like the benefits of this influx of funding and scope has very few tangible benefits, while predisposing them to a standard failure mode of large and well-funded tech activist organisations where the means (the organisation) are confused for and eventually put ahead of whatever goal they were founded for: see e.g. Mozilla support for EME, the continuing negative news pertaining to Pocket and trying to collect user data. (On the ground, part of the problem may be something of the form: imagine you are the CEO of $foundation, are employing dozens of people and hundreds of volunteers who you have to keep motivated and now you are supposed to tell them they can't do the one thing that might keep their employer going and relevant just because of some philosophical considerations about how compatible it is with the core mission.)

<comment><USER35> It's easier to criticize than it is to build.

Mozilla has been doing a lot of awesome stuff and people keep forgetting that their direct competition and threat are Google, Apple and Microsoft, the world's largest tech companies. Mozilla basically had no choice with EME, but to comply.

When the majority of HN's userbase has been using Chrome for years, power users, nay, freaking developers which should know what EME means, when Chrome is approaching the monopoly of IExplorer, good luck selling your values to the general public, who don't give a shit as long as their Netflix stream ain't working.

Open Whisper Systems has been delivering the best encrypted chat protocol to the masses, their tech being used now in WhatsApp for example.

So you can be the naysayer, but IMO these foundations are building and releasing products with a measurable positive impact on the world, whereas most of us here don't ;-)

<comment><USER34> I understand the case in the case of Mozilla, because a browser is an intrinsically absurdly complex product. In the case of Signal, the benefits of having a foundation like that seem unclear to me. What exactly is it that they want to do but couldn't before they had a $50m foundation? The linked page seems very vague about this.

</comment></comment></comment><comment><USER36> Could this mean that Flock will be making a return?

[https://signal.org/blog/flock/](https://signal.org/blog/flock/)

</comment><comment><USER37> As a complete layman, I don't understand why this is different than WhatsApp (they claim to fully encrypt stuff, right? Is it worse than this?). If I don't understand encryption and computers, why should I be sold on this? It seems to be aimed towards CS majors who understand the backend benefits. To an end user, it looks like an ordinary chat app. Am I wrong? This seems to have been heavily upvoted; is there a 10x improvement I'm missing?

<comment><USER38> While whatsapp messages are, apparently, e2e encrypted - your phonebook and metadata are slurped up by facebook.

Signal does not have that goal and have been shown by courts documents to not store the metadata.

<comment><USER37> The Signal app asks for a ton of permissions. Apparently this isn't decentralized either, so how is it different than Facebook? Did they prove it was mathematically hard/impossible for them to see any of the (meta)data? Have they proven that they are a 100% oblivious broker?

<comment><USER39> The courts not getting any data, as parent just mentioned, is very strong proof for that.

<comment><USER37> > The courts not getting any data

I don't know what that means.

</comment></comment></comment></comment></comment><comment><USER40> Pretty amazing and absolutely deserved. After the failures of systems like PGP, which aren't really suitable for the masses, the Signal protocol did a great job at spreading end-to-end encryption. I'm happy to hear that they got some philanthropic funding, even though I don't doubt that Moxie and the others did the work out of principle anyway and might have continued to do so even without the money.

<comment><USER41> IMO, saying PGP has failed is like saying cryptocurrencies have failed.

<comment><USER42> Considering the diversity of opinions on cryptocurrencies, this post leaves me with no idea what you think about PGP.

<comment><USER41> The verdict is still out on both, because, as a society, we aren't ready to make use of them/the UX haven't been made easy enough for the unwashed masses yet.

</comment></comment></comment></comment><comment><USER43> Like probably everyone else, I have an idea on how to use the money: Distributed, persistent, group-possible, configurable chat. What's the difference between person-to-person chat, group chat, twitter, reddit, HN, a discourse forum, etc? Configuration, if you ask me. But distributed is the key though I understand identity, disk, and peer management are difficult.

</comment><comment><USER44> I'm really excited about the possibility of a better client. I want to switch to Signal with my friends but the clients feel so behind Facebook Messenger

<comment><USER45> I've assimilated most friends and all family very easily by educating them about the why. Not to mention if you're a parent explicitly banning sharing of photos with relatives via social media. People accept any small inconvenience or lack of feature quickly. But at this point I'm not following on the "so behind" comment. Care to elaborate?

<comment><USER46> On top of the myriad of missing features that for example Telegram has, the UI/UX for Signal (at least on the iOS app) is far behind. The app feels laggy and slow in comparison to Telegram or Messages (only other apps I use). It has giant text bubbles with large padding which IMO looks terribly ugly. Also, Telegram now has dark mode which I find very useful. And as mentioned, as silly as gif support is, it's a nice feature to have. If only Telegram used Signal's encryption by default.

<comment><USER45> On Android... Slow and laggy: not in the least, maybe this is IOS specific. Giant text bubbles: again on Android this is not a problem. Dark mode: Signal has had this for well over a year at this point. GIF support on Android has been there for almost a year as well.

The downside to Telegram? I don't trust it - so even if any of the above we're true they're all subjective and in my mind not worth compromise.

</comment></comment></comment></comment><comment><USER47> That an account is linked to the phone number is the major problem for me because once you are in another country where you can't receive SMS with that number, you need to create a new account! Matrix is more friendly in this regard, but not as good as Signal in terms of privacy features.

</comment><comment><USER48> Maybe they can use their $50,000,000 to make it possible to sign up for their service without a phone number.

The hype around Signal is insane to me considering this lack of basic functionality.

<comment><USER42> Also considering questions like "why does this app want all my contacts?" or "how do I know I can trust the implementation? or, critically, "how much does it even matter when the OS itself might be compromised?"

</comment></comment><comment><USER49> Huge congratulations to Moxie and the team. Signal is a wonderful project and I'm super excited to see what they achieve with such serious resources behind them :)

</comment><comment><USER50> What is Signal Foundation's vision for interoperable, open-standard E2E messaging between different central services?

<comment><USER51> A null vision. Moxie is against federation, and he's against interoperable clients.

[https://signal.org/blog/the-ecosystem-is- moving/](https://signal.org/blog/the-ecosystem-is-moving/)

[https://github.com/LibreSignal/LibreSignal/issues/37](https://github.com/LibreSignal/LibreSignal/issues/37)

<comment><USER52> I don't think he's against federation, it just doesn't make sense to federate an experiment. Once you've got something really really really solid, then it does make sense.

They've been able to iterate their protocol really fast thanks to it not being an RFC or something.

<comment><USER53> Fully agree and I want to elaborate. After SHA-1 broke, IETF's OpenPGP work group have failed the community by wrestling hand over what hash function should be in 5th revision of fingerprint protocol. When they couldn't reach an agreement, the development of the next standard was abandoned, leaving all users vulnerable with no date for fix.

And FFS, it hasn't even got anything to do with protocol, it's something the client can do by itself. Having worked on secure messaging apps, I would never go to federated protocols. Signal's infrastructure allows rapid improvement of protocol and fast elimination of insecure protocol revisions. That's where we need to be at. Just look at the history of TLS and the potential in downgrade attacks. Old revisions die slowly. Signal can easily monitor what versions are still running, push updates to users and ensure codebase isn't bloated by code that merely represents insecure protocols.

Signal succeeds because of it's "closed" ecosystem, it doesn't suffer from the tyranny of the majority that occurs when there's disagreement about e.g. seriousness of some attack, when some feature might be risky. With Matrix, I worry developers of clients can affect choices, and the protocol is already dangerous, to ensure (backwards) compatibility with older clients and (other) protocols, Matrix is not end-to-end encrypted by default. I will eat my hat with mustard the day I see all Matrix clients support only end-to-end encryption for everything.

</comment></comment></comment></comment><comment><USER54> Hopefully they fix the huge privacy problem that requires people to give out their phone number in order to exchange messages. It still amazes me that they don't see why vulnerable people, or even most women, are not ok with doing this. Even Apple lets you use an email address.

</comment><comment><USER55> I'm hoping they can use some of this cash to make a better desktop client:

1\. That can be minimized to the system tray.

2\. That can be used when behind an http proxy server.

3\. Doesn't require a phone to use.

4\. Doesn't take 200MB ram to run.

<comment><USER53> So, what are you using the 15,800 MB of RAM for?

<comment><USER28> 100 tabs on Chrome?

<comment><USER52> Without tree style tab?

</comment></comment></comment></comment><comment><USER56> I hope they rebadge an android phone the way Fairphone has.

Signal would only need to make a small profit to keep it sustainable and that would bring down the handset retail cost pretty significantly. It would be like the Raspberry PI of phones.

Signal guys: if you are toying with this idea, hit me up (email in profile), I've put way too much time into researching how to do this as quickly and miserly as possible.

</comment><comment><USER57> Anytime I hear about signal, I try to sign up and my verification code never comes.

It may be something this simple that is holding it back from adoption.

<comment><USER58> Report here please: [https://github.com/signalapp/Signal- Android/issues/6027](https://github.com/signalapp/Signal-Android/issues/6027)

<comment><USER57> Done [https://github.com/signalapp/Signal- Android/issues/6027#issu...](https://github.com/signalapp/Signal- Android/issues/6027#issuecomment-367470856)

</comment></comment></comment><comment><USER59> Moxie seems to be the right person in the right position. I'm excited and happy for him.

</comment><comment><USER60> This is great news. Now maybe they'll have the resources to ditch your phone number as your identity. Traveling overseas is really frustrating when you get a new sim card and your Signal identity changes.

<comment><USER61> You don't need to re-register Signal when you pop in a different SIM card. I've successfully used it abroad with a foreign SIM card without issue. Of course people won't be able to add you by any phone number other than the one you used to set it up, but that's hardly a concern when travelling.

</comment></comment><comment><USER62> Kudos to Signal! I derive great inspiration from projects such as Signal but as an average developer I just don't know how to take that inspiration, make a plan and become good programmer.

</comment><comment><USER63> _> Starting with an initial $50,000,000 in funding_

O_O holy smokes that's a lot of "initial funding"

<comment><USER64> I'd like to know how though. They are not VC funded. I supposed Brian Acton funded it?

</comment></comment><comment><USER65> Maybe now they can afford to have some features, or group chat that's not the worst in the biz.

</comment><comment><USER66> Like I recommended for Mozilla, they could use this money to acquire and/or create highly-usable alternatives to many products that are about handling communications or data in trustworthy way. Things like SpiderOak, VPN's, backup apps for iOS/Android, HSM's, payment services, paid email… anything that unscrupulous businesses have been a problem for with insecure solutions or them just cheating customers. Each one is turned into a commercial product either shared source or dual-licensed GPL/AGPL. The money coming in improves each both for new features and 3rd party review. Release code as GPL either on component level as they are built or as a whole after development cost was paid for. Many businesses will still pay for GPL-licensed code just to know someone is responsible for it.

Such models will gradually increase the number of trustworthy goods available through trustworthy suppliers over time. That's the basic concept anyway.

</comment><comment><USER67> I don't think I feel good about this. The comments are nice and seem true, but whenever there is so much money involved, even a non profit label I would be suspicious. Are all funding and allocations going to be made public for the organization? People always seem to have a hidden self interest, especially when money is involved.

<comment><USER68> I'm neutral, but I was never convinced by Signal's PR pieces. Call me a skeptic but a lucrative field like messaging is always about money. Signal's gimmick was privacy to gain market share, but even if they had a slight edge there back then, the majority did care.

 _even a non profit label I would be suspicious_

Could be about account optimization purposes. The 50M funding was probably deducted from taxes to begin with.

</comment></comment><comment><USER65> Who funded the foundation

</comment><comment><USER69> Hella awesome news!

</comment><comment><USER70> awesome

</comment><comment><USER71> Even though I'm excited, I really hope this isn't one of this XKCD "Standards" moments.

[https://imgs.xkcd.com/comics/standards.png](https://imgs.xkcd.com/comics/standards.png)

</comment><comment><USER72> Let's hope they don't backdoor it like they did with WA. Probably already has one. Long time signal and WA user here

<comment><USER73> WhatsApp was never backdoored.

Even The Guardian backed down after a review of its research process: [https://www.theguardian.com/technology/commentisfree/2017/ju...](https://www.theguardian.com/technology/commentisfree/2017/jun/28/flawed- reporting-about-whatsapp)

Quote:

> The most serious inaccuracy was a claim that WhatsApp had a "backdoor", an > intentional, secret way for third parties to read supposedly private > messages. This claim was withdrawn within eight hours of initial publication > online, but withdrawn incompletely. The story retained material predicated > on the existence of a backdoor, including strongly expressed concerns about > threats to freedom, betrayal of trust and benefits for governments which > surveil. In effect, having dialled back the cause for alarm, the Guardian > failed to dial back expressions of alarm.

</comment></comment><comment><USER74> Kudos to Signal for taking this approach and not jumping on the sketchy ICO bandwagon.

</comment><comment><USER75> The longest list of required permissions I've ever seen on Android and tying your identity to a phone number you own?

</comment><comment><USER76> Hm. $50 million when the team has already been successful. Why, when only $1M would suffice? What on earth could $50M do? Remember the old saying: "Mo money mo problems" B.S.

<comment><USER77> Foundations are supposed to be self sustaining without actually selling anything, so they require large endowments to endure. That $50M could sustainably spit off as much as $2.5M/year, funding ongoing development indefinitely.

</comment></comment><comment><USER78> So, where did the $50 million come from?

That is a significant amount of money for what has been a handful of people, not taking venture capital, now operating as a nonprofit to "secure communications."

<comment><USER79> The article isn't directly explicit, but

> Today, we are launching the Signal Foundation, an emerging 501(c)(3) > nonprofit created and made possible by Brian Acton, the co-founder of > WhatsApp

Brian Action funded it himself.

<comment><USER53> Makes sense only if he didn't spend the $19,000,000,000 on one go when FB bought WhatsApp.

</comment></comment></comment><comment><USER80> When is the ICO?

No, I'm not kidding. Look at Telegram. Who would've thought an open source project would ever get close to _a billion dollars in funding_?

I don't want Signal to wither away or forever remain a niche chat application because of lack of funding, especially if Moxie one day decides he wants to pursue some other dreams of his and doesn't have time to deal with Signal anymore.

<comment><USER81> This seems like a much better setup - $50M and setup as a 501(c)3 - <USER2> than taking on the weird regulatory risk and all the other weirdness associated with Telegram's (IMO crazy) ICO:

[https://www.forbes.com/sites/jasonbloomberg/2018/02/17/teleg...](https://www.forbes.com/sites/jasonbloomberg/2018/02/17/telegram- ico-scam-among-cryptocurrency-scams/#5e4b33fd1cf0)

<comment><USER82> > _taking on the weird regulatory risk and all the other weirdness associated > with Telegram 's (IMO crazy) ICO_

To make this more tangible, doing an ICO means a prosecutor can personally threaten anyone on the team with violating securities laws. That's a stupid risk to take if you know, as an organization, you're going to fight the U.S. government in court one day.</comment></comment></comment>


Why Semantic Versioning Isn't - <AUTHOR> https://gist.github.com/jashkenas/cbd2b088e20279ae2c8e <comment><USER2> There's a lot of things you can say about Semantic Versioning, but it's hard to say that it isn't semantic. What is it, then? Syntactic? Temporal?

The fact of the matter is that Semantic Versioning does capture something about the behavior of the release relative to others. It helps you answer the question, given the same inputs (where input can be defined as a sequence of API calls and their arguments), will these two versions produce the same results? That is inherently a question of the semantics of the libraries. In fact it's very similar to the question that the Liskov substitution principle[0] asks of objects and their classes, but using software libraries as the reusable, swappable component.

People make mistakes with Semantic Versioning. Sometimes, they just flat out don't care. The fallibility of a humanity is no excuse to throw out a perfectly good concept that can be very useful even when executed improperly, given that no other system is at hand to assist with the complex task of building large software projects out of a bunch of smaller parts.

Properly understanding what the "semantic" in Semantic Versioning means can go a long way. For example, if semantics is what the version number is looking to capture, perhaps a good place to turn when deciding how to bump a version is tests. Have they changed? How so? If you're doing property-based testing, answering this question becomes even easier.

[0]: [http://en.wikipedia.org/wiki/Liskov_substitution_principle](http://en.wikipedia.org/wiki/Liskov_substitution_principle)

<comment><USER3> Well, at some point the argument regarding the "semantic" nature of the build numbers is just silly. Especially in today's world where it is very possible that you could do things in a version 1.x.x of a product that you can not do in a version 2+.x.x. Anyone that just takes in any x.x.y update is asking for trouble if they don't have good testing in place. How does the saying go, "one developer's bug is some user's feature?" That is, if the only real meaning I can get is that "these two aren't compatible," I don't care what friggin scheme you did.

I confess that I am particularly annoyed with semantic versioning romance where it is deemed capable of solving all dependency issues internally to a company. To that point, this piece really resonated with me.

But, at the end of the day, I don't particularly care that there is "some breaking change" between two versions much more than I care that there were additional methods added. In the end, I want to know exactly what changed between things. As such, a changelog and a non-automated update system that is audited and purposely used is much preferrable to the promise of semantic versioning.

Though, I do have to cede that the promise of semantic versioning is better than the reality of never updating that happens for many folks.

<comment><USER2> 1\. That some things are possible 1.x.x that aren't possible in 2+.x.x is a fact that nobody would deny, and is consistent with semantic versioning. The point is to clarify the vague terms of "compatibility" and "breaking" by tying them to semantics of the library, as described above. Ultimately, this is a determination made by the developer. Any responsible operator is going to test before deploying, and that's how it should be regardless of versioning scheme.

2\. In combination with automated testing, it can go a long way.

3\. The first part doesn't make any sense to me. As to the second part, semantic versioning and a changelog are not mutually exclusive. In fact, the practice of maintaining semantic versions typically leads to much higher quality changelogs.

4\. Yes, the question is: If not semantic versioning, then what?

<comment><USER3> For me, the answer would be conscious upgrades of dependencies with a thoughtful view of the changelog.

Of course, I think I would also prefer less of a web of dependencies between so many different things now. It is almost comical. A few years ago, the complaint was that something like Java's JButton would have upwards of 160+ methods from the web of interfaces and superclasses it came from. Seems that today, that web "you can't possibly comprehend it" lies more in the dependencies of a product than in the individual classes.

And this only gets worse as some dependencies grow to encompass more and more.

</comment></comment></comment></comment><comment><USER4> I suspect you can be quite rigorous about the definition of a "breaking change." Removing methods from a public API or changing their interfaces (including adding or deleting _required_ fields from payloads, or removing/re- typing any existing fields from responses) is just a quick stab at it.

It seems like, rather than attempting to document some of the complexity of API changes/versioning at an admittedly coarse grain, your argument is that we should stick with version "truthiness." I don't think I can get behind that.

<comment><USER5> > I suspect you can be quite rigorous about the definition of a "breaking > change."

You'd be surprised. Here are two real examples.

1) Project X 1.5.2 inadvertently returns `undefined` in some edge cases when it is documented to return (and previously returned) `null`. Due to the way people use the API, it's rarely encountered (hey they're both falsy) and nobody even bothers to report the discrepancy between docs and behavior until 1.7.2 is the current version. Unfortunately, some large projects that are very common use the actual behavior of 1.6.0 and are checking for a return `=== undefined`. Are you justified in breaking them?

2) Project X 1.8.0 does a big refactoring that eliminates tons of bugs and improves performance, and even passes extensive unit tests with flying colors. Unfortunately there are lots of "Ten things I learned by reading the source for Project X" blogs that describe non-public API behavior. And again, the projects using these behaviors are popular projects that many other people depend on. How do you deal with these breaking changes of undocumented functionality?

<comment><USER6> So I know this is an idealistic point of view, but:

1\. It's documented to return `null`. The fact that it returns undefined in some edge cases is a bug. If you want to be nice about it, you can approach them and explain the upcoming behavior change as a heads up, however it's still a bug that should be fixed.

2\. No sympathy for those projects here; you can't use undocumented/private interfaces and expect them to be officially supported. I do it myself, however I do it with full knowledge that every single version change is potentially breaking to me, and I make sure to have unit tests to confirm the behavior still exists in X version. I may also approach the project and say something like "Hey, I found using X undocumented interface is actually really useful, how can we expose this as an official thing?"

<comment><USER3> It isn't just an idealistic view, it is somewhat counter to the view where source is the ultimate documentation.

This is especially true in projects that don't have the resources to maintain a well done documentation site with the source.

It is also completely counter to attitude of the most successful open source maintainer, by many measures.[1]

[1] [https://bugzilla.redhat.com/show_bug.cgi?id=638477#c129](https://bugzilla.redhat.com/show_bug.cgi?id=638477#c129)

</comment></comment></comment></comment><comment><USER7> Semantic versioning is useful _for specific interfaces_.

Not long ago I implemented a scheme almost exactly like it, but it's for a specific software component. The client is compiled against a header file for that component, and pulls in, statically, the major and minor numbers. I've implemented this sort of thing in the past too more than once.

At run time, the client is linked dynamically to the component, and so it can be calling a newer version than the one against which it was compiled. The component supports a "checkversion" function in which the client reports the numbers with which it was compiled. The function returns the current numbers to the client, along with an indication of whether there is compatibility (which the client can ignore). If necessary, the component uses the client's info to implement any backward compatibility hacks needed for that client. The client can also use the returned numbers in some way, if necessary.

These numbers for that component have nothing to do with any official version number for the project, or the package which contains that component. They are, _exactly as this article says_ for the "robot", not for humans.

It definitely is "semantic" versioning: the numbers have rigorously defined semantics, which is evaluated and used to make a concrete decision based on rules.

</comment><comment><USER8> Um, yeah, semantic versioning is for machines. That's the point. You're primarily writing software to be consumed by other software, not humans.

If you're actually shipping a product, then go ahead and have your human version number. No one needs to know the semantic version.

Just don't try to put your round humanized version peg into the square semantic version whole.

</comment><comment><USER9> When underscore does get a major change that the author feels is actually worth a major number signal, then it's quite possible that we'd be better off served by a name change: 'super underscore' or something in the same vein.

When such major changes happen, there are usually a large contingent of users that are disappointed because the old version will probably stop getting enhancements and may even stop getting bug fixes.

A name change is also a _very_ strong signal that the API changes are significant. Wider adoption of SemVer has ensured that major number changes are seen as less significant than they used to be, especially as the number gets larger.

</comment><comment><USER10> After reading "Semver Has Failed Us" [1] and this current debacle (among others) I feel like something like "ferver" [2] is more practical. The funny thing is, is ferver is what a lot of libs are de facto, even if they are trying to rigidly adhere to semver. `save-prefix = ~` has been in my ~/.npmrc ever since the default became `^`.

[1] [http://www.jongleberry.com/semver-has-failed- us.html](http://www.jongleberry.com/semver-has-failed-us.html)

[2] [https://github.com/jonathanong/ferver](https://github.com/jonathanong/ferver)

</comment><comment><USER11> Another view:

Of all the recent ideas of how version numbers should work, SemVer has this advantage: _I know how to interpret version numbers_.

But when FF 31 becomes FF 32 and Chrome 37 becomes Chrome 38, what will that _mean_? (I honestly don't know. Can anyone explain?)

<comment><USER12> It means 6 weeks have passed since the last Firefox release, and they are releasing a snapshot of whatever features they were able to make stable in that time. Also, it will not be an extended support release, because 32 % 7 != 3 (every 7th release is an ESR starting at version 10).

<comment><USER11> Well, now at last I know. Thanks!

</comment></comment></comment><comment><USER13> Version numbers attempt to compress an awful lot of information into one totally ordered number. I'm really looking forward to seeing the approach in [https://thestrangeloop.com/sessions/towards-annex-a-fact- bas...](https://thestrangeloop.com/sessions/towards-annex-a-fact-based- dependency-system)

</comment><comment><USER14> I think the only issue is that the middle digit needs to become a 'breaking change', the last digit anything which isn't, and the first digit should be left to the maintainer to increment as he/she sees fit. It seems like that's how most people care to use it, and it also bypasses the '0.x.x is special issue'.

</comment><comment><USER15> Related to issue #1805 ([https://github.com/jashkenas/underscore/issues/1805](https://github.com/jashkenas/underscore/issues/1805)) and other hn post ([https://news.ycombinator.com/item?id=8244700](https://news.ycombinator.com/item?id=8244700)).

</comment><comment><USER16> We use this format [http://datever.org/](http://datever.org/) in our shop.

</comment><comment><USER17> It's easy to point out problems with semantic versioning; I'd rather read about solutions. Semantic versioning is not harmful. What's harmful is its misuse; don't rely on all projects to apply it the same way.

With or without semver, I'm going to lock my dependencies and test thoroughly when I do bump them. But semver sure is handy to help me comprehend the degree of changes in project dependencies. It's also great for finding the sweet spots among common dependencies.

I'm all ears for something better, but semantic versioning does not need to be condemned, we simply need to use it correctly.

</comment><comment><USER18> It's a false promise... but also a worse-is-better phenomenon. Good enough, if your ignore the problem cases, to allow rapid progress. It tempts you, and delivers convenience often enough you come to rely on it, only to then discover more subtle problems it was hiding later. It's the worst system, except for all the others.

</comment><comment><USER19> I've always thought of semver as documenting common sense: fix bugs often, add features when possible, and don't break the public API unless you have to.

If all projects strictly followed semver, we wouldn't have this debate. But it's not semver's fault that some developers ignore common sense.

</comment><comment><USER20> Simple, add an optional human significant "ultra" version (better name suggestions welcome) to indicate a philosophical version upgrade consistent with how major versions have historically been used (as marketing communications).

E.g., 184.108.40.206 or 1.7.0 are equivalent.

</comment><comment><USER21> Is there not some kind of clever code or progress score to be derived from the churn of a projects test cover? Might be a cool way to encourage rolling source control and writing tests into a core way of judging quality.

</comment><comment><USER22> semver has had a major success has been in the osgi communiy where adoption seems like 100 pct. part of the reason is the fantastic build tool bnd which can analyze your code and tell you if its created a breaking change. personally I dont think such a tool is even worth pursuing in languages like js since redefinition and meta programming is a common practice. the failure for me is the language and the community not the idea.

<comment><USER3> I really wish OSGi wasn't in that ubiquitous space where it gets nothing but 5 and 1 star reviews. Worse, each end of the spectrum seems to have an agenda.

Seriously, it sounds like a nice idea and all. But it also sounds like an increase in work. For many shops, just getting out what they are currently committed to is tough. Increasing the commitment level seems counter to getting things done.</comment></comment>


Tutorial to Create a QR Code with your Logo in the middle using ASP.Net C# - <AUTHOR> http://markhagan.me/Samples/Create_QR_Code_With_Logo_ASPNet

<comment><AUTHOR> If you guys have any feedback or recommendations for new videos, I would love to hear it!</comment>


How to Insult a Computer Scientist - <AUTHOR> http://www.cs.purdue.edu/homes/dec/essay.criticize.html <comment><USER2> Another insult against a theorist:

"Interesting, I'm from industry and this appears very applicable to some of the work we're doing right now."

<comment><USER3> Har har har.

Extreme theorists don't hate applications, they just don't especially care if they exist.

<comment><USER4> At schools with separate "pure" and "applied" math departments, there's sort of a running joke in the pure-math departments that they feel offended if someone has accidentally managed to find their work useful, because it means they've, quite to their chagrin, advanced the agenda of the rival applied-math department (or at least, that they weren't "pure" enough). But of course that's a self-deprecating joke more than a statement of what theoreticians really think.

<comment><USER5> "In theory, there's no difference between theory and practice. In practice, there is."

I've lost count of the number of times a theorist has told me that result -foo- shouldn't be possible during application :)

<comment><USER6> I have said that quote a lot in jest. :) But I always remind myself that it is based on the problem that there is actually very little theory going on -- that the developer is doing a lot of random fuddling around with little understanding, little theory, until some piece of code produces a desired behavior. The developer may decorate his muddling with tests and wordy comments, but it is still muddling around. If the developer understood his system, then the little mysteries that break theory would not be so magical anymore, and he can move on to keeping his theory on par with his practice.

Countless times over the years I have seen areas where Academia is decades ahead of us so-called industry experts. What is "new", "shiny", and posted all over the place online today is built of theory produced 20+ years ago. In practice, we have gotten our tasks done without some of this knowledge, but theoretically, we have, over time in our ignorance, cost our employers millions of dollars in hours dedicated to bug-fixing and features that could not meet deadlines. It is a hard pill to swallow. The silver lining is that we can recognize this and work to grow, to learn that missed theory, rather than fall into the trap of complacency.

Today's fad is functional programming. In the coming years, we will relearn the weaknesses of functional programming, why OOP was the next stage of evolution. Hopefully we will have learned not to fall into extremist camps again (the notion of a "functional vs OOP" conflict still strikes me as hilarious misunderstanding).

<comment><USER7> Out of curiosity, could you share these weaknesses of functional programming and how OOP solves them? Or at least point me to some material that discusses them? I would be very interested. I have programmed in OOP for over a decade and just picked up functional programming in the last 2 years so do not have enough experience with FP to make any definite conclusions yet (although I am really liking what I see so far). Thanks.

<comment><USER6> I wish I had a good handle on that. There is much to functional programming I need to digest yet. But the hints are there (I noticed this in the timeline of when these various concepts were played with and integrated into standard specs), and in my own programming, I have learned to use the hybrid effectively. What follows is purely my current opinion, and it should include some healthy ignorance. I am but an egg.

If I were to put a finger on it, I would say that the reason OOP arose was that there was general recognition of the need for a rich type system. I got a hint of this in the first couple parts of SICP. Haskell incorporates a kind of type system that is, itself, pretty interesting. CLOS/Moose makes C++ and Java feel antiquated.

In my experience, a lot of us who learned OOP via C++, Pascal, Java, Ada, and the like generally missed the point: type systems. We tend to treat classes like collections of the language primitives as opposed to combinations of data structures. Specifically, we make do with primitive data types and _neglect to constrain them as a type_. And "everything must be an object" is an extremist mantra with little value; given that your process image must have an entry point, purely a code-flow issue, was there really a point to the illusion of wrapping the entrypoint main() function in a class (I am looking at you, Java)?

Here is an OOP type example I see in the wild: an ID that is a string of four characters, a dash, and three digits tends to be stored as a string. This is incorrect; that string is not like other strings, and this is a blind faith that somebody is not going to incorrectly use that string. Wrap that in a type that specifically checks that the ID fits that pattern. It is easy to fall into this kind of mistake in the database management world, too, where an ORM pulls in a VARCHAR2 and does not translate values of this type into an appropriate type in the system, perhaps a type with a restricted domain.

Another example: I have learned to always question if my method really needs to accept an "int". This is a smell. Could my value be negative? What is the real min/max range of the value? Could the value have a magic value, such as "Number Not Given" (or NULL)?

Functional programming helps us with code flow. OOP helps us carefully classify the data.

<comment><USER8> Most mainstream OO languages with a type system to speak of actually get in the way of correctly classifying data by confusing the separate issues of reusing implementation artefacts (aka subclassing) and classifying data into a hierarchy of concepts (aka subtyping). The only widely used OO language (for sufficiently narrow values of wide and wide values of OO) to get that right used to be Objective Caml, and recently its stepchildren F# and scala. So it is actually FP that helps you with the classification.

<comment><USER6> This is a very interesting point and should be highlighted. You said implementation artifacts (especially in reference to reducing code duplication), and for clarity, I think you are referring to the definition of operators on data (class methods, friend methods, and so on). I agree with you that subclassing (for the purpose of reusing behavior), traits (for adding behavior), and the like can be confused with classification to such an extent that modern designs tend to depart from type systems and be used for mere code organization.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> Cue one highly ranked HN news item with no news, nothing about startups, nothing specific to hacking, no real information, and nothing that gratifies one's intellectual curiosity.

Yup - I'm "that guy" and today I'm a grumpy old man. This item is just noise.

ADDED IN EDIT: And yes, I expected to be downvoted, because anything that smacks of criticism of the community gets downvoted. People don't like to be told that they're doing something wrong, especially people who are so damned sure they're right, or clever, or talented, or hardworking.

Yes, the very nature of an entrepreneur is to follow things through in the face of adversity, but when you're criticised you need to stop and see if there's some truth - to see if there's something you should learn.

Before you downvote this comment, ask yourself why? Does this submission as a whole really add value to the site? If it does, then my criticism doesn't, and rightly should be downvoted.

But if this item adds no real value to the site then my criticism is valid and should at least make you pause before looking for an arrow to click.

And if you _do_ downvote, then a reasoned response would add value. But maybe you really are just looking for cheap entertainment. Replying - adding value to the site - would be, you know, like, work.

<comment><USER10> According to the official FAQ (<http://ycombinator.com/newsguidelines.html>) on-topic is defined as: "Anything that good hackers would find interesting. That includes more than hacking and startups. If you had to reduce it to a sentence, the answer might be: anything that gratifies one's intellectual curiosity." Now I personally am a hacker (we'll leave the good for others to argue) and I find this interesting, if not rather humorous. This post currently has 51 points, meaning at least 50 other people also considered it interesting. If that's not strong evidence that this link belongs here please explain what is.

<comment><USER9> Do you really think it "gratifies one's intellectual curiosity." ??

Honestly??

I think it's a cheap joke with no intellectual value. Some people find it funny, and they will upvote it. I'll happily believe that 50, 100, possibly 1000 people here find it funny to think about how to insult computer scientists.

After you've read it - what have you really learned?

Upvotes do not of themselves mean an item meets the guidelines.

<comment><USER10> You are, of course, correct that upvotes do not "define" what belongs in this community. However if you will not accept that evidence, look at the other comments in this thread.

I see people having fun and satisfying their creative curiosity by making and building upon jokes inspired by this link. Links which link intellect and curiosity are quite often posted to HN.

To answer your question on what have I really learned... well that's not a question you want to start asking. I can point out quite a few articles that don't belong upon HN when held against that criteria. Take for example almost everything related to the NYT. I usually don't click on those and just wait for the blog post that explains the same thing with more information and less filler.

As for another argument that you will find quite easy to strike down, this is not somewhere where I go do to market research, it is somewhere where I go to entertain myself and find things, preferably about hacking, that I may read. This link does a brilliant job of being related to hacking while also being entertaining.

<comment><USER9>
      > this is ... somewhere where
      > I go to entertain myself

And there's the difference between my purpose for being here and yours. I entertain myself in other ways on other sites. I come here for information about hacking, startups, and things that satisfy my intellectual curiosity.

This submission does none of those. I don't think it's even especially funny or clever, but I've seen it all before.

Thank you for your reply - it has taught me something. There was a time when I would've upvoted you to show that you added value, but these days votes seem to be used mostly to express agreement or disagreement, so I'm disinclined. But I value your comment - thanks.

<comment><USER10> I hope we can continue to coexist here, sorry to be one of the new voices that is taking your community in a direction you don't want it taken.

<comment><USER9> Well, it's not "my" community, and never has been - I've just hung around and tried to add value in accordance with the guidelines. It's been that way since PG suggested I submit something. I'm just continuing to see how much value there is, how much I can add, and gauging when it's time to move on ...

</comment></comment></comment></comment></comment></comment></comment><comment><USER4> The insult-backfiring section reminds me of some interesting experiences as an AI researcher, with a slight secret penchant (as many of us have) for robot domination. When a humanities or social-science researcher starts talking about "technological determinism", "machinic tyranny", "sapping of human agency by machine", the "instrumental society", and similar, the AI researcher sits, trying hard to suppress a smile, thinking, "yes, yes, PLEASE do go on!".

</comment><comment><USER11> When I worked in CS research the sure fire way of making the Prof I worked for incandescent with rage was for someone from industry to start a comment with "In the real world...".

</comment><comment><USER12> Easier ways:

1) When he/she says they are a computer scientist, say "oh so you're like an IT guy? Because I recently got this virus..."

2) Call him a mouse jockey

<comment><USER13> What does "PC LOAD LETTER" mean?!

<comment><USER14> It means MS Word screwed you over _again_ , this time by switching from A4 to Letter while you weren't looking. Damn Americans and their _Imperial_ ist defaults! :D

</comment></comment></comment><comment><USER15> For some context (odd that it's not included in the essay itself), this is an essay by Douglas Comer from January 2009 -- according to the HTTP header, at least, which I'm inclined to trust given the system. If that name's familiar but you're not sure why, he wrote _Internetworking with TCP/IP_.

<comment><USER16> I know it's older than this, since it was up when I was at Purdue almost 10 years ago.

As a side note, Comer is the type that once he's decided you aren't worth talking to, he will do whatever necessary to ensure conversations with you are short, including applying the contents of this essay in spectacular fashion.

<comment><USER17> I prefer Spider Robinson's advice. _No one_ who you totally and completely ignore will keep pestering you for long. Some people take insults as validation, or are like kids who just want attention, but no one will keep bugging you if you don't even recognize their existence.

<comment><USER18> You have to be pretty cunning to execute that strategy. Otherwise you might find that that PHB ignores you at funding time...

</comment></comment></comment></comment><comment><USER19> Wow, from 2 years ago: <http://news.ycombinator.com/item?id=436058>

The comments back then were.. different somehow.

<comment><USER9> Interesting comparison - good find - thanks.

</comment></comment><comment><USER20> Doesnt this set up an oversimplified theoretical separation over the admittedly simple but continuous spectrum of research and corresponding insults??

<comment><USER21> Are you trying to insult him following the insult rules for theorists?

<comment><USER20> Tried a shot at both simultaneously actually. saying his theory is oversimplified(theorist) and that his insult system is missing a critical element (discrete approach is invalid - experimental faliure).

Anyone has interesting ideas to create a simplest possible insult that would work for both properties ? (yeah ok, i'm no theorist)

</comment></comment></comment><comment><USER22> That people working in the area of compilers are experimentalists explains a _lot_ about compiler theory.

<comment><USER23> Please remember to always compile with -O3

</comment></comment><comment><USER24> Q. What's the difference between 'theory' and 'practice'?

A. In theory, there is no difference.

<comment><USER25> In practice, there is.

<comment><USER26> That is the obvious symmetry. Anyone could have written it.

<comment><USER25> [http://www.brainyquote.com/quotes/quotes/y/yogiberra141506.h...](http://www.brainyquote.com/quotes/quotes/y/yogiberra141506.html)

</comment></comment></comment></comment><comment><USER27> > You can try to attack both parts simultaneously:

> I note that the _systems_ aspect of this project seems quite _complex_. Do > you think the cause of the convoluted implementation can be attributed to > the more-or-less `` _simplistic_ '' _mathematical_ analysis you used?"

This has to be my favorite one :)

</comment><comment><USER28> Purdue's CS Department is legendary in its archaic theoreticalness (if there's such a word, but would be a nice insult, I think). So much so, it seems, to produce a lot of funny commentary. For another popular example from proggit: [http://www.reddit.com/r/programming/comments/gcgv8/all_hope_...](http://www.reddit.com/r/programming/comments/gcgv8/all_hope_abandon_ye_who_enter_here/)

</comment><comment><USER29> Comebacks:

Despite all the equations, it seems to me that your work didn't require any real mathematical sophistication. Did I miss something?

Yes.

\----

Isn't this just a straightforward extension of an old result by Hartmanis?

Which one?

\----

Am I missing something here? Can you identify any deep mathematical content in this work?

Yes you are. Next question.

\----

Wasn't all this done years ago at Xerox PARC?

No, only several of the underlying technologies. Can you identify which?

\----

Have you tested this on the chip Intel got running last week in their lab?

No, but I'm sure it will work because I helped design it.

\----

Am I missing something? Isn't it obvious that there's a bottleneck in the system that prevents scaling to arbitrary size?

Did you miss that function isDebugOn(){ return false; } is O(1)?

</comment><comment><USER30> It seems that the author is a theorist, not a practitioner, as his theorist insults ("Despite all the equations, it seems to me that your work didn't require any real mathematical sophistication. Did I miss something?") are much better than his experimentalist insults ("Wasn't all this done years ago at Xerox PARC?")

If you want to insult an experimentalist, it's there's a much more cutting one - "Didn't Microsoft do something similar when they were working on CORBA?".

<comment><USER31> _Didn't Microsoft do something similar when they were working on CORBA?_

To which you'd get a puzzled look while they condescendingly informed you that Microsoft never worked on CORBA - that was the OMG, and Microsoft had COM/DCOM.

Xerox PARC is good, because they probably did work on whatever is being discussed.

Other options include "Didn't Englebert include that in the _Mother of All Demos_?" and "Didn't Taligent have that running?"

</comment></comment><comment><USER32> If I write code that needs to be performant, and I do it by using an efficient algorithm, analyzing it's complexity and use Big-O notation, I'm automatically a theorist?

That's hilarious.

</comment><comment><USER33> So you work in IT? - works on me just fine.

</comment><comment><USER34> Comment by a French computer scientist: "Well, of course it will work in practice, but will it work in theory?"

</comment><comment><USER35> I just finished a class with Prof. Comer. He is hands down the _best_ instructor I've ever had. He has a very down to earth method of teaching & personality for that matter.

<comment><USER36> CS250 ?

<comment><USER35> Yep. I take it you did as well :)

</comment></comment></comment><comment><USER37> My boyfriend just graduated with a PhD in computer science, and his mother sent a congratulatory email to him (with me in CC) saying "Congratulations on your PhD in IT!"

Much good-natured jibing was had after that. :)

</comment><comment><USER38> I can see that your work contains much that is new and good however the new is not good and the good, not new.

A paper on this work would be illuminating if ignited.

Congratulations: You have now once again successfully solved one of the one star exercises in Knuth's TACP.

In this work, is your coauthor a professor, post-doc, Ph.D. student, Master's student, undergraduate, or a visitor from a middle school?

So, your new programming language is Turing Machine equivalent. Okay. Beyond that its main feature is that it 'encourages a programming style' you prefer. Just why is that 'style' more significant than, say, style in the rag trade?

Your work has used some theorems from math but has it added any theorems to math?

<comment><USER39> > Congratulations: You have now once again successfully solved one of the one > star exercises in Knuth's TACP.

My CS professor has published papers that are solutions to exercises in The Art of Computer Programming. It's sort of a fact of life for computer scientists that whatever you're doing has probably already been done by Knuth.

<comment><USER40> Knuth has a large range of problems in his text. He scales them all by difficulty on a log scale from 0 to 50. Things rated 00-05 might be a basic facts or arithmetic (What is 6! ?).

A set of problems in the 20s would be a good chunk of work, each taking about 20-30 minutes. By the time you get to 40's, you're dealing with problems that you could write a paper on. In the introduction, he demands proof of Fermat's Last Theorem as an example for 50.

</comment></comment></comment><comment><USER41> Related: Things to Say When You're Losing a Technical Argument [http://www.pigdog.org/auto/mr_bads_list/shortcolumn/1914.htm...](http://www.pigdog.org/auto/mr_bads_list/shortcolumn/1914.html)

There are some interesting points in that list, some can be used against theorists, others can be used against experimentalists.

(I'm not sure if that article has been ever submitted to HN)</comment>


Ask HN: What do you do if you have passion but not the domain knowledge? - <AUTHOR> In terms of starting a startup.<p>And even more so if the domain knowledge / connections matter a lot, like building something for Hollywood for example. <comment><USER2> You have to research the domain, and gather the knowledge. Not knowing the domain can make that difficult because you sometimes chase rabbits down holes that go no where but you have to look at it as education for education's sake.

I will give you an example, I am a vehicle restoration enthusiast, I do what are referred to in the domain as restomods. The particular segment that I am a hobbyist in is older off road vehicles. There is a huge problem in this domain right now due to the computerization of the engine and transmission, when doing restomods many hobbyist like to update the power-train to a modern power-train, but in doing so they have to swap the entire power-train. There is no easy way to say take the best transmission available and couple it with the best engine available. If you want to you have to buy a black box from a vendor.

A lot of guys don't like having those kinds of restrictions as they like to tinker with the whole mod so they opt to stick to technology up to the point of computerization which has limited there options. For me, I never liked the idea of having those kind of constraints, so I started reading everything that I could about how these systems worked.

There is not a lot of direct information about how to modify them so you have to gather the domain knowledge and then begin the process of reverse engineering these systems. I read a lot of information that had no direct relevance to hacking ECU's but there may be one nugget of information in a book that lead to a discovery on my own. At first it was daunting because I did not know how to even identify quality information, but just reading and reading helped me to focus portions of the domain knowledge into something usable.

I use ECU hacking as an example because it is known for being a black art with very little direct information available, therefore one has to acquire domain knowledge to develop direct education on the system at hand.

</comment><comment><USER3> Get the domain knowledge through brute force,research,personal projects and determination. Even if it takes years. If you truly have passion it shouldn't be an issue. If you want to talk to people smarter than you then cold email them but make sure you always have something to "give" in the emails.If you don't, you will look like a leech.Read "How to win friends and influence people".</comment>


Anti-Portfolio - <AUTHOR> http://www.bvp.com/portfolio/antiportfolio?goback=%2Egde_1682587_member_192655139 <comment><USER2>
      3 - too expensive (Apollo, Apple, Intel)
      3 - bad idea
         1 - small market (eBay)
         1 - no traction (Lotus)
         1 - big incumbent (Compaq)
      2 - rookie team (Google, Paypal)
      2 - no reason (FedEx, Intuit)
      1  didn't understand (StrataCom)

If the reasons are to be trusted (take them with a grain of salt), then they may have learned to i) be more competitive on expensive deals, ii) give "bad ideas" more thought, and iii) not dismiss rookie teams.

<comment><USER3> If the rule that kept them from investing in Apple and Intel also kept them from investing in Webvan and Pets.com (and a dozen other costly failures) they might think on balance it's a good rule. You'll note there's no page on their portfolio for "bad investments we didn't make".

<comment><USER2> I entirely agree. From their perspective though, it's more important to pick the hits than avoid the losers (within reason). An investment in Google while they were in a garage could happily pay for a dozen Webvans.

</comment></comment></comment><comment><USER4> For those curious about eBay financing, check out the book "eBoys: The First Inside Account of Venture Capitalists at Work" [http://www.amazon.com/eBoys- Inside-Account-Venture-Capitalis...](http://www.amazon.com/eBoys-Inside- Account-Venture-Capitalists/dp/0345428897) (the book is 10 years old, likely to be available at your local library).

It was definitely not a slam-dunk idea, and even Benchmark partners felt uneasy about financing an online classifieds site that would be easy to replicate and invite large players to compete in case there was a valid market (Yahoo! indeed made a move at eBay with Yahoo! Actions priced at $0 listing fees, since Yahoo! had other sources of revenue).

While Meg Whitman was being recruited for the CEO role, she browsed the dinky classifieds site and was not super-impressed - Benchmark guys basically bought her and her family air+hotel to at least sell her on California prospects, if not eBay's future.

<comment><USER5> That book is a great read. Terrific look not just inside Benchmark but the late 90s VC world and some of the big startups from back then.

One of my favorite bits is the aforementioned sell job to get Meg Whitman to join (I believe Meg doesn't the credit she deserves for taking eBay from a tiny startup to a huge business). I remember laughing out loud when the Benchmark folks discuss Meg's kid having a crush on one of the VC's kids. Every little bit counted and they pulled out all the stops.

</comment></comment><comment><USER6> I absolutely love that they publish and maintain this. When I pitched them on Shopify I said that I'll show up on their website one way or another. Thankfully they decided they wanted to keep us out of the Anti-Portfolio and invested :-)

<comment><USER7> Hey, I love you guys and think you're going to take over the world. Signed up Shopify to do fundraising for my nonprofit (your terms are generous with the nonprofit discount), and was part of the team that recently did the Auctionhouse App for the Shopify Fund.

Love what you guys are doing. If you ever want feedback from someone using/viewing your service from many different fronts, drop me a line.

If anyone's considering Shopify, go for it -- amazing amounts of functionality without any difficulty configuring it, super fast to hit the ground running on a project that needs ecommerce, and tons of power under the hood if you want to expand. One of my favorite services I use.

</comment></comment><comment><USER8> Is this supposed to be a sarcastic article? It seems to me they're just documenting how stupid their decisions were. Is it inside joke? I feel like I am missing something.</comment>


Tau Station, the free to play sci-fi MMORPG, is now public - <AUTHOR> https://taustation.space <comment><USER2> Congrats to Ovid and the team! Now go sign up!

</comment><comment><USER2> Written in Perl!

</comment><comment><USER3> free 2 play: 2π Station</comment>


$5 via PayPal: The new Internet Model - <AUTHOR> http://thenextweb.com/entrepreneur/2012/04/06/the-new-internet-business-model-5-via-paypal/ <comment><USER2> Even more frictionless than this PayPal model is using Fiverr. I know you don't get the big names on there, but they have some amazing unique stuff on there making you wonder how they produce it for $5 (custom videos under a minute). I agree there is a lot of crap on there, but the top rated stuff can be gold.

</comment><comment><USER3> disclosure: I am one of my projects is videolla.com - its one of the biggest online video marketplaces. We can share some interesting stats on this. Yes, most of smart sellers sell for under 5 bucks. Its doesnts make much difference in you charge $3-4, anything that under 5 is about same conv. rate. if you are more greedy results will be lower.

and yes paypal is killing it! Its our default payment method and most of buyers prefer it, since they know that its safe.

</comment><comment><USER4> Louis CK was quite transparent with the results of releasing his standup for $5. Has Aziz provided any insight into his results?

</comment><comment><USER5> Why $5 via Paypal when you can send 1BTC via Bitcoin instead?

<comment><USER6> because very few people have bitcoins. His entire point is that $5 via Paypal is low and easy, acquiring and managing bitcoins isn't.

<comment><USER7> It is very easy to pay some dude 1 BTC. It is laughably easy to setup a bitcoin account at one of those wallet site. It can be very fast to acquire bitcoin if you're willing to pay the premium.

But nobody have bitcoin, yet.

<comment><USER8> It's also extremely easy to lose your bitcoins as well.

<comment><USER7> No easier than losing your data or having somebody hack into your computer.

It's money, you're suppose to treat it as such.</comment></comment></comment></comment></comment>


Show HN: Rompli – Simple Docker Hosting - <AUTHOR> Hi everyone!  I built a hosting platform called https://www.rompli.com.  It can host any docker container that listens on HTTP.  The web app is built entirely in meteor and therefore has first class support for meteor applications (sticky sessions, websockets, ssl).
How much does it cost? It is currently in beta which means two things.  1. It's free.  2. You may only have up to five (5) containers.
What do I get for one container? One container is 512MB memory with 0.5 ECU compute.  You also get single click coordinated rolling updates, and single click scaling.
How do I deploy my meteor app with Rompli? https://medium.com/@isohaze/how-to-deploy-a-meteor-js-application-on-rompli-com-48c775cae8c0#.izzu3693p
How do I use a custom domain name? https://medium.com/@isohaze/how-to-use-your-own-domain-on-rompli-89f8c6c91d96#.kwvbzbodi
Is there a FAQ? Yes: https://www.rompli.com/faq
What is the tech stack? The webapp is written entirely in email@example.com.  The container orchestration is implemented with [Docker Swarm](https://docs.docker.com/swarm/).  Nginx is used for loadbalancing and I have an Elastic Load Balancer in front of the nginx servers.
Why is it named Rompli? It got the name because docker containers work really well in groups and a group of otters is called a romp. Also the underlying technology is using [The Raft Consensus Algorithm](https://raft.github.io/) and a large group of otters is also known as a raft.
I hope you try it out and give me feedback!
Thanks, Kris <comment><USER2> Now that docker makes starting a cluster quite easy. Why do developers get excited by such a service? I'm trying to understand what they're looking for and how to service them better

</comment><comment><USER3> Never got a confirmation email so I couldn't try it out. There is no re-send functionality.

If this was coupled with a docker build service I would use it for sure.

</comment><comment><USER4> clickable > [https://www.rompli.com/](https://www.rompli.com/)

</comment><comment><USER5> Link?

<comment><AUTHOR> Hi, really sorry about that. It should be fixed now.</comment></comment>


How the dumb design of a WW2 plane led to the Macintosh - <AUTHOR> https://www.wired.com/story/how-dumb-design-wwii-plane-led-macintosh/ <comment><USER2> "User-Friendly" was a term that became a fad for a while in all computer ads and articles and then thankfully faded away.

It got so bad that one writer suggested that when you hit the words 'user- friendly" that you substituted the equally-meaningless words 'lemon-scented', and it would be just as valid.

<comment><USER3> On the other hand, the fad for seeking out weak and exaggerated causal relationships, in order to write an article with a click-baity title, seems to be growing apace.

</comment></comment><comment><USER4> why post article that requires paid membership?</comment>


Here's Why Google and Facebook Might Completely Disappear in the Next 5 Years - <AUTHOR> http://www.forbes.com/sites/ericjackson/2012/04/30/heres-why-google-and-facebook-might-completely-disappear-in-the-next-5-years.html

<comment><USER2> This is an interesting thought exercise, but it dies a quick death under real- works evidence. Even when using the logic set forth in the article...

Amazon is a web 2.0 company. Therefore they don't or won't "get" the next thing, i.e. web 3.0 or simply mobile. I'd argue that they're going to own it with a combination of the Kindle Fire selling like hot cakes and the always on cash register they've inserted in my pocket with their excellent iPhone App.

(It's a tiny sample, but with the handful of prime members I come in contact with on a regular basis it's a running joke how much of our shopping is done at Amazon and the majority of it through the mobile app. It's such an incredible one-two punch of speed, convenience and power to consume.)

</comment><comment><USER3> <http://news.ycombinator.com/item?id=3910348></comment>