Facebook Messenger begins testing end-to-end encryption using Signal Protocol - <AUTHOR> https://whispersystems.org/blog/facebook-messenger/ <comment><USER3> From what is written, I understand this to mean that users can select this feature for specific conversations. That not all messages are subject to this encryption.

I am not usually one for paranoia, but is anyone else becoming more suspicious about Facebooks motivations and involvement with gov? This feature is a massive boost for intelligence services dealing with unsophisticated actors. This reduces the haystack significantly, by users self flagging messages that may be incriminating. Multi-millions of FB messages must be sent every day, brute-forcing encryption on all of these is probably not possible. A small % marked as 'secret conversation'? Much easier.

Why doesn't FB just apply encryption on all messages? Surely they have the resources avail. Is it because this feature makes somebody else's job a lot easier? If my suspicions are correct, what sort of threats would this pick up. Are serious threats likely to use FB messages with 'secret conversation' flagged to co-ordinate actions?

<comment><USER4> Reasons from @alexstamos (CSO @ Facebook):

\- FBM is multi-device, and we'd like to see E2E usability improve to support this. For now, pick one device and keys never leave it

\- Secret conversations don't currently support popular features like searching message history, switching devices, voice/video, etc

\- Hundreds of millions use Messenger from a web browser. No secure way to verify code or store keys without routing through mobile.

"We don't want to disrupt people's current experience."

Source: [https://twitter.com/alexstamos](https://twitter.com/alexstamos)

<comment><USER5>
        Hundreds of millions use Messenger from a web browser.
        No secure way to verify code or store keys without
        routing through mobile.

I wouldn't use the web version if they had not disabled Jabber access... and then I could use OTR.

This trend makes me very sad... IM networks are getting more centralized as ever. I don't feel thankful for this kind of development. End-to-end encryption should not be a feature of the service provider, but the client. The way this works with Whatsapp/FB/Google just requires us to believe that their proprietary client is actually doing what it promises. And for me that I don't have a smartphone they just don't even promise anything.

I just wish I could use XMPP or Matrix with my non-nerdy friends. There was this time Google seemed to not be evil with GTalk/XMPP, but then... The business cynicism that dominates this industry, allowing people to claim that they "connect people" at the same time that they put everyone in digital prisons, makes me really want to leave computing and go live in a cave.

<comment><USER6> I honestly find this centralization as worrying as mass surveillance itself. I'm as afraid of the Facebooks of this world as I am of any government, and I don't want all my communication locked in with one company.

This is why I will not use or recommend Signal. Moxie's anti-federation stance is unacceptable to me. It's replacing one problem with another.

<comment><USER7> Can you elaborate on the "anti-federation" stance of Signal's creator? I'm not familiar with this.

<comment><USER8> You can't run your own signal server. All accounts use phone numbers in the same namespace as ID, and all messages go from the phone to opensystems.org, further on to google, and from google to the destination phone (with lots of encryption being added and removed at various points). This has advantages (it's difficult for the Man distinguish a received signal message from other android notifications) but also disadvantage (moxie can do traffic analysis and you can't do anything about it).

<comment><USER9> You can totally run your own server for yourself and your friends: [https://github.com/WhisperSystems/TextSecure- Server](https://github.com/WhisperSystems/TextSecure-Server) (you'll have to change the server's URL in the client's source as well and compile it yourself, but that's really easy)

What you won't be able to do is federate with the official servers.

Oh, and there's also a WebSocket transport (used by the Desktop client) that doesn't involve Google. That just doesn't provide a pleasant experience on mobile.

<comment><USER10> _> you'll have to change the server's URL in the client's source as well and compile it yourself, but that's really easy_

I'm sorry, but is this a joke? "To not use a centralized server that you can neither audit nor trust, you have to _recompile the client, but that 's easy_?"

This smacks of "oh, PGP for email is fiiiiiine." To say nothing of the silliness of the inability to federate.

<comment><USER11> No, it's not a joke and you shouldn't treat it as such. Non-technical people really shouldn't be whining that their "free service" doesn't cater to a click-and-run crowd. The source is available to the public to create their own, and changing a URL in the code is a single regex command away.

Don't casually disregard him because you or others can't understand basics of doing what it takes to alter and run a service in your own private space.

<comment><USER10> I don't casually disregard him. I thoughtfully and with consideration disregard him, and you as well. The idea that there is a priestly-class of technical people and "non-technical people shouldn't whine" is silly. This is not for technical people. This is _for_ non-technical people. I've been doing this stuff for twenty years. But me being able to do it doesn't do a damned thing to help the people who actually need help.

I don't need Signal to communicate with knowledgeable people. _We_ need something to communicate with everyone else.

<comment><USER12> And yet the same argument has been made time and time again against SMTP. Let's stand back for a second and understand why SMTP has stood the test of time. Yes it has flaws that allow the "first contact" problem (ie spam). But the people working on SMTP at least understand the weaknesses and advantages of that.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER4> Reasons from not enabling it by default by @alexstamos (CSO @ Facebook):

\- FBM is multi-device, and we'd like to see E2E usability improve to support this. For now, pick one device and keys never leave it

\- Secret conversations don't currently support popular features like searching message history, switching devices, voice/video, etc

\- Hundreds of millions use Messenger from a web browser. No secure way to verify code or store keys without routing through mobile.

"We don't want to disrupt people's current experience."

Source: [https://twitter.com/alexstamos](https://twitter.com/alexstamos)

<comment><USER13> Signal Protocol already supports multi-device. We've encouraged them to enable that for Secret Conversations, and hopefully they'll continue to iterate towards support for e2e by default.

<comment><USER14> That's nice! :)

What did the OP mean by "No secure way to verify code or store keys (in web browser) without routing through mobile" ?

<comment><USER15> There's no way for a site to securely store keys in the browser. The server can't put them there because then the server would have them too. A client- side script could generate them, but it can't store them without extensions (or the server via some JS it sends) also having access to them.

This is why Signal and WhatsApp require the client to run on the phone - <USER2> phones are doing the decryption for the web apps.

This is flaky, consumes a lot of battery and generally is somewhat error-prone - probably not something FB wants to deal with.

<comment><USER14> Server would have the keys _because_ the client-side code can send it to the server. That's also possible in the native app, isn't it?

<comment><USER15> Yes. But let's assume FB doesn't want the keys (because if they have them, then it's no longer E2E encryption), then client-side generated keys in a browser are still exposed to XSS attacks and extensions.

Installing a malicious extension, tricking users into typing commands in the developer tools, XSSing FB, all of these are much easier to do than attacking a native app on a phone.

<comment><USER16> How is the possibility of XSS worse than the status quo (plaintext)? Thats like saying SSL is useless on desktop because root kits and keyloggers exist on desktop.

<comment><USER17> A false sense of security can be more damaging than no sense of security.

Certainly it can be important to know when you have a "no compromises" security option versus "mostly better than plaintext but maybe not secure".

It could be a UX judgment to not confuse users they have a "secure connection" when in fact they might not. Look at all the various attempts over the years browsers have made to keep the UX semi-reliable and easy for users to understand whether or not their SSL connection is secure.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER18> "End-To-End Encrypted 'Secret Conversations'" in software that is ordinarily used to harvest electronic phone books and rummage through user photos, from a company that made its whole fortune trying to obliterate privacy as a part of human culture?

It's going to be pretty high standards of proof to give this anything that resembles credibility.

<comment><USER19> I am confident Facebook will meet your high standards when it comes to E2E encryption for Messenger.

<comment><USER19> And we had some smart outside people review it: [https://twitter.com/matthew_d_green/status/75140316340882636...](https://twitter.com/matthew_d_green/status/751403163408826368)

</comment></comment></comment><comment><USER20> This article doesn't mention it, but Facebook Messenger will be using the Signal protocol: [https://whispersystems.org/blog/facebook- messenger/](https://whispersystems.org/blog/facebook-messenger/)

also, here is the white paper (from the above post): [https://fbnewsroomus.files.wordpress.com/2016/07/secret_conv...](https://fbnewsroomus.files.wordpress.com/2016/07/secret_conversations_whitepaper.pdf)

<comment><USER21> I'm pretty sure (actually positively sure) the article mentions this.

<comment><USER9> I think the mods merged two threads here, and the other article didn't mention it

</comment></comment></comment><comment><USER22> I've read the whole thread and I'm surprised that nobody mentionned how easy it would be for Facebook to store the secret keys.

Page 10 of the white paper mentions that there is a remote key stored on Facebook servers which can be used to decrypt the local key. If Facebook still is to be trusted, I don't see what's the deal here.

I think that as soon as you put the words "end-to-end" encryption on a marketing material, you have to be ready to open-source your client. This is the cost that companies aiming to be credible can't escape.

End-to-end encryption without open-source has no value. It is a waste of energy for the company doing that too - or perhaps a marketing cost.

<comment><USER23> "End-to-end encryption without open-source has no value. "

Not quite.

It means nobody is going to be able to read your data other than:

A) A nefarious Facebook staffer who has hacked their internal systems

B) A government entity with a court order

It's a step up from no encryption

<comment><USER24> > It means nobody is going to be able to read your data other than:

(Assuming it is properly implemented and doesn't have backdoors, which can only be practically verified if the client is free software).

</comment></comment></comment><comment><USER25> It's worth remembering that this does not protect metadata. It's believed (though not known for sure) that WhatsApp logs metadata for their encrypted messages, and it looks like Facebook do the same here.

If you want to resist mass surveillance this is not a good solution.

<comment><USER26> I'd argue that WhatsApp and FBM adopting signal have been some of the highest- impact movements toward resistance of mass surveillance, largely due to sheer numbers and accessibility.

Sure, there is room for improvement, but having 0.000001% of t he population using an ultra-secure messenger doesn't have the same impact.

And hopefully those improvements will happen in time.

<comment><USER25> The point is that metadata is more valuable for mass surveillance purposes than content. WhatsApp and FBM do nothing to protect metadata.

<comment><USER26> are you serious?

you're suggesting that the metadata of "alice messaged bob at 1:20am" is worth more than "hey bob, I'm looking to have $100,000 laundered, same methods as last time. I'll drop to the usual location. thanks, Alice."

<comment><USER27> Well, yeah, without meta-data, you only know that _someone_ messaged _someone_ about laundering money. You have no clue who it is, so it's ultimately pretty useless.

Whereas with just meta-data, you can still at least figure out who the guy is talking to, even if you cannot figure out over this way that the guy is laundering money.

<comment><USER28> But the situation being compared is 'metadata' vs 'metadata + content'

</comment></comment></comment></comment></comment></comment><comment><USER29> I'm still sticking with the website version, thanks

[https://play.google.com/store/apps/details?id=com.facebook.o...](https://play.google.com/store/apps/details?id=com.facebook.orca&hl=en_GB)

Messenger, Facebook

This app has access to:

Identity

        find accounts on the device
        read your own contact card
        add or remove accounts

Contacts

        find accounts on the device
        read your contacts
        modify your contacts

Location

        precise location (GPS and network-based)
        approximate location (network-based)

SMS

        edit your text messages (SMS or MMS)
        receive text messages (SMS)
        send SMS messages
        read your text messages (SMS or MMS)
        receive text messages (MMS)

Phone

        read phone status and identity
        read call log
        directly call phone numbers
        reroute outgoing calls

Photos / Media / Files

        modify or delete the contents of your USB storage
        read the contents of your USB storage

Storage

        modify or delete the contents of your USB storage
        read the contents of your USB storage

Camera

        take pictures and videos

Microphone

        record audio

Wi-Fi connection information

        view Wi-Fi connections

Device ID & call information

        read phone status and identity

Other

        receive data from Internet
        download files without notification
        control vibration
        run at startup
        draw over other apps
        pair with Bluetooth devices
        send sticky broadcast
        create accounts and set passwords
        change network connectivity
        prevent device from sleeping
        install shortcuts
        read battery statistics
        read sync settings
        toggle sync on and off
        read Google service configuration
        view network connections
        change your audio settings
        full network access

<comment><USER30> I use Swipe for Facebook ever since they got rid of messages. It needs no permission, and while the experience can't be as good as Messenger, it will at least let me reply to the occasional message I receive.

I don't want to be encouraging Facebook's user-hostile moves, so I'll stop using messages completely if they make my life hard enough, but Swipe is a nice stopgap.

<comment><USER31> Coupled with how buggy its been on the iPhone platform since i got my phone I don't use it at all

</comment></comment></comment><comment><USER32> Moxie and team, bravo. You've made the snoopers jobs a whole lot harder.

Your goal of making encryption easy to use by the masses is coming come true. It looks as if PGP's days are numbered.

<comment><USER30> > It looks as if PGP's days are numbered.

This seems gratuitously hostile (and, even worse, is irrelevant). PGP is a very useful piece of software, and it does something completely different from Signal, and I'm glad both exist.

<comment><USER33> >> It looks as if PGP's days are numbered

Comments like this are inevitable and represent Facebook's attempts to induce us to route all of our communications though its platform. For the quoted commenter, it's probably too late.

<comment><USER34> PGP has failed to provide "encryption for the masses".

<comment><USER24> PGP fills a niche that OTR and Axolotl do not. It provides a bunch of operations that are not supported by OTR (anything that requires signatures that are verifiable by third parties). PGP is used by the masses (package signatures and similar functions), it's just that they don't use PGP for communication.

</comment></comment></comment></comment></comment><comment><USER35> Here's the technical whitepaper: [https://fbnewsroomus.files.wordpress.com/2016/07/secret_conv...](https://fbnewsroomus.files.wordpress.com/2016/07/secret_conversations_whitepaper.pdf)

</comment><comment><USER36> I'm not immediately seeing any insight into whether this covers conversations initiated in-browser. If this does exist, it'd be interesting to see how they've tackled the security of crypto logic in-browser and compare it to what Cyph has in place for in-browser code signing.

Reading the technical docs now ([https://fbnewsroomus.files.wordpress.com/2016/07/secret_conv...](https://fbnewsroomus.files.wordpress.com/2016/07/secret_conversations_whitepaper.pdf)).

 _Edit:_ Yep, this seems device-to-device; there doesn't seem to be a web component here. Still useful given how many people use messenger primarily via phone, and I suspect implementation wasn't hard given WhatsApp did it first. It would be neat to see if Messenger and WhatsApp are ever bridged through this.

<comment><USER37> Device to device. As you are aware, doing this in a browser in a manner that is not begging for failure is next to impossible.

<comment><USER38> Could you elaborate on why applying signal protocal in a browser is next to impossible?

<comment><USER36> Well, the keywords there are _next to._ Like @remy_ implied, you need a mechanism for guaranteeing that the logic you're executing in-browser is protected from server compromise. That's where the Cyph example came in, since as far as I can tell, Cyph is the team to have hacked together a solution to that dilemma, though Cyph also is not using the Signal Protocol right now.

Anyway, there's an upcoming defcon talk which'll lightly touch on how web standards were mangled and viciously abused to make that happen, but since the talk is deliberately not vendor-specific, the focus on it will be brief. Disclaimer on my end is that I was involved in the initial review of their code-signing implementation. [https://www.defcon.org/html/defcon-24/dc-24-speakers.html#Za...](https://www.defcon.org/html/defcon-24/dc-24-speakers.html#Zadegan)

<comment><USER39> What is the difference between compromising a web server that serves js library vs the one that serves device-native app binary?

This always s gets brought up when discussing in-browser crypto and could never get a satisfactory answer.

<comment><USER36> For one, device-native binaries have to be signed in order to actually run on the phone (well, without introducing some other tweak such as explicitly permitting unsigned applications).

Implementing this with JS is far, far, far more difficult, and the only solution known (touched on in my other comments) still pisses people off because it's running in a web context that, if improperly mitigated, can still facilitate disruption via code injection i.e. XSS.

That said, we're all conveniently ignoring the fact that all of this assumes that the devices themselves haven't been owned. If you think you're a target of entities capable of getting into a fully patched phone, you've got bigger problems.

<comment><USER39> So this is "whomever is signing the app gets compromised" vs "whomever is hosting js gets compromised". Right?

Facebook could afford a security team just as capable as Apples security team, and make sure the js server remains secure. And if they can't, their own signing procedure can get compromised before the app is uploaded to Apple for review.

I'm still not seeing the difference. Anyone?

</comment></comment></comment></comment></comment></comment></comment><comment><USER40> If the messenger is not open sourced, it's trivial for Facebook to add something to the client binary (now, with a flag or at some later date) before the Signal libraries are hit. I'm not saying they are doing so, but without a clear way to verify continually, this is just short of security theater. Then there's Facebook facilitating the key exchange which of course is another blind trust as well as all the juicy meta data. Maybe this will quiet some of the nerves of privacy conscious individuals already on the network, but it seems to me more like a marketing label.

I still find it hard to believe so many people trust what they believe to be private communication with close-lipped advertisement companies.

</comment><comment><USER41> Now that the Signal Protocol is deployed in so many different places, is there a proper specification of the (current) protocol? (The old axolotl spec and the GPL implementation don't qualify)

What are the licensing conditions / restrictions for using the protocol?

<comment><USER42> [https://github.com/whispersystems/libsignal- protocol-c#licen...](https://github.com/whispersystems/libsignal- protocol-c#license)

<comment><USER41> Sorry, but an implementation is not a specification. It is not only much harder to read, but it is also a moving target. It is borderline impossible to make an independent implementation of the protocol this way.

Besides, the fact that it is licensed under the GPL might mean that somebody porting the protocol to a different platform / language might be creating a "derived work" which also must be licensed under the GPL.

</comment></comment></comment><comment><USER43> While this is a great step, let's not forget that all FB has to do is track who chooses to use encryption and it can easily use that metadata to aid law enforcement.

</comment><comment><USER44> Genuinely thrilled to see the Signal protocol adopted for Facebook and Google stuff (albeit optionally). Now if we can just get Microsoft and Amazon to hop on-board, we might actually have a shot at getting this standard to be pervasive.

</comment><comment><USER45> Last I heard, didn't their messenger app pull a ton of not required permissions on Android?

<comment><USER46> The Messenger app has Android M permissions model now. you can say no to all of the prompts if you want. I have all of Camera, Contacts, Location, Microphone, Phone, SMS, and Storage permissions disabled.

<comment><USER45> Except my phone does not have the update yet (note 3). I really need to root this sucker.

</comment></comment></comment><comment><USER47> As much as this is a step in the right direction, you have to specifically enable encryption for individual conversations in Messenger. This implementation seems a little sketchy to me. They really should just encrypt every conversation automatically. Otherwise, encryption only encourages scrutiny.

<comment><USER48> If they end-to-end encryption all the conversations then they won't be able to mine all that data for advertising purposes...

<comment><USER47> True, however my point would be that when you have to selectively enable encryption, it only allows the government to more quickly find out who they consider suspect.

</comment></comment></comment><comment><USER49> I've been wondering about this for a while.

Now both whatsapp and Facebook have this, but surely they have the encryption keys too, or how else would they seamlessly fetch your messages and decrypt them when you get a new phone?

If they do, then what's the point?

<comment><USER50> I don't know about either anything factual, but I believe it was said that WhatsApp crux in the e2e is the iCloud backup. I believe that's where your old message get restored from.

I believe you can also disable that iCloud backup and thus the ability to retrieve those messages with a new phone.

End-to-End means encrypted in transport and not saved (in any form that is decryptable) on their servers. To that, I believe whatsapp fulfills their end of the bargain.

</comment></comment><comment><USER51> When it was still possible to use the Facebook chat via XMPP I used to use Pidgin as client, and chat securely using the Pidgin OTR plugin.

Message appeared in the Facebook page as "encrypted message".

I guess you hardly can get better than this.

</comment><comment><USER52> I'll use if could communicate with non-Facebook programs implementing Signal protocol.

<comment><USER52> I've found the blog post where moxie argues against federation:

[https://whispersystems.org/blog/the-ecosystem-is- moving/](https://whispersystems.org/blog/the-ecosystem-is-moving/)

"One of the controversial things we did with Signal early on was to build it as an unfederated service. Nothing about any of the protocols we've developed requires centralization; it's entirely possible to build a federated Signal Protocol based messenger, but I no longer believe that it is possible to build a competitive federated messenger at all."

</comment></comment><comment><USER52> How can I verify my device is indeed running the signal protocol? Messenger is a proprietary app.

<comment><USER37> If you need to ask this question then you don't have the skills to verify that your device is running a secure protocol even if I handed you the source code. There are people out there who do have the skills, and you can be certain that they will be reverse-engineering the distributed binaries as soon as possible. I would be extremely surprised if there was not a lightning talks or two at DefCon or BH this year going over the actual on-device code and how closely it hews to the known protocol.

<comment><USER13> We've verified that FBM is using the unmodified open source Signal Protocol libraries we distribute at open whisper systems. Hopefully others will verify the same!

<comment><USER52> OK, I'll wait for independent verification, thanks!

<comment><USER53> I'd pretty much call the creator of the Signal protocol an independent verification. It's not like he's employed by Facebook.

</comment></comment></comment></comment></comment><comment><USER54> dumb question: how do we (know|prove) a message is encrypted with signal when we use facebook, google allo etc. etc.

</comment><comment><USER55> I'd be very glad. I keep facebook for the people who don't have any proper IM (and for the in my view much more legit micro blogging on FB).

I'm scared of what will be possible to extract from my chat logs in a few years, but the benefit of being able to IM people that only have FB feels greater right now.

Biggest problem I see so far is the multiple devices issue, but for most it will be just Desktop and Mobile, so why can't you send each message twice, encrypted separately for each device (automatically, not manually)? Does OTR3 have this feature?

</comment><comment><USER56> A user complained that the title was misleading compared to [https://newsroom.fb.com/news/2016/07/messenger-starts- testin...](https://newsroom.fb.com/news/2016/07/messenger-starts-testing-end- to-end-encryption-with-secret-conversations/), so we replaced "deploys" with "begins testing" above. If someone suggests a better (i.e. more accurate and neutral) title, we can change it again.

</comment><comment><USER57> I would still use other means of communication for something really private until this becomes the default, because by opting-in I would essentially mark myself as suspicious.

</comment><comment><USER58> I wonder by "end-to-end" do they mean they will be implementing Signal Protocol, that would be a pretty awesome increase in security (for most peoples threat models)...WhisperSystems are genuinely amazing at what they do, they have like less than 5 staff and very little budget but they are literally saving hundreds if not thousands of lives. Any chance some rich HN member will recognise this and open up the chequebook to OWS?

<comment><USER59> Looks like it is : [https://news.ycombinator.com/item?id=12055375](https://news.ycombinator.com/item?id=12055375)

</comment></comment><comment><USER60> Facebook still keeps the messages, and uses the App to track you. Unless the Signal protocol is against FB itself, I don't see how this is news.

</comment><comment><USER61> One thing I don't understand how Signal implemented by platform providers is supposed to work with lawful interception? Either it doesn't work, in which case we expect law enforcement to just give up the right to wiretap things with a warrant (which seems unlikely) or it does work and is less private than one would expect.

<comment><USER37> It does not support interception, and LEOs are going to have to learn to live with just metadata or use targetted attacks to compromise endpoints.

<comment><USER61> I find that very unlikely in the long run. As long as you there's a company to put pressure on it will happen sooner or later.

</comment></comment></comment><comment><USER62> If this is why they are pushing me away from using messenger in the mobile browser, I'm suddenly way less upset.

</comment><comment><USER63> I downloaded Signal only to find out it doesn't support phones with dual SIM cards when sending unsecured SMS.

</comment><comment><USER64> That's great! Since they're thinking of rolling out a (relatively) standard protocol, maybe we could have the ability to message our friends on facebook from other services again?

Ya know, now that it won't be such a pain to support another protocol and all, since they're doing it anyway.

</comment><comment><USER65> So what. It's metadata that counts.

</comment><comment><USER66> Awesome news!

They should call it 'private conversations' instead of 'secret conversations' though.

</comment><comment><USER67> This is worse than useless as it doesn't encrypt browser initiated messages and doesn't work cross device. It's yet another attempt to force FB users to switch to the very shady FB Messenger app. I'm still not touching it with a ten foot pole.

</comment><comment><USER52> Ill try Facebook messenger on emulated android without a google account. Not a chance that I share all my phone contacts and everything else in permissions, simply so I can talk privately with my friends that are stuck in Facebook.

<comment><USER68> Can't you use a phone-only google account which you otherwise don't use for anything else? I haven't used Android, but would you be able to use your real email account in K9, while using a dummy account for the device itself?

<comment><USER52> > Can't you use a phone-only google account which you otherwise don't use for > anything else?

Yes, good point!

> I haven't used Android, but would you be able to use your real email account > in K9, while using a dummy account for the device itself?

The problem is that would prevent me from utilizing my android's contact list when emailing. When someone texts me, I like to easily click the name and then click on that contact's email address, which routes me to K9.

But your suggested has md thinking that since newer androids support multi- users, I could setup a separate account on my android specifically for Facebook messenger.

<comment><USER52> Tried it out...works!

</comment></comment></comment></comment><comment><USER69> Facebook took the same route as Google by providing secret conversations. However you look at this, this is a good step in the right direction. I still prefer Whatsapp and Signal because they both use E2E encryption by default.

</comment><comment><USER70> End to End as in from Facebook user to Facebook user?

This is insane--I thought the whole model of Facebook chat was that they are grabbing all sorts of info from the messages for ads. What the fuck?

</comment><comment><USER71> How susceptible is this Signal Protocol to a man-in-the-middle attack? Because if Facebook is going to be the man in the middle, then this feature is pointless.

<comment><USER72> Here Facebook isn't even a man-in-the-middle. They are a 'man-on-the-box'. They get to generate the nonces, keys, etc.

It's pointless to add encryption if Facebook is your root of trust.

</comment></comment><comment><USER73> Me, if I was working at Facebook, I'd have called it "Private Conversations." But hey, what's in a name?

</comment><comment><USER74> Kudos to moxie for building free alternatives that people (Signal) and companies (Signal Protocol) can freely choose.

</comment><comment><USER75> Telegram needs you to opt in too, I though?

<comment><USER76> Kind of, but you can only "opt-in" by using so called "secure chats". From their FAQ at [https://telegram.org/faq#q-so-how-do-you-encrypt- data](https://telegram.org/faq#q-so-how-do-you-encrypt-data):

"We support two layers of secure encryption. Server-client encryption is used in Cloud Chats (private and group chats), Secret Chats use an additional layer of client-client encryption."

It seems like many people (especially users/advocates of telegram) are confused by this, since telegrams marketing sounds like it's fully end-to-end encrypted.

</comment></comment><comment><USER77> what's the difference between

\- Messenger

\- plain vanilla messages i get in Facebook web site

\- 'chat' messages, were I to turn on 'chat' in Facebook web site

i'm not asking rhetorically. i honestly can't keep up with all the messaging avenues availabale today...

<comment><USER37> In theory they are the same, but with this recent release there is now a class of messages that are send device-to-device and cannot be viewed via the web interface.

</comment></comment><comment><USER78> But the Facebook app and Android still have access to unencrypted messages ...

</comment><comment><USER79> _Can 't stop the Signal._

Cute.

</comment><comment><USER47> I'm really skeptical about this. First of all, Facebook collects more user data than just about any company out there. They make most of their money off of advertising and harvesting user data and metadata. Facebook is just about the last company I'd trust to encrypt data of mine. It's like them saying, "hey, I know we make most of our revenue off of collecting user data but I think we should throw away a huge portion of that."

Additionally, from what I've gathered, they are going to role this out so that you have to specifically tell Messenger you want to encrypt a chat. Why would they not just make encryption universal? If anything, this makes it __even easier __for the government or other entities to target "suspicious activity." I'm far too skeptical of Facebook and how they are going about this whole process to be happy about it.

<comment><USER37> It is opt in because there is a huge base of users who use Messenger via the web, and trying to do E2E in that environment is a fool's errand. If you had ever tried to deliver a crypto improvement to an actual shipping product I am sure you would know what sort of limitations one needs to operate within, but please feel free to continue risking other people's lives for the sake of feeling smug in your ignorant dismissal of this effort.

<comment><USER33> >but please feel free to continue risking other people's lives for the sake of feeling smug in your ignorant dismissal of this effort

OK, I'll bite. How does this commenter's opinion (which is, to be clear, that the feature does not make him/her happy) risk the actual lives of other conscious, living humans?

<comment><USER37> I replied above, but there are few communication tools with such a wide userbase that have forward-secrecy and similar strong E2E crypto built in and available. People die because of what they post to Facebook or what they send in Messenger, I know this for a fact. With E2E security locked to devices it means that in the few seconds it takes me to wipe my phone while someone is knocking on the door with a gun then the other party to the conversation is not going to be compromised. Is that sufficient?

<comment><USER33> A totally satisfying explanation! I apologize, you had every right to invoke the risking of lives. However, I hope your hopefully hypothetical dissident who is saying the things that cause armed men to knock knows to avoid Facebook altogether (you know, that company predicated on watching the things that you do and turning that knowledge into actionable data in exchange for money). Failing to do that is indeed an existential risk if one thinks one's speech is that threatening to $AUTHORITY_IN_BED_WITH_FB.

I'll admit, too, that my reaction to your statements is colored by my other comment in this thread, which consists of being shirty about a dude who pontificated about PGP being unnecessary because of FB's new feature, which of course is ridiculous. Lives wouldn't be being lost, I reasoned, because only the foolhardy and unprepared dissident uses a surveillance network to organize dissent.

<comment><USER37> As a former FB employee I can empathize with the desire to avoid the mass data trawling that is involved in using the product, but having seen things from the inside I also know that people working there really, honestly do have users best interests at heart. During my tenure I worked on the effort to create Tor hidden nodes so that people could use FB via secure channels and watched the E2E effort go from Alec's wild idea to an actual product ready to ship. There are risks in using any centralized service, but having also poured almost a decade of money and sweat into an actual secure service only to see it wither because most people really didn't care I have finally come around to the idea that the efforts which will have the most long-term impact are the ones that subvert a popular service into providing the sort of security and privacy from government agencies that we all hope to eventually see. At some point you have to decide who is a greater threat, and FB doesn't have an army and really does try to do their best to resist overly-broad efforts by LEOs to gain access to user data. I understand why you would have absolutely no reason to believe any of this, but those of us who spent a bit of time toiling away inside will still keep trying to fight the good fight to deliver what people really need even if we have to put it in a sometime unpleasant wrapper.

<comment><USER33> >As a former FB employee

Oh shit, sorry dude D:

>I understand why you would have absolutely no reason to believe any of this

Well, it's not really that. Most serious tech-folk have realistic conceptions of privacy issues (he said in a comment on HN, but whatever), and your response above shows that you likely do, too. The controlling suits, however, typically have different priorities. Thanks for your response!

</comment></comment></comment></comment></comment></comment></comment><comment><USER80> Is this some sort of elborate trolling?

Can an exact match for a FB-provided binary be recreated from the open source code? If it's a No, then it's back to trusting FB to do the right thing and it doesn't make a slightest difference what exact protocol it's running or if the source was peer-reviewed behind closed doors.

<comment><USER37> As moxie has stated elsehwere in the comments here, they have confirmed that Messenger is using their open-source libs and I am sure that other people will do a bit of disassembly on the on-device binaries to confirm this fact.

<comment><USER81> It makes no difference what moxie said or seen.

Facebook may have an offshore account set up for moxie, they may simply be showing alternative source, they may have a rigged build system that builds from the patched source, etc. Seeing the source is the first necessary step to establishing any sort of real trust in a compiled binary.

You are also gravely mistaken in thinking that other people will take apart the binaries. It took several years for someone to try and verify a TrueCrypt build, which has a far more technical and privacy-minded following than the Facebook app. And even if some altruistic soul will do a binary audit of Messenger, it's all for naught as it's not a sustainable process. Every build needs to be verifiable _and_ the source needs to be routinely peer reviewed for the binaries to be trustworthy. Doubly so in the Facebook's case given the very nature of their business.

<comment><USER53> While I agree that we cannot simply take anyone at their word, your example of how the alternative could be pulled off is nothing short of Reynold's wrapped goodness.

</comment></comment></comment></comment><comment><USER82> So ... no comment on the choice of picture in the blog post? I hadn't heard of Jules Bonnot, but found the wikipedia article illuminating: [https://en.wikipedia.org/wiki/Jules_Bonnot](https://en.wikipedia.org/wiki/Jules_Bonnot)

This seems like it's a subtle endorsement for using Open Whisper Systems for criminal activities. Is it just me, or does that seem like the wrong image to gravitate towards?

<comment><USER83> Moxie Marlinspike, public face of Open Whisper Systems, identifies with anarchism. They include political radicals in most of their images of the application. It's not promoting criminality, except insofar as opposing state repression is criminal. Opposing state repression is the raison d'etre of OWS. I can't speak for them, but I suspect the fact that they're using software to do it is a secondary consideration.

</comment></comment><comment><USER72> Yeah no thanks. I don't trust Facebook with anything. I consider any software touched by Facebook backdoored.

They deserve that reputation.</comment>


BICOM: BIjective COMpressor - <AUTHOR> http://www3.sympatico.ca/mt0000/bicom/

<comment><USER2> Please add "(2000)" to the title.

<comment><AUTHOR> I can't do that, but this is not purely of historical interest anyway... the techniques are fairly current, given particularly that designing an LZ-based compressor with this property seems like it would be difficult or impossible.</comment></comment>


Was Alan Turing right about the mechanism behind tiger stripes? - <AUTHOR> https://simonsfoundation.org/features/science-news/biologists-home-in-on-turing-patterns/ <comment><USER2> You can generate your own Turing patterns with OpenCV.

Watching them slowly change and with different parameters can be very mesmerizing:

Video: <http://www.youtube.com/watch?v=KKwbDKRKG7k> multiscale turing pattern (python+opencv)

Code (Python): [https://code.ros.org/trac/opencv/browser/trunk/opencv/sample...](https://code.ros.org/trac/opencv/browser/trunk/opencv/samples/python2/turing.py?rev=6080)

Paper: [http://www.jonathanmccabe.com/Cyclic_Symmetric_Multi- Scale_T...](http://www.jonathanmccabe.com/Cyclic_Symmetric_Multi- Scale_Turing_Patterns.pdf)

<comment><USER3> Wow, that is awesome!

I spent the past weekend tying to wrap my head around OpenCV. After 3 days of bagging my head against the wall trying to get template matching to work, I determined that I am not yet smart enough for computer vision. The domain knowledge required seems to be very deep.

So, seeing the cool things people do with the library is inspirational, (but also makes me incredibly jealous).

<comment><USER4> Have you looked at the book "Learning OpenCV", by Bradski and Kaehler, published by O'Reilly? I haven't done much work with OpenCV, but I have read the entire book and it seemed to be a good introduction. A companion collection of examples is available online, consisting of a set of programs that can be compiled and used as a starting point for further hacking. A Google search on the title, happens to yield a link to the full text.

<comment><USER5> The O'Reilly book is very good to get a grasp of OpenCV but it is a bit outdated as it doesn't include the C++ API. You can still run through the examples but you might have to use Google a lot since a lot of function signatures have changed since the book was written. However the book is worth reading since it also introduces and explains a lot of computer vision concepts, as well as providing practical examples on how to use them.

<comment><USER4> Of note, there is a second edition due out in June, its subtitle is "Computer Vision in C++ with the OpenCV Library".

</comment></comment></comment></comment></comment><comment><USER6> No mention of recent developments in biology related to pattern expression or the older idea of heterozygous genetic expression:

The Notch signaling pathway: <http://en.wikipedia.org/wiki/Notch_signaling_pathway>

Heterozygous genetic expresson: <http://en.wikipedia.org/wiki/Calico_cat> <http://en.wikipedia.org/wiki/Barr_body>

<comment><USER7> Perhaps because those systems aren't chemical gradient systems such as elucidated by Turing?

It's meant to be an interest story/article, not a comprehensive analysis of cell signalling and phenotype display

<comment><USER8> However, the question is about tiger stripes. And modern cell-signaling analysis has given us the answer. So why no discussion about the answer?

<comment><USER7> Well, it has and it hasn't. For example tiger stripes don't have anything to do with the NOTCH signalling pathway, and the awesomeness of the x-inactivation in tortoise shell cats also has nothing to do with tiger stripes.

Rather, the Hox genes seem quite tied up with this. The Hox genes are nothing new, they were well characterised when I was doing undergrad genetics in 2006.

This article doesn't directly answer th question of tiger stripes but is trying to tie turing's old paper, which focused on tiger stripes as an example, with new research.

Interestingly it seems like this is all just reaearch which has been pooled together with the particular aim of celebrating turing's 100th last year (see [1]) and little of the research is intrinsically ground breaking or unknown to science, but almost done with the express purpose of celebrating Turing.

[1] [http://www.eurekalert.org/pub_releases/2012-02/kcl- spt021712...](http://www.eurekalert.org/pub_releases/2012-02/kcl- spt021712.php)

By the by, did anyone think that the textile seashell pictured in the article looked like some of the shapes created in iterations of the game of life?

<comment><USER6> Tiger stripes are an example of biological patterning, as is the Notch pathway impact on neural tissue development and also the fur characteristics in other animals. Barr Bodies, Notch, trisomy, all have major impacts on pattern production.

</comment></comment></comment></comment></comment><comment><USER9> BBC's "The Secret Life of Chaos" covers some of this from kind of a historical perspective. It's a nice pretty superficial documentary, I enjoyed it: <http://topdocumentaryfilms.com/secret-life-chaos/>

</comment><comment><USER10> How Mathematicians Think About Patterns - Professor Ian Stewart FRS

<http://www.youtube.com/watch?v=xLkQFC-Z-Vk>

there is a section about tiger stripes, leopard spots etc etc

</comment><comment><USER11> > A protein called fibroblast growth factor (FGF) serves as the activator, and > a gene variant dubbed Sonic hedgehog (Shh) acts as an inhibitor.

That brightened my day just a little bit...

</comment><comment><USER12> I wonder if these patterns are related to male pattern baldness too?

</comment><comment><USER13> >convicted of engaging in homosexual acts and sentenced to chemical castration. Amid that personal drama, he still found the time to publish a visionary paper

Even in the face of his entire society condemning him to a crippled existence, it's a testament to his fortitude that he continued producing brilliant works, unfettered. We're left to wonder what other insights Turing might have contributed to human progress had he not been stifled and squandered by the people in power in his day.

History is filled with examples of intellect being trampled on by the establishment: Galileo, Socrates, and even now Aaron Swartz. We still haven't grown out of it. We still need to fight it.

<comment><USER14> Wiki has a slightly different account of the conviction.

He was not sentenced to chemical castration, though that was the result, the treatment was to reduce the libido.

Interestingly Arnold Murray was released on probation.

Source is wiki of course so possibilities of inaccuracies.

[http://en.wikipedia.org/wiki/Alan_Turing#Conviction_for_inde...](http://en.wikipedia.org/wiki/Alan_Turing#Conviction_for_indecency)

Also apparently jail sentences for 'gross indecency' were rarer at the time, "(only 174 of the 746 men convicted of 'gross indecency' in 1951 received prison sentences-typically less than six months)"

According to this: [http://drvitelli.typepad.com/providentia/2011/04/the- turing-...](http://drvitelli.typepad.com/providentia/2011/04/the-turing- problem.html)

<comment><USER15> what source has no possibility of inaccuracy?</comment></comment></comment>


What should I do with my broken kettle? - <AUTHOR> https://www.bbc.co.uk/news/business-45969676 <comment><USER2> Partially inspired by FairPhone (mentioned in the article), Luke Leighton designed the EOMA68 standard to create modular open-source computers. The project was fully funded on crowd supply [1] a couple years back and is currently testing a batch of 100 before producing enough to cover everyone's orders [2].

Luke wrote a whitepaper on the importance of ecocomputing in 2015 [3] and it's well worth a read if you're interested in modular computing/reducing electronic waste.

[1] [https://www.crowdsupply.com/eoma68/micro- desktop](https://www.crowdsupply.com/eoma68/micro-desktop)

[2] [https://www.crowdsupply.com/eoma68/micro- desktop/updates/tes...](https://www.crowdsupply.com/eoma68/micro- desktop/updates/test-run-of-100-a20-cards-and-contract-work)

[3] [http://rhombus- tech.net/whitepapers/ecocomputing_07sep2015/](http://rhombus- tech.net/whitepapers/ecocomputing_07sep2015/)</comment>


Show HN: Bukkeru - <AUTHOR> https://bukkeru-fbwvwtjvva.now.sh/ <comment><AUTHOR> Quick app I built today to get a random image from [http://bukk.it](http://bukk.it)

Built with nodejs, zeit micro, zeit now, and mithrilJS

If curious, code is here: [https://github.com/Zakjholt/bukkeru](https://github.com/Zakjholt/bukkeru)

There's also a route to get a random link, if you wanted to build a slack bot or something</comment>


Ask HN: Need HN help to get a job - <AUTHOR>

Hey HN , I am 21 years old, a recent graduate with Bachelor Degree in EE and i have been programming since 2 years, and studying for my degree in the same time, since my graduation back in July , i have been looking for a job and i applied to more than 200 job (which were suited to my profile) and most of the time i don't even hear back , few of them give me rejection, since i live in 3rd world country, it's necessary for me to have VISA sponsorship, I am ready to work for the minimum wage (even though i never reached the salary part), I am self taught, I did rails development , Android , and also have some background in infosec from some CTFs and jobs that i have done, what do you think is the problem with my situation ? My github and resume : https://github.com/Kiloreux
http://i.imgur.com/89tx9No.png <comment><USER2> Part of your situation is the job market today. Even with the best situation (BA degree, good work experience, citizenship in a country with a good tech environment) - people don't hear back from most applications. In my experience, about 70% to 90% of companies don't even reply to most applications.

About 30% to 40% of companies that have posted jobs aren't really looking to hire anyone; they're testing the job market to see if their employees really are among the best. Or they don't have a good idea of what job they want the person to do, but are looking at resumes and taking interviews anyway.

I'm sorry to hear you'll have to relocate. But remember that the USA isn't the whole world; many European countries have a solid tech industry and better immigration policies. And there are some unexpected places that are becoming popular, like Kenya.

</comment><comment><USER3> Your resume (and this post) suggest that your grasp on proper English spelling and grammar is lacking. This is an immediate turn-off to anyone receiving your application (the first line of whom are likely to be human resources, not technical folks). You may want to work on that.

<comment><USER4> This feedback is a little harsh. OP's grammar is perfectly valid, it just isn't consistent with writing style we are used to seeing in a Resume.

OP -- I think this link will help you rework your resume so its more consistent with others from the US [http://www.ceswoodstock.org/job_search/resumegram.shtml](http://www.ceswoodstock.org/job_search/resumegram.shtml)</comment></comment>


Tonedeaf at the Top - <AUTHOR> https://ethicsunwrapped.utexas.edu/tonedeaf-at-the-top <comment><USER2> While I like that the article points out that the likely reason for the increase in the percentage CEOs gone is likely due to tightening of standards, I disagree with their assessment that its due to the rise of the MeToo movement.

Not downplaying MeToo, but the last several years have seen the likes of several auto companies faking emissions test results, for example. Then, you've also some major data breaches at big companies that have seen C level execs shown the door (e.g. Equifax), which personally I'd label both of these ethical violations and amoral, but for different reasons. Faking test results to beat a teat you can't otherwise pass is, for what I hope, obvious reasons. Failling to protect critical personally identifying information (PII) is a dereliction of duty and has exposed over a hundred million US residents to potential identity theft issues, in the case of Equifax.

From my observations, I think CEOs (outside of Entertainment industry) rarely get taken down by harassment allegations, but usually for underperforming or alleged fraud or other malfeasance.

I'm also not saying that it doesn't happen, but they usually have enough money to "make it go away".

<comment><USER3> The resignations and firings from the Equifax and Volkswagen scandals were not in 2018.

Meanwhile, Demos Parneros, Paul Marciano, Steve Wynn and many others were directly taken down by #MeToo in 2018.

<comment><USER2> I never once mentioned explicitly 2018, and specifically said over recent years.

Yes, some execs have been taken down by #MeToo, but I'd hazard a guess that those that have are in the minority of ousted execs.

</comment></comment></comment><comment><USER4> Hard to be surprised. I am nowhere near the top of any corporate ladder, but having worked in several large well-known unicorns in SF I am more confident than ever that it takes a certain person capable of playing political games, pushing others down, taking credit for others work, etc. in order to climb the ladder.

<comment><USER5> I wonder whether this holds for people like Sundar Pichai or Satya Nadella, both of whom have a pretty strong reputation as honest and "good" people afaik.

<comment><USER6> Good is a relative term specially when CEOs of multi billion dollar companies are concerned, but you do raise a very interesting point.

I do wonder if there are truly good people as CEOs of big companies and but truly good I mean people that would be recognised as such by most people that have worked with them/for them

<comment><USER7> Interestingly, there's been proposals to try and let the _market_ evaluate the "goodness" of a CEO. It basically involves issuing futures on the company stock which (1) only pay if the CEO is fired by date X, otherwise the futures are unwound (bought back at market price); (2) only pay if the CEO is _not_ fired by that date, otherwise they are unwound in the same way. If the price of the type-1 future is significantly higher than the price of the type-2 kind, the market is saying that your CEO is bad and by firing them you'll end up with a better replacement.

<comment><USER6> I think the term good was used in the sense of a good person, however you choose to define it, rather than good for the company, which if I'm understanding what you are saying correctly, is what these futures are about.

In any case, I'm not sure that the market is the best judge of what a good CEO is, with its near constant fixation on the very short term.

</comment></comment></comment></comment></comment><comment><USER8> Is this cyclic? When the economy is poor, most CEOs leave because the company's doing poorly, when the economy is good, most CEOs leave for other reasons.

<comment><USER9> It's also cyclic because fewer women that the CEO has to interact with will be hired.

</comment></comment><comment><USER10> >Today, thanks to the #MeToo movement, that is not a viable strategy for corporate boards

This is a strong assertion to make when no causal evidence has been put fourth; it's trivial to think of a significant amount of alternative explanations.

</comment><comment><USER11> I really wish they would not intermingle _ethics_ and _morals_ as those terms are not the same and are frequently contradictory.

<comment><USER12> The difference is only etymological. Both words mean "right conduct."

The word "morals" comes from Latin (mos, moris). The word "ethics" comes from Greek. Since, for a long time, the liturgical language of the West was Latin, we associate the word "morals" with religion, while we associate the word "ethics" with secular philosophy. Manuals on moral theology in the Greek Orthodox Church use the word "ethics" because that is their language.

In short, their connotations may be different, but their definitions are the same.

<comment><USER11> Not completely. Ancient Greece had _ethos_ and _logos_. The etymology of the English _ethics_ derived from ethos but the definition is different.

* ethos describes character and conduct

* logos describes pleas and persuasive speech. This is the etymological root of the English _legal_.

Ethics does deal with moral character and is a branch of moral philosophy but is more specific than mere right vs wrong as the word itself is more concerned with practical application. Ethics is typically concerned with decisions and alignment to rules or codes of conduct. In this way ethics has the most value in a legal and reputational contexts. It is safe to think of ethics as an alignment to rules that may be explicitly stated or commonly accepted.

Morals on the other hand are a broad term concerning right and wrong in accordance with societal norms and a personal value system.

These terms can be at odds when a person is asked to follow rules whose violation bears legal consequence but such conduct defies their personal values, such as: loyalty, confidentiality, or religious canons.

Sources

* ethos - [https://en.m.wikipedia.org/wiki/Ethos](https://en.m.wikipedia.org/wiki/Ethos)

* logos - [https://en.m.wikipedia.org/wiki/Logos](https://en.m.wikipedia.org/wiki/Logos)

* ethics - [https://en.m.wikipedia.org/wiki/Ethics](https://en.m.wikipedia.org/wiki/Ethics)

<comment><USER13> Pretty great comment, thanks for taking the time to write it.

</comment></comment></comment></comment><comment><USER14> Interesting... I thought this was about the isolation of the folks at the top from the rest of the organization. Instead it was just about morals, which, yeah... You can have great morals and yet still be tone deaf.

</comment><comment><USER15> _in 2018, 39% left due to ethical violations_

This seems like an incredible number. If the number one reason for bus drivers or real estate agents leaving the job was "ethical violations," it'd be some sort of moral crisis.

</comment><comment><USER16> Title is missing the trailing digit, should be "in 2018".

<comment><USER17> Either that or Imperial Rome was even less virtuous than I thought.

<comment><USER18> This is the correct answer right here.

</comment></comment></comment><comment><USER19> Red McCombs is turning in his grave.</comment>


Tech Talks - phatak-dev http://phatak-dev.github.io/techtalks/

<comment><AUTHOR> There's been quite a surge in curated lists in the last few weeks. How can I tell which ones are curated well?

<comment><USER2> Another list? :)

It would help if list creators included a header describing their editorial perspective.

<comment><USER3> 'A curated list of awesome awesomeness' [curated list of curated lists] [https://github.com/bayandin/awesome- awesomeness](https://github.com/bayandin/awesome-awesomeness)

<comment><USER4> [https://en.wikipedia.org/wiki/List_of_lists_of_lists](https://en.wikipedia.org/wiki/List_of_lists_of_lists)

<comment><USER2> We need more apps to support trees that can pivot on multiple roots, e.g. ConnectedText, NoteLynx or the venerable EccoPro & Agenda.

</comment></comment></comment></comment></comment><comment><USER5> Rich Hickey's all talks[0] are awesome! Definitely would be a welcome addition to this list! Few other good ones - [https://github.com/PharkMillups/killer- talks](https://github.com/PharkMillups/killer-talks)

[0] - [http://www.infoq.com/author/Rich- Hickey](http://www.infoq.com/author/Rich-Hickey)

</comment><comment><USER6> "Cool Code" by Kevlin Henney is quite fantastic I think. He lists some examples of amazing programs (like a chess program in less than 1K, and the Ruby quine with the rotating ascii-art globe). Maybe not so useful, but still great! [http://vimeo.com/28772428](http://vimeo.com/28772428)

</comment><comment><USER7> Having the same issue (listing tech talks) and seeing that lots of tech slides were made with HTML and available on github we develop a search engine in a week-end to reference them. [http://slidedeck.io/](http://slidedeck.io/)

</comment><comment><USER8> Since it is not readme based, I suggest including Y-Not[1] - an excellent talk about functional programming and lambda calculus

[1]: [https://www.youtube.com/watch?v=FITJMJjASUs](https://www.youtube.com/watch?v=FITJMJjASUs)

<comment> phatak-dev You can contribute by forking here [https://github.com/phatak- dev/techtalks](https://github.com/phatak-dev/techtalks).

</comment></comment><comment><USER9> Shameless plug for yet another site with curated tech talks: [http://www.aula.io](http://www.aula.io)

Also: [https://github.com/hnrc/aula](https://github.com/hnrc/aula)

</comment><comment><USER10> If you all want to see some more archived tech talks, check out what we had built at TechTalks.tv.

</comment><comment><USER2> Good list. Would you consider maintaining a JSON version?

<comment><USER11> There is already an ATOM feed: [http://phatak- dev.github.io/techtalks/feed.xml](http://phatak- dev.github.io/techtalks/feed.xml)</comment></comment>


Ask HN: Value of .com vs other TLD's - <AUTHOR>

How much value is placed on a .com vs other TLD's?  In this age of mobile apps, my co-founders and I are trying to figure out if it makes sense to get a crazier .com name or a simple .something-else. <comment><USER2> The additional revenue that comes from a perfect domain is roughly equivalent to the cost of building a bike shed.

Actually, it depends on the audience, as ibstudios pointed out. A "mobile audience" isn't enough information to make a good decision; among potential users of mobile devices are such different groups as children, adults who raise children, adults who don't raise children, old people... These groups can be broken into even smaller demographics.

If you're counting pennies, more alternative TLDs can be more expensive over time ([https://news.ycombinator.com/item?id=7069513](https://news.ycombinator.com/item?id=7069513)). If you can find a short but not too cryptic .com, go with it. An .io, for instance, has the advantage of shortness and more available English words.

The domain name should be pretty low on the list of priorities for your app. Focus on design (for the app and for marketing pages), content and marketing copy, good customer service, and performance.

</comment><comment><USER3> From personal experience with a .me product, it is fine. There is like 1% who dont get it, but I also noticed they are _the same people_ who mess up the non-TLD part of the address. (They just don't have great listening / reading skills)

</comment><comment><USER4> It depends on the purpose of the website.

<comment><AUTHOR> The purpose of the website of us is really just to serve as a landing/informational page for the mobile application we are building. Think of it like [http://www.snapchat.com/](http://www.snapchat.com/), all of the rage for Snapchat is in the app, not really on the website. We're looking to go down a similar route.

</comment></comment><comment><USER5> I think it depends on the audience.

<comment><AUTHOR> We are looking to target a mobile audience. Our app will be the primary user interaction with our software.</comment></comment>


Show HN: How many times a link has been shared? - <AUTHOR> http://www.linkb.info

<comment><USER2> That's unusable. \- First, it requires that I create an account. F* that. Hopefully mailinator isn't blacklisted. \- Then I tried adding a URL, "<http://yourls.org>. Nothing happened. After a couple random clicks, I figured that it add been added to the "All time" tab. \- And now, if I want to check the stats for this link again, how am I supposed to do it if the link disappears from All Time top 10?</comment>


Ask HN: Any insight into which web app I should develop next - <AUTHOR>

Hi, GOOD: I have the luxury of spending the next 3 months on developing a web app. BAD: I have no idea what i should develop.
Im trying to learn from my mistakes. A few years ago I built a photosharing website. I shut that site down as I just couldnt get enough paying accounts.
Now I understand that it makes more sense to build an app that caters towards small businesses as they would be more willing to spend on an app if it helps them generate more money.
The problem is I dont have any idea what I should be building. Should I start a: "issue tracker", "project managment app", "proposal creation app"...
I would appreciate any thoughts or insights you may have. My monetary goal: generate approx $5,000 a month in revenue. <comment><USER2> You could spend a month researching these 3 markets to see which needs the overhaul...</comment>


The Vacuum Tube's Many Modern-Day Uses - <AUTHOR> https://tedium.co/2018/11/13/vacuum-tubes-modern-day/ <comment><USER2> What this article doesn't mention is why vacuum tubes are still used in guitar amplifiers:

The "distorted guitar" sound common in rock music is a direct result of nonlinear characteristics of tube amps (both the tubes themselves and the coupling transformers necessary to connect an output tube to a speaker). Tubes exhibit "soft clipping" when pushed to their limits, which has the effect of producing the harmonic content associated with distorted electric guitar. Rock and roll pioneers got their sound principally from driving tube amps past their limits. "Overdrive" pedals are usually just voltage boosters that make the amp's input signal louder, but this pushes the amplifier past its clean linear section into the nonlinear crunchy overdrive that guitar players want.

Modern tube guitar amplifiers, even "new" designs, generally follow one a handful of basic circuit topologies, all derived from a few classic designs. Even the iconic Marshall "Plexi" amp was a close copy of an earlier Fender. These circuits are extremely simple; a handful of tubes, transformers, and passive components, often less complicated than the internals of a single LM741. Here's an example: [https://www.thetubestore.com/lib/thetubestore/schematics/Fen...](https://www.thetubestore.com/lib/thetubestore/schematics/Fender/Fender- Deluxe-5A3-Schematic.pdf)

It's possible to mostly recreate this sound with digital signal processing or carefully-tuned solid-state analog circuitry, but players like the sound of tube amps and are willing to pay for them, and so the market exists as it does.

<comment><USER3> I've found that a really good proxy for how good an amp sounds is the number of line-items in he BOM. The fewer the better.

A lot of the classic designs that sound good and still sell have exactly what they need to get the job done well and no more. It's almost like all the major (and boutique) amp manufacturers took one of three or so amp designs and just threw components at the schematic until you couldn't recognize it right away, and sell it as some revolutionary design. I wouldn't be surprised to find that it it all came from some RCA reference design in 1950

<comment><USER4> There some truth to that, but not always.

Ideally you would want each time to be fed with a noise free constant current supply. Having each tube on its own power supply would be incredibly expensive but sound awesome.

Buffering the output of each tube would prevent blocking Distortion, but would also be fairly expensive (although now we have mosfets that can handle 500+, so that might not be as bad).

Split audio path about, where the bass goes through cleanly and the treble is overdriven would also sound incredible, but be expensive.

Designs end up being about compromise: the above features will add $5-$35 to the bom per tube, and in the end, a lot of people just end up buying on brand.

My Laney Lionheart L5T has a really cool preamp that uses solid state surface mount components where they don't affect the signal. This drives the bom cost down but sounds incredible (fully buffered fx loop, fully buffered reverb tank).

<comment><USER2> And further counterpoint: some guitar players like the sound of overdriving a tube power supply (the attack on a loud note reaches current limits for the p/s rectifier tube, dropping rail voltage, increasing harmonic content). Mesa "dual rectifier" amps made this an option, letting players switch between tube and solid-state rectifiers.

There's definitely room for "improving" guitar amplifiers; I personally think that many guitar players like classic sounds, buy on brand as you said, and the brands just try to reproduce classic designs with any deviations made for cost more than for any other reason.

</comment></comment></comment></comment><comment><USER5> The article briefly mentions magnetrons and X-ray tubes, the former of which is made in massive quantities today for consumer appliances. Other vacuum tubes in current use include the vacuum fluorescent display, the photomultiplier tube and the electron multiplier tube. I believe old school vacuum tubes also still have application in high-wattage class-C RF power amps. Vacuum tubes for audio receive a lot of lip service, but they really are botique, lunatic fringe stuff in that application. Magnetron tubes are the only practical choice for microwave ovens; in contrast, power output tubes for audio amplifiers are inferior to semiconductors in every way.

<comment><USER6> I think you mean traveling wave tubes for high power RF amplifiers [https://en.m.wikipedia.org/wiki/Traveling- wave_tube](https://en.m.wikipedia.org/wiki/Traveling-wave_tube)

There are also klystrons, which are oscillators, used for high power radar generation, particle accelerators, etc... [https://en.m.wikipedia.org/wiki/Klystron](https://en.m.wikipedia.org/wiki/Klystron)

</comment></comment><comment><USER7> And of course, there's the Nixie tube.

[https://www.youtube.com/watch?v=wxL4ElboiuA](https://www.youtube.com/watch?v=wxL4ElboiuA)

(Previously posted in [https://news.ycombinator.com/item?id=12623738](https://news.ycombinator.com/item?id=12623738), the maker's web site via [https://news.ycombinator.com/item?id=12308974](https://news.ycombinator.com/item?id=12308974), and covered in an IEEE article via [https://news.ycombinator.com/item?id=17397133](https://news.ycombinator.com/item?id=17397133))

</comment><comment><USER8> In 2002, you could buy a PC motherboard with a sound section amplified by a dual-triode vacuum tube. You can still find them on eBay: [http://ixbtlabs.com/articles2/aopentube/](http://ixbtlabs.com/articles2/aopentube/)

<comment><USER9> There's still a market for tube amps, although most are external for both aesthetic and practicality purposes.

<comment><USER10> Guitar amps too!

</comment></comment></comment><comment><USER11> People who are interested in vacuum tube technology might enjoy the following youtube channel:

[https://www.youtube.com/user/MrCarlsonsLab](https://www.youtube.com/user/MrCarlsonsLab)

<comment><USER12> A counter channel (hilarious guy revives old TVs sitting out in the desert for 50 years). He's the voice of LA:

[https://www.youtube.com/user/shango066/videos](https://www.youtube.com/user/shango066/videos)

Also, make your own tubes (in Texas while wearing a dress):

[https://www.youtube.com/user/glasslinger/videos](https://www.youtube.com/user/glasslinger/videos)

</comment></comment><comment><USER4> I recently designed and built my own guitar amp. I highly recommended the book "Designing Preamps for guitar and bass". Absolutely fascinating read and software engineers could learn a lot from the writing style! It's very approachable.

</comment><comment><USER13> I didn't see too many uses listed. Here is one:

[https://en.wikipedia.org/wiki/Active_Denial_System](https://en.wikipedia.org/wiki/Active_Denial_System)

[https://en.wikipedia.org/wiki/Gyrotron](https://en.wikipedia.org/wiki/Gyrotron)

[https://www.sciencedirect.com/science/article/abs/pii/S00422...](https://www.sciencedirect.com/science/article/abs/pii/S0042207X13001516)

<comment><USER14> Other than ADS systems, and the audio and microwave ovens mentioned in the article:

\- Huge-ass klystrons used to drive particle accelerators (which themselves can be thought of as the largest vacuum tubes ever made)

\- High-power transmitting tubes used in radio and TV broadcasting

\- TWTs are still used for some satellite communication work, both on the ground and onboard the space vehicles

\- There's still no solid-state substitute for X-ray tubes. Hard to find a semiconductor with a 50,000-volt band gap

\- Cesium-beam tubes used for timekeeping (as well as masers used for the same purpose, for that matter), although entire atoms are emitted in those sorts of tubes rather than just electrons

If you don't count fluorescent lamps as "vacuum tubes," those are about all the remaining applications I can think of.

</comment></comment><comment><USER15> High power RF transmitters are still a notable realm of tubes.

<comment><USER12> True, but apparently not any more in the broadcast industry. To make a 50 KW AM station these days, you use 50 1 KW solid state amplifiers and combine their outputs.

[https://www.youtube.com/watch?v=GXh23qrPniM](https://www.youtube.com/watch?v=GXh23qrPniM)

</comment></comment><comment><USER16> Glad I have not jettisoned the two or three boxes of tubes stored up in our water tank tower that I inherited from my father in law - Time to go exploring again!

</comment><comment><USER3> Photomultiplier tubes, still pretty much the only solution for photon-counting applications.

</comment><comment><USER17> Vacuum tubes can't be that hard to make.</comment>


Two Large Chinese Borrowers Miss Bond Payments - <AUTHOR> https://www.bloomberg.com/news/articles/2019-02-11/two-large-chinese-borrowers-are-said-to-miss-bond-payments <comment><USER2> The house of cards is starting to fall.

<comment><USER3> not sure why your comment was also downvoted.

it seems that anything that points to a reality that doesn't paint China favorably are downvoted instantly here and reddit.

given SV's willingness to take Chinese money, I'm not surprised if see winnie the pooh banned on HN.

</comment></comment><comment><USER3> this is HUGE. here's why:

You and I are reading about two separate entities, as if we are talking about Pepsi Inc. vs Apple Inc., but alas China is simply not America.

[https://www.youtube.com/watch?v=auiGFRmD0tg](https://www.youtube.com/watch?v=auiGFRmD0tg)

edit: care to explain the downvotes? why is it anything I post on HN are automatically downvoted and flagged? It's so weird, right after I commented on that Israeli-spy thread too.</comment>


Show HN: I made a site to help you find good nonfiction books - <AUTHOR> http://learnbyreading.herokuapp.com/ <comment><AUTHOR> Hi, anyone enjoys reading nonfictions (e.g. business, social science, biography and others) here? I enjoy reading them a lot, because I can always learn a lot from them.

However, a lot of books on Amazon simply do not have good ratings, and sometimes I need to spend a long time to find a good book to read. so I collect the data from Amazon and apply some filter and made this site. The books being displayed are with good review stats.

I hope this is helpful for you to find some good books.

<comment><USER2> Very cool! When you say you "collect the data from Amazon," are you scraping this or using an API? If the latter, which API and where can I go to read about it? I also would love to be able to query this kind of information from Amazon.

<comment><AUTHOR> I scrape the data. The API from Amazon seems not very informative.</comment></comment></comment>


Google Instant Makes SEO Irrelevant - <AUTHOR> http://www.steverubel.com/google-instant-makes-seo-irrelevant

<comment><USER2> Steve doesn't take into account the amount of people that will actually make it through their search term entirely. Is there data somewhere on how often users click on suggestions as opposed to writing out the term in its entirety?

Even so, Google will still rank sites based on SEO and will in turn use that to suggest terms when users are typing. This just means that it's even _more_ important to be the top result for a given search term.

</comment><comment><USER3> I hate getting caught by link bait. "oh no SEO is irrelevant", I should read this to see why! No, I shouldn't.

</comment><comment><USER4> wow... not even close. It is like he does not understand the point of SEO.</comment>