Automating Threat Intel with NLP: Grasping Concepts from Underground Discussions - <AUTHOR> https://delvesecurity.com/automating-threat-intel-with-machine-learning-extracting-the-underlying-concepts-from-underground-discussions-and-osint/ <comment><AUTHOR> Very interesting article detailing how to use Latent Dirichlet Allocation to extract topics from cybersecurity vulnerabilities, then use the model to track the most trending topics from online discussions. By mapping back the extracted trends to the vulnerabilities topics, it is possible to rank the most attractive and exploitable vulnerabilities. Very concise and intuitive.</comment>


How Design Works (2012) - <AUTHOR> https://startupsthisishowdesignworks.com/ <comment><USER2> For a website that is all about design, I found this website to be not very intuitive or pleasing to look at. I may be in the minority though.

I found the typography was too big, there were too many bold/italics/font sizes and the actual elements of what makes good design made me click in order to reveal what the elements are.

<comment><USER3> This feels to me like design overload. Someone tried to do too much or too many ideas in a single page. I'm with you, I don't like it.

<comment><USER4> I also had this feeling, but I'm a far cry from an expert, so I kept my mouth shut.

I can confidently say I wasn't a big fan of the design, though.

</comment></comment></comment><comment><USER4> Second highlighted word already doesn't work, so now I can't read more about "undesigned."

(Same for "unstoppable" later down the page)

<comment><USER5> Same for "aesthetic"

</comment></comment><comment><USER6> Why is "environmentally friendly" an aspect of design here? Maybe industrial design but certainly not a factor in digital design.

<comment><USER7> In security, environmentally friendly designs are almost always insecure. The reason is that you get all that low cost and energy through tons of integration/sharing. This introduces attacks from hardware emanation on up to software issues due to shared resources. The paradigm of both reliability and security is isolation of problems one can't prevent. Long story short, that leads to extra hardware in many forms. Means those systems will always use more space and energy.

Further, the stuff that's easier to verify and more diverse is on the older process nodes. They deliver less transistors and use more power in the same space. However, they're cheaper in mask costs, open-source tools can semi- handle them, still diverse in number of fabs, and easier to reverse engineer. So, once again, high confidence and low design/development cost = not environmentally friendly.

For high confidence systems, it's best to just forget about the environment entirely. As if those smartphones weren't manufactured from very polluting processes anyway. Their users are just as guilty: just more judgemental. ;)

<comment><USER8> Curious, what areas or systems are sacrificing environmentally friendly choices for security choices?

<comment><USER7> You can start with my security framework that lets you see all the risk in modern systems along with many techniques for addressing it in development process:

[http://pastebin.com/y3PufJ0V](http://pastebin.com/y3PufJ0V)

The stuff on the bottom, esp hardware, usually need either faster hardware or extra hardware to isolate functions on dedicated chips/boards. Except in most brilliant designs, the more things you counter the more chips or energy you must use.

An example is a VPN where you have one node for trusted side (Red), one for crypto component, and one for untrusted side (Black). This is called Red-Black separation: used by many high-assurance, crypto devices. Having a node/chip/board each lets you make separation work to your advantage. The Red and Black nodes will each handle transport, input validation, conversion from complicated (i.e. standard) interfaces to simpler ones (esp non-DMA), and administration to a degree. The crypto node, running state machines for just security part, can be built on all kinds of hardware, have minimal onboard software, and use about as much security as you like. Such a combo of physical isolation, interface protection, and implementation simplicity lets you have confidence that even strongest attackers hitting Black node won't steal data from Red. That's three pieces of hardware at a minimum with more if you isolate crypto node's logical functions (esp I/O).

Another angle comes from an approach I advocate against nation-states called Security through Diversity. The risk is that markets converge on a small number of hardware, peripherals, OS's, etc. Nation-state resources are large & necessary targets are small. High odds of 0-day development. Also, increasing worries that modern stuff might be subverted by NSA, China, Russia, etc. Easiest way of dealing with this is to diversify one's hardware (even processor types) and use portable software that cares not what it runs on. Plus lots of randomization and obfuscation. All this makes the job of getting from known software issue to working, stealth exploit harder. The best hardware choices are all old hardware or embedded which takes more hardware (i.e. servers, boards) to equal modern performance. Will use more space and energy.

Combining these two models will certainly use more space and energy. Plus, a lesson established by criminals and spooks alike is to treat all the equipment as disposable: constantly changing it. Sure someone might use it if you erase it and drop it off at a pawn shop, etc. The trend still causes more hardware manufacturing and waste, though.

So, there's a few ways that security against High Strength Attackers trades against the environment. There's some tradeoffs that can be made with MCU's/CPU's on low-power process nodes but development costs are prohibitive. New projects will likely combine existing ASIC's onto boards with redundant, power-using components. That power usage itself is a security hole (eg side channel attacks) guarantees this.

</comment></comment></comment></comment><comment><USER9> Discussed at the time: [https://news.ycombinator.com/item?id=3791427](https://news.ycombinator.com/item?id=3791427).

</comment><comment><USER10> unsurprisingly, well designed! And very informational.

If you're a bootstrapped startup, you should probably consider a bootstrap template. There are a lot out there, and it allows you to leverage a designers thoughts, ideas and work that they've already done, and adopt them to your own, all to the tune of $9. Unless you absolutely know what you're doing, or unquestionably need a designer, its better to pay for something prefab and build out from there.

</comment><comment><USER11> I'm interested in reading this but it isn't designed for mobile screens.

Who needs that, amiright?</comment>


Ask HN: Please review my startup - <AUTHOR>

Its my attempt to simplify the process of sending and getting paid for invoices<p>http://www.howtosendaninvoice.com <comment><USER2> I'm going to be harsh, but this needs a LOT of work.

1)Maybe its my screen resolution (1280*1024), but the "Pay now" box overlaps the content of invoice sheet.

2)Where the hell is login? Not where I would expect it, somewhere at the top. its at the left side... In the middle?

3)Why is there a "tip" box that is titled "How?" What does that even mean?

4)What does the open button do in the bottom left corner? Er... Ok.. It saves my invoice...

5)Everything is just kind of floating around, no defining lines or colors. Makes it very hard to decide what is part of the web app and what is not.

This needs a major amount of UI changes to even make sense.

<comment><AUTHOR> I am on a roll working through this. I could only get to a 1280*768 on my machine but I see what you mean. The Pay Now box is now in its right place.

If you are around could you please test this again and let me know? I will be grateful

<comment><USER2> Pay Now is now correctly placed. Good job making fast changes!

Some updated thoughts:

1) I'd keep the [X]'s inside the App to be honest. They look kind of jarring outside, but maybe there is a third option I am missing

2) Still need to move login/signup to somewhere more obvious. Maybe move both those up to the very top right, along with moving "Hello Guest" with them up there as well. Then move the logo to the top left (instead of a little bit down from the top left), and make the Logo, sign in/signup/hello guest into a "top bar" by adding a line below these items. Would probably help a lot.

3)Pay Now is not overlapping, but now I'm not sure what it means. Does this mean I need to register (change this to Sign Up to keep wordage the same) to get the "pay feature", or is this part of the invoice?

<comment><AUTHOR> 1) The [X]'s are ugly I know... I will try and get an icon to come up on hover.

2) A top menu will probably clean up the mess with the menu items. I will work on that.

3) Good suggestion. I have changed the wordage now. Yes, it means you get the pay feature (your client will be able to pay you directly using PayPal or a CC)

Thanks again :-)

</comment></comment></comment></comment><comment><USER3> Also messed up on my screen.

Would be nice if users could load a background image.

You could extend the idea to other kinds of common form templates.

<comment><AUTHOR> could you tell me your screen resolution?

This sounds interesting.. "You could extend the idea to other kinds of common form templates" - call me naive, but could you explain that with some examples that came to your mind please?

loading a background image is a neat idea... will add that to my list</comment></comment>


HyperCard: What Could Have Been. - <AUTHOR> http://www.wired.com/gadgets/mac/commentary/cultofmac/2002/08/54370 <comment><USER2> I want HyperCard, exactly as it was, but for Windoze. How can we go about developing this? It's 1986 technology, so we should be able to reverse engineer it today, right? How about Python or Lisp to replace HyperScript?

<comment><USER3> I don't think it's being actively developed, but check out PythonCard: <http://pythoncard.sourceforge.net>

It looks to be exactly what you're after.

<comment><AUTHOR> The reason why no one has been able to duplicate the success of HyperCard is that all of the contenders have focused solely on the attributes it _had_ , rather than the ones it _did not have_ \- namely, the bloated, revolting, and limitless unnecessary complexity of today's programming environments.

An accomplished HyperCard user was justified in feeling like the "master of all he surveyed." Even _trying_ to cultivate such a feeling in the users of "modern" computing systems is akin to building an amusement park on quicksand.

</comment></comment></comment><comment><USER4> I did some of my first programming in HyperCard in elementary school, so it's a nostalgic subject. It was a clever and flexible program. Its game-creation sibling was WorldBuilder, which I "borrowed" from my 5th grade computer teacher, because it had been discontinued when Aldus bought the Silicon Beach company and they wouldn't sell it to me.

</comment><comment><USER5> I remember HyperCard being our main development platform.

And then one day someone showed me this application called NCSA Mosaic. It looked kind of like HyperCard but didn't seem to be quite as robust. I think I said something like "That will never catch on."

</comment><comment><USER6> Okay, let's not kid ourselves here. The point of HyperCard was to create animations of stick figure skateboarders going off jumps during computer class when the teacher wasn't looking.</comment>


Warmer planet, higher food scarcity - the-red-herring https://komonews.com/news/local/study-global-warming-puts-crop-chomping-insects-in-the-mood-leads-to-rise-in-food-prices <comment><AUTHOR> You can add the higher rate of migration. Border walls will become the norm. This is important to relise now so we can avoid future conflicts.</comment>


Superhuman: Read Statuses - <AUTHOR> https://blog.superhuman.com/read-statuses-bdf0cc34b6a5 <comment><USER3> No one who is outraged by this didn't know this was going on with almost every email tool out there. I don't understand how this manufactured outrage gets hyped, when literally every email tool in existence does this as standard practice. Every marketing email you get from a brand has this tracking. Every customer support email has this tracking. Every feedback form has this tracking. Every receipt for every purchase has this tracking. Every signup form for your kids friends birthday parties has this tracking. Every single pull request notification you get from GitHub has this kind of tracking. Go to your inbox right now pick any email message and view the source. You will most likely find a 1px by 1px tracking pixel.

I imagine anyone who works at any company that uses any kind of digital tool uses this exact same method to track people, so why the outrage here. Go tell your marketing departments to turn off email tracking in Salesforce, or to stop the marketing team from running campaigns with tracking in them.

<comment><USER4> Story time! Recently, I've been thinking back to when lack of SSL was a huge, widespread problem on the Internet. This was back in the mid 2009-2010's, and at that point, one company in particular was lagging: Facebook.

So some random person made a browser extension that automatically collected the login credentials of everyone who opened Facebook on whatever public network you were connected to.[0] Then they publicly released it for free. Ironically, the very first comment in the article I link here is, "Okay, it's evil, but how is this news?"

But the Firesheep plugin was a really big influencing factor in forcing not just Facebook, but a number of companies to switch their entire sites to HTTPS.

The point I'm trying to make is not that you should go out and blow up the world to make a statement -- it's that it's possible for there to be a problem that's trivial to exploit, and that is regularly exploited by criminals and businesses, and that is widely known to be exploitable, and for some reason people will still ignore it.

But if it's personal, if your next-door neighbor or your weird coworker can suddenly start doing it, then something clicks and people realize, "Oh, this is actually a real problem."

There's no technical difference between what Superhuman was doing and what every other marketer is still doing, but people are weird about what exactly they're willing to care about, and if the Superhuman controversy can be used to direct some of that anger towards structural, useful goals, then is that really a problem?

I understand that sometimes the specific triggers that make people care are stupid, but my response to that is never to ask people to care less. It's already hard enough to make people care about things.

[0]: [https://lifehacker.com/firesheep-sniffs-out-facebook-and- oth...](https://lifehacker.com/firesheep-sniffs-out-facebook-and-other-user- credential-5672313)

<comment><USER5> > But if it's personal, if your next-door neighbor or your weird coworker can > suddenly start doing it, then something clicks and people realize, "Oh, this > is actually a real problem."

What is "it"? Knowing I read an email they sent me? That's not what criminals and businesses are doing; criminals and businesses build extensive personalised profiles of who you are, what you like, what times you're active, where you go, who your friends, family and coworkers are and what your personal trigger points are all for the goal of exploiting you. They use email tracking as a single metric among dozens of others, and the way they evaluate the metric is completely different to how an individual would evaluate it. That data is usually then sold to other groups that do the same thing.

How is that anywhere even close to an individual with email read receipts?

I don't think anyone would say "this is actually a real problem" besides people manufacturing a problem out of nothing. I'm also willing to bet that 99.9% of the people that are outraged are totally willing to establish, work for, or implement an extensive user tracking system for a company that actually acts on malicious grounds (such as monitoring users or for the objectives of making sales).

This includes you - by the way - a quick look through your resume shows that every single company you've worked for _heavily_ participates in tracking and the first personal website of yours I accessed at reset-hard.com includes Google tracking which is dozens of times worse than a "weird coworker" knowing you read an email they sent. This is literally contributing to a global database of user tracking which we _know_ is used for malicious purposes.

> I understand that sometimes the specific triggers that make people care are > stupid, but my response to that is never to ask people to care less. It's > already hard enough to make people care about things.

When people care about the wrong things is when we end up with homosexuality being criminalized, prohibition or terrorist groups. So hopefully in this case - just like many others - people would focus their energy into things that actually matter. And personal email tracking is not one of them - and will never be.

<comment><USER4> We could break down each of your personal accusations: some of them are fair and some of them aren't. But you don't really care about any of that. You're not trying to make a point here beyond, "you're hypocritical and therefore your obsession over privacy is unimportant."

The only thing worth saying on that topic is that it matters very little what you (or anyone else) thinks of me, whether it be good or bad. I don't even judge myself that way; I only care about trying to be better tomorrow than I am today. Anything else is a waste of time. And certainly, my response when I encounter hypocrisy is to try and fix the hypocrisy. Not to throw up my hands and say, "well, I guess none of it matters then."

The above out of the way, I want to try and engage with the deeper argument you're making in good faith.

What you're missing here is that all of the business tracking and personalized profiles you bring up as the real problem are using the exact same technology as these read receipts. The point is not that read receipts are the worst thing in the world (although I think they're unhealthy and they show a lack of respect for the person you're communicating with). The point is that they illustrate the broader pattern of tracking in a form that regular people understand and emotionally connect with. That's a good thing.

The other thing you're missing when you talk about criminalizing homosexuality and prohibition is that pervasive tracking is a tool that allows powerful people to oppress less powerful people. Pervasive tracking outs people's sexual preferences, it allows companies to illegally target individuals based on protected characteristics, to advertise to people at their most vulnerable moments, and to exclude them from opportunities that they would otherwise have. Far from being a nothing issue, privacy is fundamentally tied to people's ability to express themselves without fear and to hide from companies, governments, and even individuals that want to harm them.

Fixing personal email tracking has a pleasant side effect of also fixing the tracking that happens in both phishing and corporate emails as well. Like you quoted:

> I understand that sometimes the specific triggers that make people care are > stupid, but my response to that is never to ask people to care less. It's > already hard enough to make people care about things.

Yes, sometimes people can be encouraged to care about things that are actually unimportant, or even outright wrong. But privacy isn't unimportant; privacy is an essential tool to help protect individuals and marginalized groups from mobs, governments, companies, and individuals that don't have their best interests in mind.

<comment><USER5> My point is that this is manufactured outrage from people who don't actually care. They're just caring because it is today's flavor of the day. There are real steps people can take to support user privacy but they don't do them. People happily and voluntarily engage in objectively worse conduct for privacy day-to-day. This includes myself too -- my employer had me add not one but two separate tracking scripts on my company's homepage. I "care" about privacy yet here I am participating in stripping it away from people.

> using the exact same technology as these read receipts

What technology people use doesn't matter, what matters is how they use it. If I were to implement a system that tracked actions users do in a way that was ethical and completely not personally identifiable, then it doesn't matter - there is no problem, regardless of what technology is used to do it.

> Fixing personal email tracking has a pleasant side effect of also fixing the > tracking that happens in both phishing and corporate emails as well

I don't think so. At all. This is like banning plastic straws to save the planet.

It is mutating what is basically a porch security camera into a discussion on oppressive government surveillance. The two are not the same. Personal email read receipts have almost no bearing on privacy at all. This is perhaps the point that is being missed by most people.

<comment><USER4> So, there is a part to this argument I agree with -- which is that getting mad exclusively at _Superhuman_ ultimately accomplishes very, very little. Because you're right, this is absolutely everywhere, and literally every non-personal email you get has these same trackers.

My hope with this whole controversy of the week is that it leads people to disable loading remote images by default, and it leads email providers to change their default settings. I don't want to see people riled up just for angers sake -- I want to see that anger directed towards making changes that help with the entire spectrum of email pixel trackers.

This is where I think we disagree:

> _What technology people use doesn 't matter, what matters is how they use > it._

You make a good point that Superhuman isn't doing anything unique, and you make an (arguable) point that what Superhuman is doing isn't even that bad on its own terms.

But if you have to trust companies or 3rd parties to be responsible with a technology, you're still leaving yourself open to less ethical attackers. The safest fix is to get users onto platforms where _no one_ can track them, even if those trackers are deployed in responsible ways.

Think of it this way -- you make a completely reasonable assertion that including Google Analytics on a web page is a personal violation of privacy[0]. When I get around to removing Analytics from Loop Thesis, that will be an improvement. But I'm not under the illusion that doing so will affect anyone other than my visitors on my site.

There are two steps to this process. One is to be personally responsible about what we do. The other (equally important) step is to empower users such that they don't need to rely on us being responsible -- by encouraging them to install ad blockers, by building browsers that resist fingerprinting, and so on. I want to respect people's privacy, but more than that, I want them to be private _regardless_ of whether or not I'm trustworthy.

Encouraging products like Gmail or Fastmail to block images by default is not the biggest step in the world -- it certainly doesn't fix everything. But it is a step, and it makes things slightly better. There is no short checklist to fix omnipresent surveillance; it's a long, arduous road where we hope that things gradually get better over time. The outrage over Superhuman will be beneficial if it encourages some people to change a setting in their email clients that they didn't know existed.

[0]: [https://gitlab.com/danShumway/site/commit/c294dc81ae330ec432...](https://gitlab.com/danShumway/site/commit/c294dc81ae330ec432133252b3b2c489e0fc9da9)

</comment></comment></comment></comment></comment></comment><comment><USER4> Put me in the camp that this is not out of the ordinary for what most marketing emails are already doing. Also put me in the camp that it's unacceptable.

My takeaway is that Superhuman is a scuzzy company that I want nothing to do with, but my takeaway is also that Superhuman backing down doesn't really solve the problem. Everybody does this -- and I don't care if Superhuman is worse than everyone else, _none of it_ is acceptable.

An immediate partial solution is for us to push very hard for email providers not to load remote images by default, and (better) for image providers to load remote images one-by-one, rather than in a single batch (which would make it less likely that a user will accidentally turn the tracking pixel on with a single click). An email provider loading images by default should be derided the same way that loading a blog post over HTTP currently is. Have good defaults that protect your users. There should be a swath of email providers on Twitter right now reassuring their customers that tracking pixels won't get loaded by default in their clients.

If you're upset about this, I don't want you to be less upset. But I want you to think about being _also_ upset about stuff like Amp for email, which will make it even easier for companies to pull this crap. I want you to _also_ be upset about email providers that don't turn off images by default, or that don't do any background caching to obscure IP addresses.

There's a large number of obvious improvements to make in this area, and a lot of discussion to be had about non-obvious improvements. If people are only mad at Superhuman, then the overall machine will continue as normal, and all that anger won't actually accomplish much in the long term.

Superhuman is calling this a critical feature, so they're not getting rid of read receipts. My perspective is that their business model is built on a technology that _shouldn 't_ work. They're speculating whether there could possibly be a technology to support consent. I couldn't care less about theoretical consent technologies, I want their entire business model to stop existing.

<comment><USER4> Just to follow up on this, I currently use Fastmail for email. I like Fastmail, a lot.

But why doesn't Fastmail block remote images by default? Yes, they have a setting, but why isn't it turned on for new accounts? If I tell my parents to sign up for Fastmail, I don't want to have to worry about whether or not their default settings are safe.

<comment><USER6> FastMail does block (well, decline to load) remote images by default: [https://www.fastmail.com/help/receive/remotecontent.html](https://www.fastmail.com/help/receive/remotecontent.html)

If you aren't using FastMail's webmail, it's your email reader's responsibility. FastMail quite reasonably doesn't rewrite email content.

<comment><USER7> gmail does this too.

(which just means you've chose to leak your privacy to Google instead of Superhuman...)

<comment><USER4> I'm not a fan of Google, but to me leaking your privacy to a mail provider you chose to sign up for belongs to a different privacy category.

It's very good that Gmail proxies images, it's one of the few features that I wish everyone else would copy. Now, on the other side of that, unless their policy has changed since the last time I checked, Gmail still loads images by default and it doesn't cache them, it only proxies them.

So it's good that Gmail obscures your IP address, it's bad that Gmail still loads images from remote servers by default when you open a message, and it's bad that it will reload them every time you open it in a new client/environment instead of serving them from a Google cache.

Read receipts do work in Gmail, and Google should be shamed for that. I didn't call out Gmail in particular because I don't think Google cares about privacy enough to change anything. I'm hopeful smaller companies like Fastmail might.

<comment><USER8> > Read receipts do work in Gmail, and Google should be shamed for that.

Work how? There's a responsible way to handle read receipts (where the client notifies you the remote side would like a read receipt, and offers the choice to send it), and if it's done in that manner, I'm not sure why they should need to be shamed.

I'm not sure what Gmail does, but I see stuff when searching about how to configure it for G Suite accounts to always/never/selectively respond, and about how to disable Gmail's _nagging_ about it, so I'm not sure the current status.

<comment><USER4> > unless their policy has changed since the last time I checked, Gmail still > loads images by default and it doesn't cache them, it only proxies them.

That's a read receipt, in practice if not in name. I put a unique tracking pixel in the email, and when you open the email by default Google proxies it from my server. It's uncached, so unless the browser itself decides not to re- fetch it, I'll also know whenever you reopen the email.

Google also allows you to request a read receipt the responsible, official way that you're thinking of, but why would I ever use that feature when I can just give you a tracking pixel instead? The responsible read receipts require consent, and tracking pixels don't.

Again, I haven't checked Gmail's default settings in... probably years. So maybe this has changed, and it doesn't load images by default anymore. But any client that loads images by default has non-consensual read receipts, and they should be shamed for that.

<comment><USER8> > Google also allows you to request a read receipt the responsible, official > way that you're thinking of, but why would I ever use that feature when I > can just give you a tracking pixel instead? The responsible read receipts > require consent, and tracking pixels don't.

Read receipts (as opposed to email tracking through images, let's not overload terms here) have the benefit that they might be returned by clients that don't load images by default. That's probably a relatively small portion of clients, but it is only one setting change away on Gmail.

> Again, I haven't checked Gmail's default settings in... probably years. So > maybe this has changed, and it doesn't load images by default anymore. But > any client that loads images by default has non-consensual read receipts, > and they should be shamed for that.

A client that loads images by default does what 99% of people desire. That Gmail does so in a safer way than many others is a good thing, and maybe _shame_ is a strong word for transparently making people's default behavior slightly safer while doing what they want (showing emails as they were visually intended and looking nice).

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> Honestly: This was... pretty fast, the response is not just a statement of belief, but a clear list of changes they intend to implement quickly, and I really have no major complaints about how they've handled this.

If someone wants to use tracking pixels, they'll find software that does it, so I'm really okay with them keeping the feature in... with the removed location information. (I am going to block it anyways, let's be honest.) And most importantly, they recognized the power of defaults for setting how people tend to behave. Making the feature non-default will crater it's use percentage across their customer base.

<comment><USER7> > the response is not just a statement of belief, but a clear list of changes > they intend to implement

Sure. But it's also an indication of what their team thought "this is fine!" about, before an internet shitstorm rained down upon them.

In my mind they're always to be suspected of being either naive or actively evil in their use of personal data.

Anybody who launches "a powerful business tool", and then later tells us "We did not consider potential bad actors. I wholeheartedly apologize for not thinking through this more fully." is not someone I'd want running _my_ business tools. I'm now wondering if they considered "bad actors" finding their open MongoDB databases on Shodan? Or their public S3 buckets with their backups? Or their production API keys and secrets in their pubic GitHub code? Or all those other mistakes that everybody goes "but nobody except idiots would do that!" and yet we read about it multiple times per week anyway...

Maybe these guys have a great Email tool. I strongly doubt they have an entrenched culture of "considering bad actors" and appropriately investing effort and securing all the non customer facing infrastructure...

<comment><USER9> To be honest, I would suspect a large percentage of tech startups had failed to consider bad actors until the last year or two.

Don't get me wrong, it's not perfect, but I've seen far too many companies respond to controversy with how they care and will think about how to make things better, while not making any significant changes at all. This is a big step above that.

</comment></comment></comment><comment><USER10> _" Recipients of emails cannot opt out....I would love to find better technology to solve this problem."_

How about...put a notification of tracking in emails that contain it rather than making it invisible and then include an opt out link? That seems....not hard.

<comment><USER11> It doesn't seem to me like a problem worth solving. What's so bad about sending an email and trusting that the recipient will get around to it? Send a follow up email if you need to. Or use old-fashioned read receipts (which depend on the recipient to enable them).

Tech shouldn't really be creepy by default, nor should it really establish needy/clingy behaviour, which is what I think non-consensual read tracking tends towards.

I mean, personally, I would consider it a significant invasion of my privacy if anyone who sent me an email knew when I opened it and, roughly, where, without me knowing.

The problem with the internet and tech companies now is that there is an established pattern of you being able to consent on behalf of other people purely by virtue of giving access to your contact list, or using a certain mail client. You are giving away their data, not your own.

<comment><USER12> Meh. I'll risk the downvotes and say that I fully support tracking pixels in emails.

One of the reasons I use WhatsApp heavily is the read statuses. A single checkmark underneath the message means it was sent. Two checkmarks mean it was delivered. When the checkmarks turn blue, it means the recipient read the message.

I love, _love_ this feature. If I could wave a wand and instantaneously make it standard for ALL methods of communication, I would do it in a heartbeat.

<comment><USER13> Conversely, I would gladly push a button to make such tracking technically impossible. The idea that sending me an unsolicited message entitles you to any information about my activity is absurd.

<comment><USER12> > _The idea that sending me an unsolicited message entitles you to any > information about my activity is absurd._

What about for solicited messages? Just curious.

<comment><USER11> I think read receipts solved this problem already. If you want someone to know when you open their messages, enable it. Disable it and they don't find out. If you want to improve that setup, enable read receipts for a whitelist of contacts. People who you do want to notify when you open their message.

I think a mistake was made when some messaging apps turned it into an opt-out and also made it punitive, in that opting out would mean that other people's read receipts would be disabled.

I don't think it would be so bad if every single data point wasn't hoovered up and sold to third parties. They're probably using this read status feature to measure engagement and decide how to target more ads. They can infer a lot: who you respond to quickly, who you don't... who is intimate and who is an acquaintance. Who is important, who isn't.

</comment></comment></comment></comment></comment></comment><comment><USER14> Discussion yesterday of controversy: [https://news.ycombinator.com/item?id=20336762](https://news.ycombinator.com/item?id=20336762)

Highly visible blog posts are indeed the best way of effecting change, although the investors who were criticizing the original article now look very silly.

<comment><USER15> Yes, not even a few hours ago a VC at Founders Fund tweeted "...there's a strong correlation between the people outraged by privacy and the people that I think are dumbasses in the valley."

Source: [https://twitter.com/zebulgar/status/1146430814374117376?s=21](https://twitter.com/zebulgar/status/1146430814374117376?s=21)

<comment><USER16> Amazing to find a VC who not only isn't concerned but actively derides concerns around privacy. Maybe he has a terrible personal opinion (in my opinion), but this seems like a poor perspective from someone who should be worrying about existential threats to companies. Someone should tell the US Senate that "capitalism baby" is an appropriate response to privacy violations!

</comment></comment></comment><comment><USER17> I don't think Superhuman should have caved to this criticism as quickly as they did. Good that they kept the feature, albeit dumbed down. People pay for a power user email client because it's exactly that - a power user tool, which should be fully featured. If you remove read receipts then there are a whole host of other email clients that will gladly give you that feature (bye-bye revenue). Is someone going to write a Medium post calling out each of these companies too? There is also a bunch of companies that aren't primarily email clients - like CRMs (Pipedrive etc) that offer this feature out the box, as it's exceptionally useful for sales teams.

If there really was such mass hysteria regarding read receipts in emails (WhatsApp has it by default too?) then it should be your email provider that should be leaned on to secure their system. Google has known for a very long time about this, and has changed the loading of images to stop location tracking, presumably the only thing they actually think is controversial with read receipts.

<comment><USER18> Read receipts for email are the worst. Groupwise shops used to often have an awful culture about waiting on/complaining about when mail was opened.

</comment></comment><comment><USER15> Now the CEO is getting praised on Twitter but this doesn't address the main complaint which is the read status itself. Yes, location made it worse, but that data was mostly bunk anyway because Gmail (and probably others) will show the location of the Gmail server and not the user themselves.

<comment><USER19> It does address it. He specifically says that it is table stakes for his software and that they are leaving it in. You may not like that but it is addressed.

Personally I like that response, though I think they have legal problems in some jurisdictions. They didn't try to weasel word their way out.

</comment></comment><comment><USER20> It's remarkable that he was able to quantify the demand for his feature: "at the time of writing only 32 out of 26,000+ requests [was for turning off Read Receipts]".

There's a lot of Superhuman skepticism in the comments, but their CEO owned the decision and responded quickly. If you assume good intent, it's remarkable in its comprehensiveness, transparency, and speed.

If you don't, well, you probably wouldn't be satisfied by anything other than ripping the feature out. Which wouldn't make sense for the business given the demand from its primary customer segment.

<comment><USER21> > It's remarkable that he was able to quantify the demand for his feature: "at > the time of writing only 32 out of 26,000+ requests [was for turning off > Read Receipts]".

A company managing customer feature requests is suddenly remarkable? For a tool aimed at professionals? I would take that as par for the course.

<comment><USER20> It's remarkable to track 26k requests. That's non-trivial. Especially with the ability to drill down to a single feature request.

I know this is non-trivial because I run a business that helps product teams do this. I talk to PMs at companies you've heard of and probably use that struggle with this.

<comment><USER22> I don't know what tool they use to get user feedback, but it would be trivial for me to find out how many user requests we've gotten for a feature like read receipts: just do a search for "read receipts" in our contact email inbox. Might it miss some requests that didn't have the exact phrase? Yes, but it's in the CEO's interest to have a count that is very low, since he's trying to say that their users haven't asked about this much.

So it might be hard to get an exact count of how many people asked for some feature (particularly if it doesn't have an agreed-upon name, like "read receipts", but if you're just looking for one phrase and don't mind erring on the low side, this should be a pretty easy exercise.

<comment><USER20> Or on the high side: "read receipts are awesome!"

I think my broader point stands: given their 26k requests (which you can't figure out using your method) it's impressive to know that N of them are for Y feature.

</comment></comment></comment></comment></comment><comment><USER23> "I am so very sorry for this. When we built Superhuman, we focused only on the needs of our customers. We did not consider potential bad actors. I wholeheartedly apologize for not thinking through this more fully."

Rare to hear such honesty from a CEO. I don't think I've ever seen a corporate leader admit they didn't consider product security. Concerning? Maybe - but I think it's miles better than the usual "we value your privacy and use industry standard blah blah blah.." canned spiel everyone gets in their inbox after a breach goes public.

<comment><USER21> > "I am so very sorry for this. When we built Superhuman, we focused only on > the needs of our customers. We did not consider potential bad actors. I > wholeheartedly apologize for not thinking through this more fully."

> Rare to hear such honesty from a CEO. I don't think I've ever seen a > corporate leader admit they didn't consider product security. Concerning? > Maybe - but I think it's miles better than the usual "we value your privacy > and use industry standard blah blah blah.." canned spiel everyone gets in > their inbox after a breach goes public.

A company that has access to your email did not consider bad actors, and that is a "maybe" of a concern for you?

<comment><USER23> Perhaps I should have included the full context:

"1\. Location data could theoretically be used nefariously

This criticism is the most severe. Upon reading the commentary, I have come to understand that there are indeed nightmare scenarios involving location tracking. I should note that we deliberately do not show cities — we only show states or countries — but a determined attacker could still misuse this information.

 _I am so very sorry for this. When we built Superhuman, we focused only on the needs of our customers. We did not consider potential bad actors. I wholeheartedly apologize for not thinking through this more fully._ "

This isn't a case of them having invalid SSL certs or improperly validating data sent to an endpoint. This is them building a feature that could have been used in bad ways and not realizing it. To that end, I am not very concerned about product security in this instance, because I have no reason to not trust their honesty.

</comment></comment></comment><comment><USER24> Super on brand response: personal, quick, and well thought-out. Kudos to the team for their ability to handle a crisis.

On the topic of read receipts, I'm glad this is opening up a broader discussion about (pretty common) industry practices that track individual user activity across the web. IMO this will be a whole set of behaviors that will be viewed as having been on the wrong side of history:

We'll look back in 50 years and wonder why we would have ever legally let so much invasive tracking technology into our lives (we didn't know! but everyone was doing it!).

</comment><comment><USER25> It's tracking without consent, plain and simple. Forcing users to choose between HTML email and being tracked is nefarious. Users by default do not assume they're being tracked. Just like unsub, highly visible opt out of tracking should be the law. Morally there's no question.

</comment><comment><USER26> The technical solution to tracking pixels isn't to disable remote image loading, it's to load all remote images when receiving the mail over smtp, and embed them in the mail. That way the sender gains no information whatsoever that they didn't already get from the smtp exchange.

</comment><comment><USER27> Can't believe the amount of jabronis here saying "what is the big fuss, everyone tracks everything anyways".

Companies (and individuals) should act ethical and in good faith, regardless of what others do. So, if you have a chance to improve something, you should do it. Make a superior product that also doesn't track users without explicit content. Superhuman definitely acted the right way with this decision.

</comment><comment><USER28> Some food for thought: Imagine how crazy it would be if we would have these tracking devices on _real life physical mails_ , you'd get a letter in the mailbox and you open it and read it. Without you knowing the sender has put a tiny device in there to track whether you opened it or not.

When framed like this, I can't help but feel we are all kind of crazy on the web!

<comment><USER29> You used to send sealed letters with the reasonable expectation that it would arrive intact and unread. Now everyone[1] sends the equivalent of a postcard - the vast majority of which are actually read/scanned by the entities doing the delivery.

[1] apart from the weirdos who use encryption

</comment></comment><comment><USER30> Shot in the dark, but could tracking pixels fall afoul of wiretapping laws? It's a single bit of information, but it is a 1-bit recording gathered without the other party's consent.

<comment><USER19> Tracking pixels have been a normal part of the email ecosystem for more than 20 years. If an esoteric use of the law was going to stop it it would be done by now.

<comment><USER31> This is basically what GDPR is designed to stop.

<comment><USER19> That's not reusing old law, that's a law designed purposely to stop this.

</comment></comment></comment></comment><comment><USER32> When these things happen, to me the more important thing is what will leadership do to change the thinking that led to the problem. Issuing a patch is a solid step, but it's a symptom that points to a need for change in how features are vetted and thought through.

</comment><comment><USER33> Please have your email solution tell me that you are tracking opens, so that I will never correspond with that sender again.

I think tracking opens without notifying the recipient is a blatant privacy violation. If that's where society is heading, I want to part of that.

</comment><comment><USER34> This pisses me off more than it should. I used to be interested in Superhuman, but after they backed down I no longer care about getting an invite.

It's nobody's business what email client I use. I would like to see a bold email client that offers all these extensive tracking features and makes no apologies. Call it Supervillain for all I care, there is a market for it. If you don't want to be tracked, don't accept images from me or anyone else. Simple as that.

</comment><comment> drevil-v2 The quality and depth of introspection from the leadership of an organization, when they get caught with their hand in the cookie jar, is a truly epic spectacle to behold.

The more cynical among us might even think they knew exactly what they were doing but did it anyway for their own profit and to the determent of others and the only thing they are actually sorry for is that they got caught.

</comment><comment><USER35> how is this working ? Gmail caches pixels - [https://help.litmus.com/article/166-how-are-gmail-opens- repo...](https://help.litmus.com/article/166-how-are-gmail-opens-reported- within-email-analytics)

> _When Gmail automatically downloads and caches images, those cached > images—including open tracker pixels, like the ones used with Email > Analytics—are stored on Gmail's servers. Gmail then loads the same images > from the same servers for everyone—regardless of whether they open using > Gmail in a web browser or a Gmail Android or iPhone /iPad app._

<comment><USER36> Presumably every email gets sent a unique pixel name.

<comment><USER35> Even so. It will get cached, so the analytics should fire only the first time it's opened. Not subsequent times.

</comment></comment></comment><comment><USER37> Why do 'power users' care if people read their emails?

</comment><comment><USER38> how about a browser or email extension that repeatedly and randomly loads the pixel. for bonus points, through a wide set of proxies.

</comment><comment><USER31> Sadly they followed the path of nearly every surveillance capitalism startup out there.

1\. Breach user trust by acting without user consent. 2\. Market it as a service. 3\. Eventually get caught. 4\. Offer an apology.

Rinse, Repeat.

I don't have any real complaints about the steps they took to correct this. I have complaints about the fact that they did it in the first place and didn't consider the users. I also take offense at their investors who continued to invest while knowing this was going on.

</comment><comment><USER39> Surely this a massive breach of GDPR ?

<comment><USER19> 'Massive'? I'd be surprised if they have anywhere near the incidents of tracking pixels that a bog standard small ad network has.

No one will be able to tell accurately until a ruling comes down but I believe this is a gdpr violation but one they won't be fined for if they do basic location filtering for their tracking pixels.

<comment><USER40> A "bog standard small ad network" does not typically have the email address of the ad viewer.

</comment></comment></comment><comment><USER41> Every statement ever made by a tech company that went over the line and decided to step back from it should automatically, in your mind, be appended by "for now."

Superhuman is getting rid of this _for now_.

Also works for mobile carriers and pretty much any statement they make ever.

</comment><comment><USER42> I didn't expect this, but it's actually everything I would have reasonably wanted from them. Dang!

</comment><comment><USER43> I really don't get what the fuss is about here. You are being tracked online. Why get upset about this specific instance?

<comment><USER5> I have no idea either. I track every email I send out. The issue with tracking, when done by companies, is what they use that data for. People don't want to have sales profiles built on them or have their literal privacy - <USER2> terms of their personal web traffic - being invisibly tracked and potentially exploited by bad actors.

On a personal level, I send emails for a variety of reasons, and I haven't found a good reason why I wouldn't want to know when they were accessed.

1\. I've sent legal correspondence and it's important for me to have a record of when and how frequently it was accessed in case it ever reached court.

2\. When I send emails to my staff, I'm less interested in whether or not they reply and more interested in whether or not they read the emails at all. If not, then I can use alternative and more immediate forms of communication.

3\. Sometimes I'm ignored by people that owe me money for one reason or another (in one particular case, I was almost scammed out of $40,000). Knowing that the correspondence I was sending was being accessed but was being ignored allowed me to take more immediate action.

I'm not building profiles on people, I'm not trying to sell anything. And I'm not going to apologise for it either. My intentions are not malicious, so that's where it starts and stops for me.

<comment><USER13> _My intentions are not malicious_

In scenarios 1 and 3, your intention is to spy on people to gain an advantage over them in legal proceedings. That's going to qualify as "malicious" from their perspective.

<comment><USER5> You think having a transactional log to stop people from lying in court is a _bad_ thing and has me doing harm? What unfair, malicious gain do I receive by being able to present evidence that says that someone did in fact read correspondence?

Respectfully, you're in a very small camp there. You might as well call security footage or fingerprint evidence malicious as well. The same goes for snail mail that has delivery confirmation.

If anything, this thread has just reinforced my belief that I'm doing the right thing.

<comment><USER13> _You might as well call security footage or fingerprint evidence malicious as well._

Security footage of your property is fine. Embedding a hidden camera into a package that you mail to someone is not.

 _If anything, this thread has just reinforced my belief that I'm doing the right thing._

And it's reminded me to verify that image loading is disabled on all my clients. Win win, I suppose.</comment></comment></comment></comment></comment>


Getty, Flickr reach deal:  amateur photogs to get paid - <AUTHOR> http://seattlepi.nwsource.com/business/369988_getty09.html <comment><USER2> Is it specifically opt-in, or can Getty simply pay some amount to retrieve any photo on Flickr?

I find the latter concept disturbing.

<comment><USER3> it would have to be opt-in. Flickr does not own the photos, they are merely a service that the owner uses to distribute their photos.

Now getty could distribute some cc-licensed works without payment, although I think they would shy away from that for a number of reasons.</comment></comment>


Ask HN: Do you spend too much time on Content Dissemination for your startup? - <AUTHOR>

With the rise of Content Marketing as a cheap marketing channel, more and more people tend to promote their startups with their blogs. That's fine, but I have the feeling that more and more people spend really a lot of time on this business.
What's your opinion on the topic ? What's the ratio between content publication over content dissemination ? <comment><USER2> We're a relatively new startup (jut.io). At this point our focus is much more on creating good content, getting our voice right etc. Our main distribution vehicles are those we control - twitter, fb, linkedin, etc.

We have begun to do things like guest posts and think about hacker news as a potential distribution vehicle. I suspect as we get closer to operating "at scale" we will have the exact challenge you describe - distribution becomes more important to move the needle for content marketing.

</comment><comment><USER3> I can't speak for myself (yet) but some successful bloggers such as Ramit Sethi or Derek Halpern recommend spending even 50% or more time promoting the content you write. But that's of course only one part of the whole equation. One should make sure first that someone will actually want to read that content - i.e. do _a lot_ of upfront research.

<comment><AUTHOR> Thanks @jkbyc , yes, I know this rule of thumb, and know that many people even recommend a stronger ratio (like the more you distribute, the better).

I recently found the following : [http://everyday.marketing/the-real- challenge-of-content-mark...](http://everyday.marketing/the-real-challenge-of- content-marketing-is-when-you-dont-have-a-strategy/) where the moto is 'think about distribution before thinking about creation'.

In your own case @jkbyc, do you blog for your startup ?</comment></comment>


Show HN: Pandas in the Cloud: 100GB+ pandas dataframes with 4MB local memory - <AUTHOR> https://cloudpy.io/ <comment><USER2> Looks interesting. Have you heard about the picloud (not in business now)? The concept looks similar, and promising. (they were acquired and shut down, i hope you will stay in business)</comment>


Ask HN: Open-source feedback software? - <AUTHOR>

I've recently been trying to find an open-source solution similar to proofhq.com, getbackboard.com, etc... I'd like to host it myself.
Basically something that allows for teams to give visual feedback on an uploaded file.
Does anyone know of anything similar?
Thanks <comment><USER2> It's not exactly what you're looking for, but there enough of an overlap for me to mention Review Board, written in Django, that is really for code review, but supports screenshots.

Anybody looking to make open source "visual feedback" software may want to check out the code.

<http://www.review-board.org> \- Hope somebody posts to this thread with a previously unknown open source tool. Because the tools you listed (proofhq.com, getblackboard.com) look great!

<comment><AUTHOR> Hey, sorry for the late reply. Thanks for mentioning Review Board. I'm a big Django fan anyway, so at the very least it'll be insightful to review it.

Thanks. And I guess we're out of luck on an open-source Backboard clone...</comment></comment>


Make ES6, Not Coffee - <AUTHOR> http://gofore.com/ohjelmistokehitys/make-es6-coffee/ <comment><USER2> Good points here. It complains a bit about the semicolons and as Standard ([http://standardjs.com/](http://standardjs.com/)) points out, you don't actually _need_ most of the semicolons.</comment>


Show HN: Decentralized financial management tool for non-hierarchical teams - <AUTHOR> https://medium.com/@misthosio/de-risking-multisig-wallets-cd03dedbfe1c <comment><AUTHOR> Today we launched www.misthos.io. Misthos is the most advanced multisig bitcoin wallet for businesses, emphasizing frictionless setup, low risk and streamlined collaboration.

Read more about our launch here: [https://www.coindesk.com/bitcoin-wallet- blockstack-decentral...](https://www.coindesk.com/bitcoin-wallet-blockstack- decentralized/)

<comment><USER2> Really clean UI. Looks fantastic. Can you talk about how you see Misthos being used in a little more detail? The post has some examples, but I'm curious if you have more.

<comment><AUTHOR> Sure, misthos is designed with collaboration in mind. Its for project teams, investment partnerships and other ad hoc ventures that want collective ownership and transparency of their cash flow.

Examples of ppl using it today (from our beta testers) are:

\- crypto focused youtube channel receiving donations and dividing it transparently to the individual content contributors of the channel.

\- A startup building out a payment processor that has their cut of the bitcoin cashflow stream into misthos for further dividing up amongst the team members.

\- A team offering consulting around onbording institutions and individuals onto crypto (that get payed in BTC for their services).

It is also really useful for informal groups such as Bitcoin Meetups as there is literally no setup cost, where setting up a shared bank account to manage expensive would include prohibitive overhead.

</comment></comment></comment><comment><USER3> I attended the demo and found the product and team delivering a very consistent first version which supports the scenarios I was looking for</comment>


Saying No to unjust computing even once is help - <AUTHOR> https://www.gnu.org/philosophy/saying-no-even-once.en.html <comment><USER2> I hate to say it but free software has eaten everywhere many programmers want to work. If you want to work in operating systems, frameworks, databases, editors, tools, compilers, etc, you'd better be willing to do it on your own time. If you're like top 10, you'll get picked to work for the big leagues and make money doing it. Meanwhile the paying gigs are the things that either are services or can't be open sourced.

I guess I'm just sad that all the tools conpanies are gone or shells of their former selves. Borland, Symantec, etc. New ones pop up but there's no money in support.

Companies are making huge money on their services that are 90% open source and 10% special sauce that they don't contribute back. We've seen how they'll spend $300,000+ per programmer but won't pay $10,000/year for a tool or framework. It's like the economics are messed up now.

<comment><USER3> Free software has definitely created some weird economics. Like I can't imagine paying money for a programming language on the other hand I don't blink about paying for Jira.

<comment><USER4> Maybe not for a programming language per se but Developers often do pay for IDEs and other niceties around developing software. Swift is another interesting example of a language that you have to pay for developing in (not directly but in order to participate in Apple's developer program).

<comment><USER5> Swift on Linux costs no money haha

</comment></comment></comment></comment><comment><USER6> Unfortunately it becomes near-impossible to say no to nonfree software such as zoom, skype, discord, slack, gmail, etc. You will often end up with no job and perhaps even no friends or no communication whatsoever by declining to use the world's most popular centralized communication platforms.

Until there is a way to dampen the extreme and long-lasting power of network effects for communication platforms, little will change with respect to this, as no one is truly willing to accept the consequences of declining to use the software that the rest of the world expects them to use.

<comment><USER7> This is incorrect. It becomes impossible to say "no" 100% of the time. It's very possible to say no occasionally. Indeed, if everyone said "no" when not overly awkward, it would make a world of difference.

If everyone was willing to pay even an extra buck for a microwave based on free software, market economics would push for 95% of microwaves to run free software.

And if everyone picked banks which ran on free software, being willing to give up just 0.1% interest, every bank would run 100% free software.

If everyone who could afford to pay for a free Google Docs clone did so, we'd have nice alternatives. I don't know the adoption, but it'd be enough to sustain a company.

And for video conferences, I'd never move a business meeting, but I do pick freedom-preserving technologies when I set up meetings, and many of my friends do as well. No one has ever commented on it.

<comment><USER8> This assumes there are equivalent free software options each time, at only slight disadvantages. That's pretty frequently not the case.

Even if you want to claim there exists a stable configuration with all those true, there's still a bootstrapping problem to get there, and we're certainly not past that point right now.

<comment><USER9> This is absolutely true.

That said, I have been thoroughly impressed with [https://meet.jit.si](https://meet.jit.si) every time I've used it.

It genuinely works well, and it may not be a Zoom killer, but for my one-on- one calls, it has absolutely been a viable alternative.

<comment><USER10> I used jitsi until I was overruled and now we use teams (sigh). It worked somewhat but would start to get iffy after 5 or 6 people would be in a call, especially when they're a few hours away. We'd have to start turning off cameras to get it to work. That of course doesn't seem like a software issue more than it is an instance issue, zoom and microsoft probably have hosts of more servers to handle stuff compared to the default jitsi stuff.

</comment></comment></comment></comment></comment><comment><USER11> One phenomenon I am fascinated by is the advent of software that is entirely built out of open source components and open standards, that is closed off to people using non-mainstream open operating systems and hardware sort of by accident at packaging time.

I'm thinking of apps that built around Electron and Chromium. This stack allows people to ship beautiful webapps (= web protocols and languages, weblike experience) in a format like native applications, with the addition of desktop integration, but ... now we have HTML5 developers shipping binary blobs for the operating systems and CPU architectures they choose. It's cool that that includes common Linux distros as well as the leading commercial OSes, but what if I want to run RISCV instead of Intel/AMD, or FreeBSD, or <insert any other system entirely capable of running the usual stuff from the Unix ecosystem that some people call the "Linux desktop"> instead of Linux, and why is an HTML5 developer/publisher making that choice? Add to this the fact that Chromium itself is an open source project that is widely ported to systems other than Android/Linux/macOS/Windows, but the upstream apparently doesn't accept portability patches. Suddenly that matters if the unit of delivery includes an internal browser executable.

I understand the practical reasons for all of the above, but it irks me on some level; the whole point of all of the huge tower of open standards involved was to avoid this situation. In practice most of these apps are probably also available as straight up webapps in a browser, so it's not really a big deal in the end, but it seems like a really strange position to have finished up in.

<comment><USER12> It always bothered me, that applications have to ship and load their own copy of chromium and node. I don't get the compatibility argument. After all, websites have the exact same problem to solve and do that just fine, most of the time.

For desktop applications you could even require a given minumum version of electron installed on your target system. If its not there, your installer offers to download and install/update it. Also, instead of including a copy of chromium and node, electron could just use installed version of those.

</comment></comment><comment><USER13> I emailed RMS on 2019-02-19, with a subject line, "What's bad about: Zoom.us". Somehow Zoom was missing from his pages as an example of unacceptable software/service (I see it's finally there, but very barebones compared to the rest of the examples -- [http://stallman.org/zoom.html](http://stallman.org/zoom.html)).

Let me quote his select quote from my email, and the start of his reply:

\---

      > I really enjoy your What's-bad-about series.  Any chance you can do one for Zoom.us?

      I never heard of that.  What does it do?  I would guess that since I
      never head about it then it isn't important enough to mention.

\---

Yes, 2019. With Zoom having a billboard at SJC and plenty of other airports, not to mention every other phone interview for a software engineering role being done over Zoom.

<comment><USER14> >Yes, 2019. With Zoom having a billboard at SJC and plenty of other airports, not to mention every other phone interview for a software engineering role being done over Zoom.

Would you rather he bluffed and said "Oh yeah, Zoom.." and rattled off some reasons, rather than expressing a curiosity and willingness to listen to someone about it?

No one listens to RMS because they think he's the most hip person around -- they listen to him because occasionally he spouts out some wisdom that, on average, is worth listening to.

<comment><USER15> Almost certainly parent isn't talking about

> I never heard of that. What does it do?

I'm pretty sure they're talking about the dismissal on the following line (which on the surface is the opposite of curiosity, although you can make the argument that paired with his question on the previous line it's more a statement about his confidence in his own familiarity with the field of software):

> I would guess that since I never head about it then it isn't important > enough to mention.

<comment><USER16> Let's agree that he has to draw the line at some point, otherwise the list of proprietary programs would be huge.

<comment><USER17> Stop intentionally ignoring the thrust of the argument.

Let's agree that Stallman does have to draw a line. Let's also acknowledge that Zoom is included on this side of the line.

</comment></comment></comment></comment></comment><comment><USER10> While this is true to some extent, there has to be a game plan. This is a lot like climate change. Sure, individual choices help, but there has to be systemic change as well, especially if your goal is to change the situation that exists in the world around you. I mean, hell do I push, I've been trying to get people to use jitsi over zoom for example even when the default instance is kinda poor compared to zoom for the reasons rms listed. But from the other side, we need regulation of the worst abuses that zoom has done. There need to be some sort of consequences for zoom lying constantly about their product and how it isn't actual encrypted for example. When they can operate on an uneven playing field and get away with abuses just because will mean we'll never win.

</comment><comment><USER16> We should recognize that many times network effects are not the problem, but the low quality of the free software offerings.

Many free software advocates are OK with ugly and bad interfaces, bad documentation, etc. and they don't understand why anyone would prefer the proprietary alternative.

As a community, if we want to make normal people use (and donate to) free software, we should increase our quality standards. It's important that the whole user experience (downloading, installing and using software) is smooth.

For example: I can give many good reasons to use Jitsi instead of Zoom, but if Jitsi's usability or video quality is not on par with Zoom's, all my reasons crumble at the eyes of normal people, and we shouldn't blame them. (Just an example, not saying Jitsi is bad.)

<comment><USER18> I think we also need to realize the difference between a "pretty" interface and a functional one.

I think it's possible to have something that's not ugly and yet not bloated to hell. It just depends on actually understanding UI design in a way that is universal to your audience. For instance, I doubt most people find pre-XP windows "Ugly", if anything a lot of us yearn for that era of interface.

</comment></comment><comment><USER19> I need to get rid of Google, they don't even let me login to my own account anymore because they don't recognize my devices... but before I do I need to get my data out, somehow.

</comment><comment><USER20> I understand why open source software is important for security and innovation. I don't understand why it some believe developers shouldn't charge a fee for software. Why is charging a fee unjust?

<comment><USER21> The FSF is fine with charging for software. That's why they say "free as in freedom not free as in beer"

<comment><USER15> Theoretically true, but practically unworkable.

If you give end users the right to redistribute your software for free there's not much you can do other than appeal to people's better selves and implore them to pay for your software instead of choosing the exact same copy for free (even though that's something both legally and ethically completely allowed by your choice of license).

At that point it's just a donation model with a suggested donation, which really isn't all that different from "free as in beer."

Under most circumstances "free as in freedom" is a superset of "free as in beer."

This is the reason why open source businesses focus on paid add-on products or services rather than monetize their nominal core product.

<comment><USER22> When you say paid add-on products.. you mean, that's the reason "open source" business focus on selling proprietary software? As in, "open core".

<comment><USER15> Effectively yes. Sometimes it's not quite "open core" in the sense that they don't offer two versions of the same piece of software, but rather separate programs that are meant to work in conjunction with that software (or a paid cloud version of the local program), but the end result is similar. There is some nuance in how this affects community uptake of the software if it is divorced at the software level.

</comment></comment></comment></comment></comment><comment> jerome-jh Personally I am increasingly concerned by deceptive SW, free or not.

Take the enrollment tunnel of a brand new Android phone, or Google Play as a whole. Deceptive wording everywhere, trying to make optional steps pass for mandatory. You could say it is just as bad as many ecommerce site (eg Amazon with Prime).

I know Google Play and key applications of the Android ecosystem are not open source, still it is based on a pretty large free codebase (on which my employer, hence me, make a living by BTW). But that makes one of the largest open-source contributor, Google, act quite devilishly. And other large contributors (I am thinking of Redhat) act devilishly too.

In short, there were days when being an open-source contributor meant being ethical. These days are definitively over.

</comment><comment><USER23> I've found refusing to use an app on privacy or security grounds often doesn't curry a lot of favor. Even if I can demonstrate concrete examples of harms. But I generally try to invite people to open platforms when I can.

So if I need to share something online with someone, I share using my Sandstorm server. Sometimes they ask what it is, sometimes they don't because it works for what we are doing and nobody found need to comment further.

<comment><USER24> I'd never heard of Sandstorm but it looks great. The similar alternative I've been using owncloud for things like this, but will give Sandstorm a shot!

</comment></comment><comment><USER25> Also linked from this is a set of Libre (Freedom as in liberty and also often Freedom as in usually beer recipes also) communications tools.

[https://www.fsf.org/blogs/community/better-than-zoom-try- the...](https://www.fsf.org/blogs/community/better-than-zoom-try-these-free- software-tools-for-staying-in-touch)

Voice: Mumble, Asterisk/SIP

Video calls and presentations: Jitsi, Jami, OBS (and presumably an RTMP server?)

etc

<comment><USER26> Hahaha, have you ever set up an Asterisk server? It's difficult to do right. Then you've got clients - there aren't many good SIP clients for Android, let alone free ones (CSipSimple is long abandoned)

<comment><USER27> I've never used Asterisk, and perhaps I misunderstand what you're trying to do with SIP, but wouldn't the built-in VOIP client work for AOSP-Android?

It may be hidden based on your carrier, but it's configurable if you remove your SIM, reboot, and set it up under Phone > Settings > Calls > Calling Accounts. Settings you enter will save if you reboot after as well.

</comment></comment></comment><comment><USER28> I don't think it's fair, but when I read Stallman it always feels he's part of a Machiavellian ploy to suppress wages.

</comment><comment><USER29> What sort of an economic model makes open source software feasible at large scale?

<comment><USER30> I would flip everything around: At scale, doesn't a private enterprise run out of money to support large codebases?

This isn't a facetious suggestion. Every employer I've had in the industry has been drowning under their heavy codebases. They have massive amounts of vendored dependencies, and long tails of single-author modules. The bigger employers have to create special teams just for pruning codebases and cleaning up after old projects.

And they're losing the battles. Code sprawls between multiple cloud vendors. Services exist in ecosystems so large that they have echo chambers, network effects, and politics. New languages are slowly introduced and even more slowly removed, with most code being written in mid-level glue modules. Code ontology and navigation is primitive and limited to indexed search.

What makes FLOSS different? Political discussions have to bring technical justifications to the table, mostly; this is Linus' famous "talk is cheap, so show me the code" slogan. The openness of collaboration ensures that CI systems, code repositories, and other shared services are available to folks, although this is still a cultural situation that isn't quite uniform yet. (There's too many folks who only publish tarballs and don't share the rest of their infrastructure, which is fine but not very collaborative.)

The resulting ecosystem _can_ directly and openly compare codebases, and deprecate code which is shown to be inferior or unsafe or otherwise undesirable. We have shown an ability to not just change code artifacts, but the protocols and languages which we use to communicate, at a very rapid rate.

<comment><USER31> > We have shown an ability to not just change code artifacts, but the > protocols and languages which we use to communicate, at a very rapid rate.

Results may vary for the C language, IPv4, X11, GTK, ALSA, and massive swathes of the CoreUtils.

<comment><USER30> Rust, Zig, IPv6 in Linux, Wayland, EGL, PulseAudio, PipeWire, and of course BusyBox. Compare and contrast with the fact that the banking industry is still searching for COBOL maintainers.

</comment></comment></comment></comment><comment><USER32> > If you tell one organization you won't use its "portal" or app, so you will > deal with it by phone, that helps.

If those are the choices, I think using a proprietary app might be better from a non-religious, consequentialist perspective than adding to the stress of an overworked and underpaid call center worker.

Also, for some people, using the app isn't just a slight convenience. I don't know this for sure and would be happy to be corrected, but I imagine that deaf people greatly prefer an app over using a TDD or a hearing interpreter to communicate with a phone-based customer service rep.

<comment><USER33> Call center reps prefer having work to do than being unemployed.

</comment></comment><comment><USER34> It's good to be reminded that every choice makes a difference and it's not all about being self-consistent. Kind of like how, even though I left home without a mask yesterday, it's still better to wear a mask today than not.

</comment><comment><USER35> My disagreement with the fsf is pretty fundamental. I don't see anything wrong, all things equal, with paying someone for software that is closed source provided there's some way to ensure it's not doing things wildly unexpected or malicious. Perhaps it's impossible to verify such a thing without source code, but the core ethical claim seems off to me.

<comment><USER36> It's not about maliciousness it's about owning the machine. If you bought a radio in the 1950s, you could take it to bits and fix or upgrade it. You can't do that's with today's software.

It's not comfortable for companies but it is a simply better way of doing software development both ethically and in terms of quality.

</comment></comment><comment><USER37> The donate button at the bottom of the page is telling.

<comment><USER36> Why?</comment></comment>