Ghidra, NSA's reverse-engineering tool - <AUTHOR> https://www.nsa.gov/ghidra <comment><USER2> Why this is important (for those uninitiated):

\- Ghidra is basically the first real competitor to IDA Pro, the extremely expensive and often pirated state-of-the-art software for reverse engineering. Nothing else has come close to IDA Pro.

\- Ghidra is open-source, IDA Pro is not.

\- Ghidra has a lot of really cool features that IDA Pro doesn't, such as decompiling binaries to pseudo-C code.

\- It's also collaborative, which is interesting because multiple people can reverse engineer the same binary at the same time -- something IDA only got VERY recently.

<comment><USER3> IDA Pro is not expensive at all for serious professionals in the field. Other common software in the industry costs way more. Nessus is $2k a year, Metasploit like $1500 to $15000, and Core Impact is $30k and up.

If this is expensive to you, then it's not _for_ you. This is for people who are making _real_ money with these tools, not hobbyists dicking around.

<comment><USER4> > If this is expensive to you, then it's not for you. This is for people who > are making real money with these tools, not hobbyists dicking around.

That's an odd perspective. Imagine if this type of sentiment were applied to paint brushes. There is a lot of useful work that is not economically viable per se, and to discount that and to be pejorative feels wrong.

<comment><USER3> If you are using these tools you are either defending systems from threats or breaking into systems and making money through illegal activities. There is not really any other useful work you can do with these tools.

I don't see how the perspective is odd. Having tools like Core Impact and the knowledge of how to use them well can propel you to a six figure income easily. On top of that these tools are also business expenses you can use for tax write offs.

They are certainly worth the investment. The only people who see the price as steep are those who cannot see any viable way to make a decent ROI off them.

<comment><USER5> Google "video game modding ida".

Then think about the fact that some people are poor and can't float thousands of dollars long enough to learn and get employed with tools like this.

<comment><USER3> I don't think about those people, here's why:

1) No one is entitled to a career in cybersecurity or reverse engineering, no matter how poor or sad your origin story is.

2) There are always lucrative opportunities in this world that are out of reach by people who lack some resource. In this case, it's money, but it could easily just have been something like popularity, beauty, connections, location, or even plain old brains.

I always wanted to be popular and loved by many, but I came to accept long ago that it just wasn't going to happen. I'm an introvert, I keep to myself a lot, don't get much pleasure from social outings, and at the end of the day people just don't give a fuck about weird people like that. So I just try to enjoy the gifts I do have and the things that come naturally to me. We all have to accept the realities of our lives at some point, even the poor.

<comment><USER6> Sorry to hear you're finding it tough. Some people find ways of becoming less constrained by their introversion, but no judgment on you for doing what works for you.

It's true that some pre-existing conditions can limit what options people have, but it doesn't apply to everything.

It's important to be discerning about when this effect applies and when it needn't, and work to open more opportunities to more people wherever possible.

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> From someone who does binary reverse engineering full time, in my experience, BinaryNinja, Hopper, radare2, etc are toys compared to IDA Pro + Hex Rays Decompiler. The quality of the results and the features supported are unmatched... until now. I haven't spent too much time with ghidra yet but it's the real deal. The output of the decompiler looks alright (not complete garbage like I've seen with other tools). Even if everything else sucks, the decompiler by itself makes it outrank every other tool aside from IDA. And it costs $10k less! The fact that it'll be open source is just icing on the cake.

<comment><USER8> Out of curiosity what kind of job involves doing binary reverse engineering full time?

<comment><USER9> Red team?

<comment><USER10> If your Red team is reversing binaries you're doing it wrong.

<comment><USER11> Why? If your real world adversaries can reverse binaries, why would you shackle a Red team from doing so?

<comment><USER12> Because they have access to the source code itself. No need to reverse engineer anything.

<comment><USER13> Couldn't compilation introduce vulnerabilities that wouldn't be in the source, but could be found by decompilation?

<comment><USER14> Short answer is yes.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER15> You are the leader in your segment of the market one day and the undisputed leader. You wake up and the NSA decides to send a free competitor out with better or matching functionality. Tough blow. But good for us.

<comment><USER16> I'm surprised that noone is yelling "socialism" yet.

Tax paid competition for existing commercial products. Isn't that considered evil/wrong by pure capitalists?

<comment><USER17> "Eschew flamebait. Don't introduce flamewar topics unless you have something genuinely new to say. Avoid unrelated controversies and generic tangents."

[https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)

<comment><USER18> OP does have a point that this software was subsidized by tax payers. One could argue the NSA needs advanced tools and that the costs of IDA Pro add up.

<comment><USER19> This, unfortunately, occurs so infrequently that it can safely be ignored by 99.9% of the economy. Businesses have really enjoyed having their cake and eating it too with the transition away from a highly involved acquisition process that generally resulted in a tailored solution that the USG owned, to the present COTS policy that allows them to then go on to sell software to people that have already effectively paid for it through taxes. While there was an impressive amount of bureaucracy and an infinitely self referential system of standards in the old method, it did lead to some pretty interesting side effects: Ada[0], IDEF[1], MIL-STD-498[2], etc.

The most recent liberation of useful taxpayer funded software that I can think of was over ten years ago, when NIST released NFIS2 - the fingerprint software that the FBI relied on. They of course had to be crappy about it and wrap it in export controls that limited its utility, but it was interesting to see all the work that internal development had done - very polished, with man pages going back to '97\. Ah the memories: software classified as munitions, the clipper chip...

[0] [http://archive.adaic.com/pol- hist/policy/naig94-1.txt](http://archive.adaic.com/pol- hist/policy/naig94-1.txt)

[1] [https://en.wikipedia.org/wiki/IDEF#The_IDEF_modeling_languag...](https://en.wikipedia.org/wiki/IDEF#The_IDEF_modeling_languages)

[2] [https://en.wikipedia.org/wiki/MIL- STD-498](https://en.wikipedia.org/wiki/MIL-STD-498)

[3] [https://web.archive.org/web/20041206072946/http://fingerprin...](https://web.archive.org/web/20041206072946/http://fingerprint.nist.gov/NFIS/index.html)

</comment></comment></comment></comment></comment><comment><USER20> RCE included ;)

[https://github.com/NationalSecurityAgency/ghidra/issues/6](https://github.com/NationalSecurityAgency/ghidra/issues/6)

<comment><USER21> This not being the top comment kinda scares me.

Sure, it might be a great tool for free, but who knows what else might be hidden in there?

<comment><USER22> Likely nothing, it's the source code for an RE toolkit with an NSA sticker right on the box. There is _literally_ no worse place to try to hide back doors.

At worst they will know how to mask their real malware from analysis with their own tools.

</comment></comment></comment><comment><AUTHOR> Download: [https://ghidra-sre.org/](https://ghidra-sre.org/)

GitHub: [https://github.com/NationalSecurityAgency/ghidra](https://github.com/NationalSecurityAgency/ghidra)

<comment><USER23> Download from the NSA without open source software...

anyone else virtualizing three layers deep to get to this?

<comment><USER24> AFAICT all the source is there, beside every `.jar` there is a `.zip` with the corresponding source. The source in a more usable form should be posted here soon: [https://github.com/NationalSecurityAgency/ghidra/](https://github.com/NationalSecurityAgency/ghidra/)

(And if not I'm sure the community will reconstitute it)

<comment><USER25> One person's jar is another's zip.

<comment><USER24> Well sure, but the .zip files I'm referring to are "decompiled" for you with nice naming conventions and all that ;)

</comment></comment></comment></comment></comment><comment><USER26> I'm curious what feature specifically prompted the NSA to develop their own IDA Pro alternative. I mean, someone somewhere at the NSA must have been trying to do something with IDA Pro only to repeatedly fail before the decision was made that whatever the NSA was trying to do warranted developing their own IDA Pro... right? Or perhaps they used IDA Pro so often and grew so frustrated by it that they started their own?

<comment><USER27> A few reasons I can think of:

1\. Collaborative.

2\. supporting classified proprietary architectures (think missile chips or something)

3\. The intermediate representation (architecture independent representation of code) can be integrated in to many other classified tools. Maybe for automated analysis for example.

<comment><USER28> 4\. Managing licenses is a huge PITA, presumably especially in environments with lots of classified information.

<comment><USER29> Good point... "we need a site license. No, I can't tell you for how many employees, that's classified. No, I can't tell you who we are, that's classified. No, I can't tell you what we are working on, that's classified. Hello? Hello? Darn they hung up again..."

<comment><USER30> I think all three letter agencies create front companies for this kind of stuff?

<comment><USER31> [https://www.battelle.org/](https://www.battelle.org/)

</comment></comment></comment></comment></comment></comment><comment><USER32> Just used it to solve the 2015 flare-on challenge #1. Rudimentary, but I am blown away. The interface feels better than IDA, I was able to write a python script straight away! 10/10 recommended.

The python interpreter attached with it is aware of the state. Where is my cursor, what memory module I have selected etc. Easy to write scripts for

<comment><USER33> Any chance you could do a few videos tutorials on using it in conjunction with Python?

<comment><USER32> That's a great idea!! I can try.

<comment><USER34> Remind me! 7 days.

Shit... wrong site.

<comment><USER32> Haven't streamed before. Need some time to prepare

</comment></comment></comment></comment></comment><comment><USER35> Why do they have a LICENCE file with the Apache Licence in it? As a work of the federal government this is public domain by definition, isn't it?

edit: Oh, outside contributors of course retain their own copyright. That's what's licenced.

[https://github.com/NationalSecurityAgency/ghidra/blob/master...](https://github.com/NationalSecurityAgency/ghidra/blob/master/NOTICE)

<comment><USER36> They can also enforce copyright in other countries.

<comment><USER13> Can they? How's that work, surely a resident in USA could take the work to the other country and make it available, if they can't then it wasn't public domain in the first place?

Can you point me to any caselaw/ analysis please?

<comment><USER37> I don't quite get it either, but one of their documentation files seems to imply that they can:

>In countries where copyright protection is available (which does not include the U.S.), contributions made by U.S. Federal Government employees are released under the License. Merged contributions from private contributors are released under the License.

[https://github.com/NationalSecurityAgency/ghidra/blob/master...](https://github.com/NationalSecurityAgency/ghidra/blob/master/INTENT.md)

</comment></comment></comment></comment><comment><USER38> I'm definitely excited for this, considering I couldn't fork out the thousand of dollars needed for using IDA. I can't really justify that on a small hobby project (reverse engineering games).

<comment><USER39> If it's a hobby project why don't you just pirate it? Honest question.

<comment><USER40> My personal reason for not pirating IDA Pro is because I don't want to contribute to the problem. It's one thing to argue about the effects of piracy on things like video games, where the unit price is much cheaper, and a large number of users are casual users who mostly are going to buy legitimate copies if it's convenient and not exorbitantly expensive.

Power user software, like Photoshop, IDA Pro, VMWare, etc. are a different story. They provide tremendous value to both companies and individuals and yet I have no doubt an enormous amount of their poweruser userbase simply have never paid for them. As a young adult or child with no practical way to get a license, this is pretty innocuous since frankly it's hard to argue any sale was lost. But there's plenty of cases where large companies and of course hobbyist users end up pirating the tools they use. I believe Windows XP shipped with some audio files that were produced with a pirated version of Sony Soundforge, for example. That's just silly, but.. it happened.

IDA Pro is an excellent piece of software. They provide a freeware version, which is a pretty nice thing to do. And while the licenses are expensive I have no doubt it is worth it to the companies that purchase it, many times over.

Sadly, I can't afford IDA (as I've discussed eerily recently in HN comments, actually) so I've been mostly avoiding it for now, but I do buy other software, including Windows licenses, Adobe Creative Suite, VMWare, etc. If they're useful enough for me to use, then as an adult with decent income, I pay for them.

<comment><USER41> > yet I have no doubt an enormous amount of their poweruser userbase simply > have never paid for them.

Do keep in mind that many of these companies _expect_ users to pirate their software. Indeed, piracy is ironically part of what has made Adobe such a big player - teenagers pirating software in highschool, and using it up until their first job, make it their go-to tool when they actually do enter a company. Often leaving the company with no choice _but_ Photoshop!

<comment><USER42> Hex-Rays is not one of those companies, I don't think.

</comment></comment></comment></comment></comment><comment><USER43> Here is the presentation slides from the Ghidra presentation at the RSA conference:

[https://published- prd.lanyonevents.com/published/rsaus19/ses...](https://published- prd.lanyonevents.com/published/rsaus19/sessionsFiles/13678/PNG-T09-Come-Get- Your-Free-NSA-Reverse-Engineering-Tool%21.pdf)

</comment><comment><USER44> This is an unusually large open source project, especially for NSA. I wonder whether they were motivated to release this tool because of their recent brain drain / hiring problems.

<comment><USER45> Here's a potential angle: If you're going to use a tool internally it's in your best interest to be able hire people w/ experience with that tool. (ie, people learn the tool for free on their own time)

</comment></comment><comment><USER46> Oh yeah, for those who are wondering; there's another NSA project where they made a tool that's a direct competitor with a product that's "out there": [https://github.com/redhawksdr](https://github.com/redhawksdr)

The competitor in question is GNU Radio.

</comment><comment><USER47> I just don't understand the doubt and hate. It's perfectly reasonable to distrust the NSA in most cases, but look at the context - the NSA has a huge brain drain and PR problem. They desperately need qualified people to start trusting and applying to them again. Does anyone seriously think they would try to backdoor security researchers in such a stupidly obvious way?

I was actually at the RSA talk where they released the tool - the presenter was very open in saying that this is a recruiting tool. They want college kids just getting into RE to learn their tools and have their name in the back of their mind so they apply for internships and jobs, and are trained for those roles from day zero. There are other benefits to releasing the tool, like free labor and testing from people submitting patches and bug reports, but the real value is in making the NSA appear like the good guys and getting people on their side.

It seems pretty obvious to me that this gives the NSA more benefit than trying (and probably failing) to hack random people. And yet the dude sitting next to me was shaking his head and saying he would only ever run it in a VM. Irrational as hell.

<comment><USER48> Well, they shouln't have involve in "hacking random people". Then we would trust them. They didn't and they still have surveillance and hacking programs. Why would I expose myself and become a target for the next years? Are they trying to know where are the new targets?

<comment><USER47> Your comment makes no sense whatsoever. Let's say you're an NSA target. You're probably already hacked. If not, then you are very smart or you haven't been an NSA target for long. Let's assume you're a very smart malware researcher - that means you 1. Already have tools like IDA and don't need this, 2. Have an in depth knowledge of how to acquire and run potentially malicious code safely, 3. Have experience figuring out if that code is malicious.

Do you think the winning strategy for the NSA here is to attack you in a way that you're perfectly equipped to deal with?

</comment></comment></comment><comment><USER49> So, I've tried it on some mips binaries I've been reverse engineering on and off last 7 years from assembly, for various reasons. I'm completely blown away by the quality of the decompiler output. The binaries include symbols, so everything global is named correctly, which helps. Anyway, nothing I've tried over the years comes even close to the clean output I'm seeing from Ghidra.

It's great.

</comment><comment><USER50> I'm really hoping this release will improve the situation with learning RE in universities etc. The free version of IDA is very limiting, and few people use the open source and cheaper alternatives (radare2/cutter, binary ninja, hopper). I'm also hoping I can get that decompiler (or something similar) in cutter at some point, but with the source not yet available we'll have to wait.

</comment><comment><USER51> The intro video is pretty good, if you want to see a screen recording: [https://ghidra- sre.org/GhidraGettingStartedVideo/GhidraGetti...](https://ghidra- sre.org/GhidraGettingStartedVideo/GhidraGettingStartedVideo_player.html?embedIFrameId=embeddedSmartPlayerInstance&theme=dusk)

</comment><comment><USER52> Are they serious? They are banning Russian IPs with decompiler source code. Hmm, I know ARM and x86 assembly. Of course, I don't know how to download these sources :)

<comment><USER53> Legal reasons.

<comment><USER52> As I see it's licensed under Apache 2.0. I don't know about any regional restrictions for this type of license. But it's could be a real reason because of our stupid government.

</comment></comment></comment><comment><USER54> I wonder how this compares to retdec, an open source cross-architecture decompiler by Avast.

[https://github.com/avast-tl/retdec](https://github.com/avast-tl/retdec)

<comment><USER51> I'm wondering this too. I haven't heard of retdec being used too much, but it looks very cool. I'll guess that Hex-Rays is better, but I still am interested in the opinion of someone more experienced who has tried retdec.

<comment><USER55> I'll go one better: I've contributed patches to retdec.

Retdec is ... okay.

On small binaries it's usable. On even average sized windows binaries (a few meg), not really.

Like on things that IDA takes 10-15 minutes and a reasonable amount of memory (like a 7 meg windows binary), retdec can take forever and unlimited amounts of memory.

I started fixing a lot of the memory issues (completely recursive CFG traversal, etc), but there are also very serious algorithmic issues (N^3/N^4 algorithms in the optimizers).

If i disable a lot of the backend optimizers, i can make it work okay.

But then the output is also a lot larger/worse. To be fair: It used to be about 50x bigger than similar IDA output. The latest development version of retdec now has a new backend IR converter, and the output is only 5x-10x bigger than IDA output.

So as a TL;DR: retdec in its default state is unusable for anything but small binaries. If you understand what is going on, you can get it to work on a lot of binaries as long as you have a _ton_ of memory and time to spare.

</comment></comment></comment><comment><USER56> It's not the first real competitor available to the public. Hopper Disassembler and Binary Ninja are both capable. They have been available for a few years.

Binary Ninja is also collaborative if you get the enterprise edition: [https://binary.ninja/purchase/](https://binary.ninja/purchase/)

<comment><USER57> They're arguably competitors if you don't care about decompilation. But Binary Ninja has no decompiler and Hopper's was awful last I checked. Ghidra's decompiler seems as competent as Hex-Rays.

<comment><USER56> Binary Ninja has most of a decompiler and is expected to get the rest soon.

Binary Ninja offers multiple views of the code, each with an API that gives you the same access that the GUI has. The different views vary in how much they are like assembly or C. Only that last step, real C code, is still missing. Those other views are quite good if your goal is to understand things, but less good if you were hoping to throw the results into a C compiler.

<comment><USER58> Binja could get a decent "C-like" view on top of MLIL, sure, but it still fails in a large number of relatively rare cases.

Anybody use SEH or MSVCRT exceptions on x86? Well, there are non-inlined functions that adjust the stack pointer dynamically there. Binary Ninja can't capture that. To be fair, it's unlikely IDA can either- but IDA has a heuristic (read- hack) that treats those functions specially. Result? SP- analysis for all callers generally fails, and Binja becomes convinced that arguments are being passed in eax and ebp.

Ah, but you can just patch the LLIL for calls to those functions to adjust the stack. Oh, no, you actually can't patch LLIL that way- it's immutable after the lifter creates it. Now, you can write your own architecture hook, and there you can be your own lifter- you can call the real lifter, see if it emits a LLIL_CALL to a function you recognize, and if so just emit the stack adjustment LLIL instead. Ah, heh, but you can't- you can't call the real lifter, because it doesn't _emit_ LLIL, it adds LLIL to an existing function, and you can't remove that IL later- it's append-only. And you can't recognize functions easily, because the things passed into your GetInstructionLowLevelIL callback don't include a BinaryView pointer- the thing you'd need to find out anything at all about other functions. You can sort of, kind of, hack around this by calling about five other functions... for every CALL instruction in every function in the binary. This is, ah, less than performant.

Ever reversed a Win32 binary that uses the Win32 API a lot? I hope you like defining structs by hand, because OH BOY are you going to be defining a lot of structs to do anything useful. And you also get to define DWORD, LPDWORD, LPVOID, and every other annoying Windows typedef by hand. (You can be clever and use libclang hackery on the Windows SDK and automate some of this. But you'll have to do it yourself.)

Then there's stuff like type propagation only going forwards inside functions- sometimes. The GUI occasionally deciding that all basic blocks should be laid out in one small square, on top of each other. (You have to reanalyze the function to fix this.)

Mind you, I love Binary Ninja- I bought my own dang commercial license, and renewed it! It's getting better, fast... but it's got its warts.

<comment><USER58> Oh, and I forgot to mention- despite being multi-threaded, it's slooow on massive (50MB+) binaries. Bother your co-workers! Play Pokemon GO outside! Make lunch! Take a nap! Use the foosball table in the 'game room' that's there because we want to seem trendy! When you're done, perhaps the initial analysis will have finished.

If you're on the dev branch of binja (which, at least until recently, was miles ahead of stable), you get to do this again in a few days when binja updates and throws out all its old cached information.

Also, saving and loading massive databases can easily be a 5-minutes-or-more process. Again- this does provide you with ample time to explore the area around your office building, but still.

(Mind, this isn't a problem if you mostly see small binaries- for malware it's probably entirely fine.)

<comment><USER59> Can you please edit your post to make the word "slooo[…]oow" shorter? It's currently breaking the page layout. :(

<comment><USER58> Oops.

</comment></comment></comment></comment></comment></comment></comment><comment><USER60> Probably not run that on networks you care about: [https://twitter.com/hackerfantastic/status/11030878690637045...](https://twitter.com/hackerfantastic/status/1103087869063704576)

<comment><USER61> … in debug mode. Normally it doesn't load the debugging tools.

</comment></comment><comment><USER62> Aaaaaand: [https://twitter.com/hackerfantastic/status/11030878690637045...](https://twitter.com/hackerfantastic/status/1103087869063704576)

<comment><USER63> Though the obvious explanation for that is that it was an intentional backdoor, that honestly looks more to me like a legitimate oversight than a backdoor. I think an actual backdoor would be a lot more subtle and clever than that. Especially since this way, absolutely anyone could exploit it (it's just Java Debug Wire Protocol).

Also, you have to explicitly run it in debug mode for this to happen, which probably only a small percentage of end users will do. Kind of seems like the equivalent of running Flask apps in debug mode, which by default will handle exceptions by showing a traceback with an interactive debugger that can be used to execute arbitrary code.

There could be some backdoors in it, but I'm leaning towards that not being an intentional one. (But I definitely could be totally wrong; you never know when it comes to intelligence agencies.)

<comment><USER64> I also don't think it's a backdoor, but the best way to hide a backdoor is to make it look like a mistake.

<comment><USER63> >but the best way to hide a backdoor is to make it look like a mistake

It is, but usually the best way to do is to make it look like a mistake that's very subtle and difficult to notice without careful testing and analysis, kind of like Apple's infamous SSL "goto fail". That's a classic example of a vulnerability that really could be either an honest mistake or a very insidious backdoor.

This is more like leaving the house's sliding glass door to the backyard wide open for everyone to see.

</comment></comment></comment></comment><comment><USER65> Is it odd that this is written in Java? What advantages does this have?

<comment><USER66> Fairly portable and future-proof, and very easy to compile (just collect dependencies; you need to really go out of your way to compile and "link" Java applications wrong)

</comment></comment><comment><USER67> I am going to sound pessimistic here, but isn't there a real danger of having this technology available to bad actors and is there any value to keeping such things confidential if it plays a role in national security?

If someone was releasing malicious software to hijack the power grid as an example, wouldn't they be first able to use this to try to improve the robustness and invisibility of their attack ?

Or is the functionality here common place enough that it doesn't tilt the axis of power in an unfavorable way?

<comment><USER68> Bad actors have been using IDA this entire time. So no, not really.

<comment><USER67> You mean there is nothing new here? Then why is this news?

I am not wondering about the concept of reverse engineering but the specific (and hopefully novel) feature set that this may enable.

<comment><USER69> It's a competitor to IDA's monopoly, basically. It might be better in certain aspects.

<comment><USER42> IDA has a bunch of competitors --- Hopper, Binja, and all the Capstone interfaces.

<comment><USER69> Yup, well aware of them (I think Hopper uses Capstone, FWIW). I'm sure you agree that they're not quite at the level of IDA, though ;)

<comment><USER42> I'm not especially a fan of IDA, but I don't do much of this work anymore and haven't had a reason to catch up. IDA definitely wouldn't be the first tool I'd reach for in 2019.

<comment><USER69> I'm not really a fan either, but it's somewhat better and this makes people seem to like to pass around IDBs…

<comment><USER42> It's the de facto standard and the program you can assume everyone is already using, plus the fact that a lot of tooling relies on IDA (in part because, for a long time, it was the only game in town) for analysis and function recovery. I don't know if that really makes it "better".

I got out of this stuff before decompilation became a mainstream feature, so it might be a big deal that Ghidra has a strong decompiler.

<comment><USER69> Yeah, that's basically it. Most other tools either lack a decompiler or have a somewhat poorer one.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER70> Am I the only one or is anyone else thinking about what the angle here could be?

Pretty impressive software though. Finally one strong open-source alternative for reverse engineering.

</comment><comment><USER71> Can anyone speculate as to why the NSA decided to release this? Have they released any OSS in the past?

<comment><USER72> Yes they have. Their biggest effort to date is SELinux: [https://github.com/SELinuxProject](https://github.com/SELinuxProject)

If you run Linux, you likely have NSA OSS on your machine.

You can find their public GitHub profile at: [https://github.com/nationalsecurityagency](https://github.com/nationalsecurityagency)

</comment></comment><comment><USER73> There's a typo in launch.sh that breaks when you try launch in debug mode

> "{$DEBUG_PORT}"

</comment><comment><USER74> If you run in debug mode it listens on port 18001 allowing for RCE on host machine

</comment><comment><USER75> Discord created for this tool here: (Help with mods is needed!)

[https://discord.gg/RcSBc6](https://discord.gg/RcSBc6)

</comment><comment><USER76> Oh cool, this even supports old DOS MZ exes. And it easy to make portable.

Edit: no, spoke too soon. It acts like it supports MZ exes but consistently fails to import them.

</comment><comment><USER77> honest question: should I trust the binary they provided? What reason should I have trusting it? Because I don't.

<comment><USER78> Virtualize, containerize, or sandbox it.

</comment></comment><comment><USER79> The logo reminds me of 8 chan's logo.

<comment><USER80> indeed.

</comment></comment><comment><USER81> does Ghidra work for APK files, it would be cool if it also worked with mobile projects.

<comment><USER82> Yes it does work with APKs.

Well, it should. It kept having issues with the only APK I had on hand, but when I just pulled some DEX files out and loaded them it handled them just fine (including decompilation)

</comment></comment><comment><USER83> How did they use jenkins to do this exactly? I'm curious

</comment><comment><USER84> Started to watch the video, then remembered Snow Crash.

</comment><comment><USER85> I know what I'm doing this weekend :)

</comment><comment><USER86> Does it work for non windows binaries?

<comment><USER87> >includes a suite of software analysis tools for analyzing compiled code on a variety of platforms including Windows, Mac OS, and Linux

From the site, so yes it works on non-windows binaries. It also runs on Linux, Mac and Windows. This is the list of file formats I found in the docs that are supported by Ghidra

* Common Object File Format (COFF)

* Debug Symbols (DBG)

* Executable and Linking Format (ELF)

* Ghidra Data Type Archive Format

* GZF Input Format

* Intel Hex

* Mac OS X Mach-O

* Module Definition (DEF)

* Motorola Hex

* New Executable (NE)

* Old-style DOS Executable (MZ)

* Portable Executable (PE)

* Preferred Executable Format (PEF)

* Program Mapfile (MAP)

* Raw Binary

* XML Input Format

</comment></comment><comment><USER88> wish it would be helpful for reversing drivers etc.. for oss community

</comment><comment><USER89> This is awesome!

</comment><comment><USER90> radare2 is an other open source alternative

</comment><comment><USER91> This is Sanskrit name for Vulture

Ghid = Vulture

Ra = In Sanskrit RA is the acoustic root of fire. RA also connotes with light or spiritual light.

<comment><USER32> No. This is clear apophenia. Ghidra is a reference to the Japanese video game boss of the same name, which was supposed to be called Hydra, but due to mis- translation, came as Ghidra

In Sanskrit, a vulture is vocally spoken aloud like [Giddh], emphasis on the end.

> Ra is the acoustic root of fire

Any source for that?

<comment><USER92> Funny, I'd assumed it was a reference to the movie monster.

</comment></comment></comment><comment><USER93> Yeah, I think I'm gonna pass on this strictly binary release and wait until the code is released, reviewed, and independently compiled.

</comment><comment><USER94> >clicking the link before reading the domain

regret

</comment><comment> an-allen Nice try NSA.

</comment><comment><USER95> Annndddd, it's ugly as fuck. Well, I'm not going to install something made by the NSA on my machine but I'd be interested in feedback.

<comment><USER42> It's not as if IDA is a work of art. Arguably, this is a cleaner, more usable interface.

<comment><USER95> Totally, that's why I was hopping for something better looking. Looks like Binary Ninja is the only one that cares about that.

<comment><USER69> And Hopper!

</comment></comment></comment></comment><comment><USER96> [https://twitter.com/hackerfantastic/status/11030878690637045...](https://twitter.com/hackerfantastic/status/1103087869063704576?s=21)

</comment><comment><USER97> It appears that it isn't actually available as of now. Apparently, the NSA is going to release it at RSA Conference 2019, so it'll probably _actually_ be published within the next couple of days.

<comment><USER98> The RSA conference is currently ongoing and the NSA talk was today. Actually, it should be over just about now.

<comment><USER99> Is the NSA talk about this available online?

<comment><USER69> I don't know if there's a video, but here are the slides: [https://published- prd.lanyonevents.com/published/rsaus19/ses...](https://published- prd.lanyonevents.com/published/rsaus19/sessionsFiles/13678/PNG-T09-Come-Get- Your-Free-NSA-Reverse-Engineering-Tool%21.pdf)

</comment></comment></comment></comment><comment><USER100> Also found this community edition linked on twitter:

[https://ghidrace.github.io/](https://ghidrace.github.io/)

<comment><USER101> This link is third party junk, don't touch it. A "fork" existing before the original software release, yeah right</comment></comment>


My dual core can beat up your quad core, and other mobile CPU mysteries - <AUTHOR> http://icrontic.com/article/dual-core-faster-than-quad-core-mystery

<comment><USER2> It is interesting to compare the new TI arms with current Intel atoms Here is previous benchmarks on ubuntu The dual-core Cortex-A9 1.2GHz on the TI OMAP4460 with the PandaBoard ES is mostly comparable to the first-generation Intel Atom N270 in terms of raw performance. [http://www.phoronix.com/scan.php?page=article&item=ubunt...](http://www.phoronix.com/scan.php?page=article&item=ubuntu_1204_armfeb&num=1)

</comment><comment><USER3> There's the beginnings of support for the little core/big core paradigm in Linux: "Operating System Support for the Heterogeneous OMAP4430:A tale of two micros" [http://www.ssrg.nicta.com.au/publications/papers/LeSueur_Rod...](http://www.ssrg.nicta.com.au/publications/papers/LeSueur_Rodgers_12.slides.pdf)

Think they said if it's not in kernel mainline soon, they'll write a usenix paper instead

<comment><USER4> There is a good LWN summary of what will probably happen short and longer term here <http://lwn.net/SubscriberLink/481055/f5344869dc672690/>

</comment></comment><comment><USER5> reads like an ARM commercial. is that independent writing?

<comment><USER6> I confess I stopped reading when they said that "Even Apple Macintosh computers now use x86, after nearly 30 years of utilizing a competing and incompatible ISA known as PowerPC (PPC)."

I understand it's all ancient history now, and that I probably shouldn't expect a ton of fact checking from somebody named "Space Penguin", but it was circa 10 years on Motorola 68k processors and then 12 on PowerPC before the Intel switch in 2006. Maybe the rest of the article is solid, but if I'm reading an article on the details of processors, it worries me when they miss a detail about processors.

<comment><USER7> If you finish the article, it's not really about any of that at all, he's just writing a flourishing introduction. A detail like that isn't that important in the scope of the article.

<comment><USER8> But how can I know if I can trust the information in the article that I don't know (the reason I'm reading it), if the information I do know is wrong?

"Maybe the rest of the article is solid, but if I'm reading an article on the details of processors, it worries me when they miss a detail about processors" I think expresses it pretty well.

</comment></comment></comment></comment><comment><USER9> a computer is not a machine that does computing. it is a primarily a machine that moves information around, and occasionally performs computation on it.

as such, a quad core will saturday the processor - memory bandwidth much sooner than a dual core chip will, which stalls the pipeline. couple that with that four cores will abuse the cache much more than two will and you have a recipe for slowdown.

<comment><USER10> s/saturday/saturate/ ?

Perhaps we can use all this extra processing power for a better autocorrect implementation? ;)</comment></comment>


You can now trustlessly trade ERC20 tokens on Reddit (or Twitter, Slack, etc.) - <AUTHOR> https://np.reddit.com/r/ethtrader/comments/6trdgg/you_can_now_trustlessly_trade_erc20_tokens_on/ <comment><AUTHOR> linked to reddit post because the site itself isn't working due to heavy load.</comment>


Vi Hart: cramming G+ into YouTube has made comments even worse, I'm leaving - <AUTHOR> http://boingboing.net/2013/11/13/vi-hart-cramming-g-into-yout.html <comment><USER2> "The promise [...] was that making people use their real names would incentivize them to behave themselves. It's abundantly clear now that there are more than enough people who are willing to be jerks under their real names. In the meantime, people who have good reason not to post under their own names -- vulnerable people, whistleblowers, others -- are now fully on display to those sociopaths who are only too happy to press the attack with or without anonymity."

Told you so :(

Though I'm personally in a slightly different position, where my online handle is my public face that my hard earned reputation is linked to, but google wants me to use the birth-certificate name that nobody has heard of >:( (And it's not easy to just lie about my real name since I once bought something with google wallet, so they've seen my credit card and they want my profile name to be in sync with that...)

<comment><USER3> "It's abundantly clear now that there are more than enough people who are willing to be jerks under their real names."

The frightening thing is that most of these people probably are not consciously trying to be jerks -- they simply do not realize that their behavior counts as "being a jerk". Thus, it's trivial to see why having to use their real name does not matter much if at all.

<comment><USER4> No, the frightening thing is the people who are jerks, know it, and don't care. The Jerry Springerization [1] of the audience. Further there is a bit of nerd backlash in the heartland going on. While the readers here might aspire to being the next Zuckerberg, in central part of the US there is a statistically significant part of the population which has this 'over rich, under religious, morally suspect' view of "successful" people in tech.

[1] Jerry Springer, host of a TV show with people acting badly on it and essentially becoming 'famous' has made acting badly more acceptable to way too many people.

<comment><USER5> "While the readers here might aspire to being the next Zuckerberg, in central part of the US there is a statistically significant part of the population which has this 'over rich, under religious, morally suspect' view of "successful" people in tech."

Working in the fly-over (and quite cold this time of year) part of the states in a position that puts me in contact with quite literally thousands of them every quarter, I call BS on this one. I wouldn't say that most people see tech folks as that. I would say that most people in the farmy part of the country don't really have an opinion about the tech industry, and those that do see tech people as generally useless, or just disconnected from the lives of the rest of us.

They believe that there is a lot of money being thrown around, and that some of the technology coming from the coasts will be useful in their lives, or will be convenient for talking to people, but for the most part they're indifferent.

It has very little to do with religion or wealth, and more to do with lifestyle (city v country) and focus (work v family).

<comment><USER6> Seems like coastal tech types are more judgmental than these people living in the sneered-at "flyover states". The amount of contempt you see out here in the bay area is just staggering.

</comment></comment></comment></comment></comment><comment><USER7> Why link BoingBoing and not directly to her actual blog post?

[http://vihart.com/google-youtube-integration-kind-of-like- tw...](http://vihart.com/google-youtube-integration-kind-of-like-twilight- except-in-this-version-when-cullen-drinks-bellatubes-blood-they-both-become- mortal-but-cullen-is-still-an-abusive-creep-also-it-is-still-bad/)

<comment><USER8> Her actual blog post has been submitted [1], too, but it has a very nondescriptive title "Google+ YouTube Integration" so it had no chance of getting upvoted to HN frontpage.

I mean, the title is a good title for her blog, but as it does not mention Vi Hart (and why would it, it's her blog), it makes a very nondescriptive title for a HN submission.

[1] [https://news.ycombinator.com/item?id=6719069](https://news.ycombinator.com/item?id=6719069)

<comment><USER8> As HN policy is to keep the original titles of the submitted links, this probably has the consequence that only original content that has an "upvote- able" title, can reach HN frontpage.

If the original content is good, but has a "non-upvote-able" title, then the only way for that kind of news to reach HN frontpage is if a third party re- blogs about them with a better title.

As happened in this case.

<comment><USER9> That's kind of a terrible side effect, isn't it?

I understand the existing policy as it is used to prevent editorializing, but it's unfortunate that this burying of interesting/original content can also result.

<comment><USER10> PG posted about it recently. [https://news.ycombinator.com/item?id=6572466](https://news.ycombinator.com/item?id=6572466) He basically said it's an acceptable loss compared to policing linkbait.

<comment><USER11> I suspect it has the opposite effect; rather, it promotes spammy linkbait reblog content on HN.

<comment><USER12> Coming soon: An automated article wrapper whose sole purpose is to re-title otherwise interesting articles?

<comment><USER13> You pretty much just described the entire business model of Gawker, Business Insider, and the Huffington Post.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER14> I guess Google couldn't resist tapping into one of their only successful social media (Youtube) to promote G+. Of course Youtube being right below 4chan's /b/ in terms of online discussion it was a very risky decision.

Google is very good at sorting the web and finding the interesting content. I think in the long run they might be able to do the same thing with comments and be able to extract the insightful content and weed out all the noise. If they manage to do that it could be a revolution: imagine a website like reddit where you could automatically hide all low-content submissions and comments based on your preferences.

They're definitely not there though, so far this G+/Youtube integration is an unmitigated disaster. It even broke my Chrome plugin that removed all comments from Youtube videos. Life is suffering.

<comment><USER15> _I guess Google couldn 't resist tapping into one of their only successful social media (Youtube) to promote G+._

This is a common sentiment, but doesn't simple platform pragmatism make it obvious why they want to merge disparate identities and systems? Why _should_ YouTube have an island comment system given that it's a Google property? Of course the replacement should be ready for prime time (it sounds like some basic features are missing right now, such as channel owner moderation), but the eventual move to that is something that under virtually any situation anyone would recommend.

My Flickr account got turned into a Yahoo account. My Skype account is now a Live account or whatever. Of course these things come together, and I'm not quite sure why every narrative about things like this (not necessary your post) has to be "G+ needs to take on Facebook so this is how it's doing it", when the more obvious explanation of "Company homogenizes systems" fits so well.

Further one annoying aspect of this whole drama is that to demonstrate that there is a problem, people _become_ the problem. It seems like the vast majority of abuse in YouTube land right now are people desperately trying to demonstrate that the Google+ migration was a mistake (e.g. copy pasting tanks an other inanities). This demonstrates that people resist change more than any fault in the new platform.

<comment><USER16> "Why _should_ YouTube have an island comment system given that it's a Google property?"

That's a very Google-centric way of looking at it. From their point of view, merging everything may be a big convenience and make them more money through more detailed profiling of users.

But my end user point of view is the opposite. The fact that one company with a product I use bought another company with an unrelated product I use, because it happens to create efficiencies on a balance sheet, doesn't magically create a desire within me to use those products together.

I don't need some stupid cat video I clicked on and watched for 10 seconds affecting my searches and ads I see. My choice of what videos to watch is by default disjoint from my other online activities. If I want to share a video, I'll do it explicitly and don't need any integration to make that happen. Having my actions tracked across unrelated sites and reported to everyone I know, and a labyrinthine scheme of privacy settings I would need to constantly monitor to stay configured the way I want, just keeps me off social networks altogether and using adblock/ghostery everywhere.

<comment><USER15> _That 's a very Google-centric way of looking at it. From their point of view, merging everything may be a big convenience and make them more money through more detailed profiling of users._

It's a very every company ever way of looking at it -- if you have multiple systems that do largely the same thing, you take the better or more encompassing of the two (or three, etc) and let it win. This is 90% of the purpose of companies acquiring systems and companies.

As to tracking, do you think Google didn't already track you with complete accuracy and knowledge? I don't think this does anything at all to improve their profiling of you. Literally nothing. They probably have some hopes about engagement, but I would wager the primary motivation is simply rationalizing systems.

And let's be clear -- YouTube's comments _before_ this debacle were a garbage dump of noise. They represented the most notorious, least signal manifestation of comments on the tubes. Now, apparently, distaste for Google+ is enough for people to black that out of their memory?

</comment></comment></comment></comment><comment><USER17> I mostly use YouTube to watch channels that I subscribe to. I already disliked when they switched to their new "feeds" view that makes following channels very tough (sometimes videos are missing, the list only goes so long, but I want to watch something far later, also no real control over what goes into your list in the first place etc.). That made me write my own feed view[0].

Vi mentioning torrents made me wonder: would combining torrents with something like flattr and a reasonably good ui plus maybe a choice of where to host comments (reddit etc.) be something that I should be working on?

Since torrents eliminate the hosting overhead, there is no real extra cost that content providers would have to pay here. Probably the only question is whether people would support something like that through flattr, but it seems to me like patreon[1] is doing pretty well already. And the model to keep content at a "release early to paying members, then to the public" makes a lot of sense in general. The only real problem I can see is that YouTube does have the benefit of being very accessible - automatically converting videos for mobile devices etc..

[0] [https://github.com/daviddeutsch/yt- sanegrid/](https://github.com/daviddeutsch/yt-sanegrid/) [1] [http://www.patreon.com/](http://www.patreon.com/)

<comment><USER18> Accessibility and streaming. I don't always want to download an entire video, sometimes I just want to dip into it and see if I am interested. There are streaming modes for torrents available in some clients that try to prioritize what you need to stream, but they never have worked very well in my experience.

Giving up accessibility and mobile seems like the touch of death.

<comment><USER19> Not having to download a video/piece of music is exactly the problem that YouTube solved. Going back to this doesn't seem like the right answer to me and will likely cost you most of your audience. Furthermore, moving to torrents is hardly a solution for YouTubers who actually monetise their videos through the site.

The better solution, if you don't agree with their new comment policy, would be to migrate to another video site like Vimeo.

<comment><USER17> > Furthermore, moving to torrents is hardly a solution for YouTubers who > actually monetise their videos through the site.

That's why I mentioned flattr and patreon.

</comment></comment></comment></comment><comment><USER20> Before this becomes another Google bashing session, I'd like to point out that this is one person's opinion, a respectable opinion from an intelligent person but still it's very subjective and a mainly a reactive judgment (see the post's date).

I am subscribed to a number of channels, mainly edu/pop science stuff. I took note to scroll through the comment sections during the change and from what I saw the quality generally improved. I was also pleasantly surprised to see better discourse under some of the more popular entertainment videos although in the first couple of days there was the occasional protest comment. It's the gaming videos that attract the largest amount of trolling and ASCII art comments.

Ironically those protesting the comments are the ones producing the spam, seemingly just to prove a point. The main complaints: lack of character limit, users can reply to their own comments, and the order of the comments. This isn't unfixable, they'll have to study the new comment corpus and tweak accordingly, there is no one size solution to trolls/spam, just data. And I hope Vi takes that into consideration. The new comment system might need a short while to mature, the fact that it wasn't perfect out of the gate doesn't mean it's a bad concept.

I remember similar amount of displeasure on display when YouTube changed the rating system from 5 stars to thumbs up/down, and there was always the smaller retaliations following each redesign (youtubers hated the new unified channel design at first and produced the mandatory protest videos) there is also residual anger because YouTube nixed video responses late last month due to low usage.

It's mainly aversion to change, this time the change is bigger and is noticeable not just to those that make the videos.

<comment><USER21> Even if the YouTube comments will be of higher quality in the long run, there is one functionality problem that I am wondering how Google will resolve. That is, enabling Safe Search on your Google Account will turn on Safety Mode by default in YouTube [1]. This in turn will auto-hide comments. This makes for a very poor user experience for those who wish to see comments by default but also keep their Safe Search on - something that was possible prior to the merge.

[1] [https://support.google.com/youtube/answer/174084?hl=en](https://support.google.com/youtube/answer/174084?hl=en)

<comment><USER22> I'm curious about your use case. Why would you be okay with YouTube comments (which could be full of profanity and/or the names of reproductive organs) but still want Safe Search enabled?

<comment><USER23> Isn't that a pretty broad brush you're using there? Not all comments are full of profanity and/or the names of reproductive organs. Wouldn't your approach to Safe Search be to not return any links (which could be full of profanity and/or the names of reproductive organs)?

<comment><USER22> Then wouldn't it make more sense to complain that Safety Mode should filter "bad" comments rather than all comments entirely than to complain that you want Safety Mode and Safe Search to be in different states?

I thought the point of these features was "think of the children" (and letting kids access comments that aren't moderated is a big no-no in online safety), but clearly there are use cases that aren't being captured here.

<comment><USER21> fluidcruft was right on the money. You're painting quite a broad stroke on the comments there. To elaborate, my use case is this:

On YouTube, the only channels I read comments on are the educational ones (Crash Course, Grey Explains, SciShow, etc.). For everything else, I don't care much for hearing what other people think. So in my use case, I honestly haven't seen much profanity or bad comments in my entire time using YouTube.

For Google, I use strict Safe Search because I don't care for NSFW content. I also work at a school and when I need to search for images to use on handouts, I don't want any NSFW content to appear.

> Then wouldn't it make more sense to complain that Safety Mode should filter > "bad" comments rather than all comments entirely than to complain that you > want Safety Mode and Safe Search to be in different states?

No, because prior to Google forcing my G+ account to merge with my legacy YouTube account, I was able to have these in different states. YouTube had Safety Mode off and Google had Safe Search on. If Google is going to force people to merge accounts, then they should not be removing functionality that existed when the accounts were separate. Complaining for a feature to change, when it was working perfectly fine on its own before, is far less productive than pointing out how two features worked separately before they were merged together. This also ties in with what theOnliest says below. There is a very distinct different between the two use cases (reading YouTube comments and using Google Search). It does not make sense to merge the two features; especially if you aren't going to rename then into a single feature (there is no indication on YouTube and Google Preferences that changing one will affect the other).

<comment><USER22> Hmm, I see. Thanks!

</comment></comment></comment></comment></comment></comment></comment><comment><USER24> Check out the beta for "lightweight" Youtube, dubbed Feather[1]. It's a streamlined layout without comments or other junk. I've found that the user experience with Youtube has been steadily declining for several years; this seems to mitigate many of the issues I've had.

[1][http://www.youtube.com/feather_beta](http://www.youtube.com/feather_beta)

<comment><USER25> So the fix for youtube breaking perfectly fine comments in a move to push G+ on the unwanting, is to remove comments all together?

Seriously?

<comment><USER26> Perfectly fine? Maybe you only watch videos in an extremely narrow group, which typically have only the most eloquent and empathetic commenters, but I think most people would argue that comments have been the worse part of Youtube since their inception.

Spam, trolls, racists, and flamers were routinely "thumbed up" in comments. And then we have the comments consisting entirely of "exact quote from the video you just watched" which typically have hundreds of thumbs up as well, and add absolutely nothing to any discussion on the video itself. I don't think I'm alone in saying the SNR of Youtube comments was low to the point that I never sought out to read them any more. And when I did, it was more of a "lets see how bad the train-wreck is" mentality.

<comment><USER27> Stupid comments never bothered me, sometimes they are even funny, that's the beauty of it.

Moreover, did Google/Youtube said they pushed the change due to quality of comments ?

<comment><USER28> They're funny until you see a gazillion pages of them.

<comment><USER23> You don't have to see a gazillion of them if the good stuff is on the first page.

<comment><USER28> Quote from parent: "Stupid comments"

Stupid comments = good stuff? :)

</comment></comment></comment></comment></comment></comment></comment><comment><USER29> This is blogspam.

Original content: [http://vihart.com/google-youtube-integration-kind-of-like- tw...](http://vihart.com/google-youtube-integration-kind-of-like-twilight- except-in-this-version-when-cullen-drinks-bellatubes-blood-they-both-become- mortal-but-cullen-is-still-an-abusive-creep-also-it-is-still-bad/)

<comment><AUTHOR> Actually, the original post _was_ submitted. As was pointed out above, this is not blogspam. It's a result of HN's policy that only original titles can be used. The original blog post has a title that isn't nearly as friendly to upvoting. It's a system that has its pros and cons, but it's what HN has decided to do.

<comment><USER30> _As was pointed out above, this is not blogspam._

Well, boingboing _is_ festooned with ads and affiliate links. It's a business, after all.

The problem is not so much whether BB is blogspam[0] but that blogspam often has a better chance of getting up-voted on HN.

[0]: My view: There are many ads, but half the time there's some sensible additional commentary for the target post, so there's plausible value in exchange for the ads.

<comment><USER31> Boingboing is a good place to find interesting things, but they value traffic more than correctness : [http://lee-phillips.org/notmiles/](http://lee- phillips.org/notmiles/)

<comment><USER30> True. I've found many good and useful things there, but every so often they post something that is clearly dubious or a hoax. That's fine as things go; people make mistakes.

But when caught out they tend (to the extent I've seen) to either say nothing or to just delete the post, rather than make an effort to correct mistakes.

(On a related note, I'm amazed at the level of snark and bile in the some of the comments on Boing-boing; the nasty ones rival or out-do the worst of Youtube.)

</comment></comment></comment></comment></comment><comment><USER30> Interesting tweet from Vi Hart:

 _I repeat, I have no plans to stop uploading to YouTube. I like @doctorow but that article 's title was sensationalist and quite incorrect._

[https://twitter.com/vihartvihart/status/401035312819736576](https://twitter.com/vihartvihart/status/401035312819736576)

</comment><comment><USER32> Google's revenue is structured like this: search, peering agreements and whatnot, and way, way down the ledger: "other". Most of the products that google makes are just toys. The pressure is off because nobody at google expects anything in the "other" category to earn company-affecting levels of revenue. As a consequence google has spent years and years being in huge businesses that it barely understands and barely cares about. Youtube being a prime example of that.

Youtube has lots of problems, but it has lots of amazingly wonderful aspects as well. It is rapidly becoming a very important part of the way people communicate in the 21st century. Yet google is so ham fisted in their handling of youtube they have no idea what to do with it other than use it as a lever to compete against facebook. Google should be coddling the creators on youtube, these are people who have acquired very enthusiastic and very large fanbases through the medium of youtube. Some folks make their living entirely off of youtube. Others use youtube as a critical part of their brand and their business. Many musicians have kickstarted their careers through youtube, for example.

Google should be understanding the way these people use youtube, and improving the tools they have available to make their lives easier. To help them connect even better with their audiences and fan bases. Instead google treats content creators little better than any other average user of youtube.

Google didn't switch the youtube comment system to g+ for any benevolent reasons, those were just excuses and justifications for them to try to roll out the g+ empire far enough for it to actually get traction.

Meanwhile they are pissing off the people who add the greatest value to youtube. The trolls and spammers don't give a shit. Even in the worst case scenario for them where they are completely and utterly silenced it's not a big deal, they'll just find some other outlet. Meanwhile everyone else pays the price.

The saddest part is that google doesn't even realize the value of what they have, and because they are so inept at monetizing anything other than slapping ads on it they may never realize until they've destroyed it or driven everyone elsewhere.

</comment><comment><USER33> Original article: [http://vihart.com/google-youtube-integration-kind-of-like- tw...](http://vihart.com/google-youtube-integration-kind-of-like-twilight- except-in-this-version-when-cullen-drinks-bellatubes-blood-they-both-become- mortal-but-cullen-is-still-an-abusive-creep-also-it-is-still-bad/)

HN Discussion to the original article: [https://news.ycombinator.com/item?id=6719069](https://news.ycombinator.com/item?id=6719069)

</comment><comment><USER34> On Twitter, Vi Hart denies this: [https://twitter.com/vihartvihart/status/401035312819736576](https://twitter.com/vihartvihart/status/401035312819736576)

"I repeat, I have no plans to stop uploading to YouTube. I like @doctorow but that article's title was sensationalist and quite incorrect."

</comment><comment><USER35> What are the top main 3 competitors to youtube (besides vimeo).

Shouldn't someone be able to come up with a half decent competitor at this point in the game? Seems like Google is trying really hard to kill the best media property they've got.

<comment><USER36> I think the ultimate competitor for these kinds of things will be no competitor, when people can just post things "up there" that don't appear to be tied to any obviously identifiable gatekeeper.

<comment><USER37> They already have that. You might have heard of it, it's called "the web". :)

But seriously, the FSF or somebody needs to work on the problems Youtube and Facebook solve, but urgently. When posting things on your own website and sharing it with your friends becomes as easy as updating your facebook status, much disruption will ensue.

It just doesn't seem like it should be that hard. A fancy UI on top of email and an easy homepage creator is all it would take, right? Opt-in advertising could give people a choice whether to display ads or pay for hosting.

Couldn't web hosting companies make a lot of money and compete with Facebook and Google if they innovated this way? Because, basically, that's what Facebook is selling. Hosting+fancy UI. I must be missing something because nobody seems to be doing this.

<comment><USER38> We need IPv6 first I feel; then we need the idea of a personal IP address that can act as a personal gateway to your computer. Then there needs to be a social platform which merely acts as a caching proxy for connection to you.

At that point we can do FB but have it decentralised, you won't need a sharing service you'll just need to give people your IP - this I felt was the idea behind Opera's Unite "server in a browser".

<comment><USER6> "Boy I'd sure love to see the pictures from Dan's wedding, but his desktop got a virus so he's offline."

You could use a little Pogoplug-style appliance, but you're still placing usability at the mercy of Comcast, clueless users, and curious cable-pulling children.

</comment></comment></comment></comment></comment><comment><USER39> The people at Google need to open source the comment data if they can't figure it out themselves. I could take a crack at it and at least I'd get rid of the comments that spout "nigger" a hundred times.

<comment><USER40> Your HN post has been quarantined because you used a forbidden word. We are sorry if you were legitimately using it to spawn a meta-discussion about sensitive topics, we are very sensitive about internet censorship issues, but please understand that our natural language parser is optimized for the most common content, and that doesn't include (hopefully) insightful comments like yours.

<comment><USER41> That's silly and untrue.

EDIT: Mmh. Humor on the internet?!

<comment><USER42> It might be a satire on filtering comments by "certain" words.

<comment><USER43> Yeah, that's a clbuttic mistake.

</comment></comment></comment></comment></comment><comment><USER44> Title is just incorrect: She isn't leaving. She is only "maybe" turning off comments and moving discussion to Reddit.

<comment><USER38> Reddit? No hateful comments there then ...

Guess at least you can have moderators.

Sounds like Reddit need to add a video distribution system, it would be quite a thing to pick top vloggers and add them in to the current mix.

I wonder where Vi Hart stands WRT her content. Can she remove it from YouTube. Could she remove it via a copyright infringement claim?

<comment><USER32> Sub-reddits are like irc channels or usenet newsgroups, they can have owners and be moderated to whatever degree those owners desire. Some sub-reddits are very tightly moderated.

</comment></comment></comment><comment><USER45> Who actually reads youtube comments? Anyone here? They should just remove comments all together or allow only the video poster to create and approve comments.

<comment><USER46> +1. I don't see why there's so much whining. The YT comments are shit, and you'll be doing yourself a favor installing by a extension like this [1] (which, unfortunately, doesn't work with the new system yet)

Doesn't want to comment under your real name for whatever reason (trolling, personal info, fear of being stalked, etc)? Don't comment. Everyone will be better off.

[1] [http://www.tannr.com/herp-derp-youtube- comments/](http://www.tannr.com/herp-derp-youtube-comments/)

</comment></comment><comment><USER47> From the perspective of a content consumer without a youtube account, the quality of the service continues to decrease. The most basic use case of uploading and linking to or embedding content remains invaluable, but functionality facilitating content exploration has noticeably diminished over time. This can clearly be seen in the list of suggested videos presented to the user for each video being watched.

Google, understandably, wants to increase metrics related to time spent on site since it facilitates selling ads. This has led from suggestions having less emphasis on presenting related videos. Instead, priority is given to videos algorithmically determined to most likely be clicked on by the viewer. This has resulted in the suggestion list becoming increasingly obnoxious even for viewers without youtube accounts.

For instance, if I pull up the Dead Skeletons - Dead Mantra music video [1] -- my new favorite psychedelic rock song -- the first four video suggestions are:

I. Weird trick for baldness (ad)

II. Dead Skeletons Mix (playlist of 49 videos)

III. Magical Healing Aura - Om Mani Padme Hum (featured video) [new age esque instrumental with 8 million views]

IV. MOST SHOCKING DEATHS ON CAMERA!!!!!!!!!!!!.flv [presumably a Faces of Death style video for those that enjoy watching people die; absolutely not something I want to expose myself to]

The deaths on camera video only recently infected the suggestion list for this video. Apparently it's the highest ranking result of some algorithm predicting what I'll most likely click on independent of the video I landed on. My only guess at explaining this suggestion is I recently followed some youtube and wikipedia links on reddit about the mysterious circumstances surrounding Edgar Allen Poe's death.

This obnoxious suggestion that I can't opt out of has made me pay more attention to the top suggestions on the videos I watch. Ultimately I'm served up with suggestions that increasingly remind me how Google is tracking my past behavior even though I don't currently use a youtube or gmail account. This has left me longing for the good old days of youtube where I would often follow related video links and discover great new content.

The result of these changes in video recommendation strategy is gradually conditioning me to expect personalized linkbait instead of related content, leading to less time spent on site.

It's a damn shame that Google is so focused on maximizing ad sales at the expense of content exploration functionality. The immediate value and historical importance of the content hosted on YouTube needs a better steward than Google. Thank god Wikipedia hasn't fallen into the hands of a for-profit entity. I can imagine Google getting their hands on the current Wikipedia functionality and gradually jailing users in a Panopticon of filter bubbles optimized for ad targeting -- Orwell spinning in his grave.

Hopefully I'll be able to look back on the previous paragraph in the future and see it proved to be FUD...

[1][http://www.youtube.com/watch?v=CsyrOGRxF0E](http://www.youtube.com/watch?v=CsyrOGRxF0E)

Edit: I may be wrong about the MOST SHOCKING DEATHS ON VIDEO!!!!!!!!!.flv suggestion being targeted specifically at me. However, "The Stupidest Bid on The Price is Right" further down the suggestion list almost certainly is.

<comment><USER48> >Google, understandably, wants to increase metrics related to time spent on site since it facilitates selling ads.

The funny thing is that Google's original success was based on creating a search engine which didn't try to "trap" users to the site, instead giving what they wanted quickly.

<comment><USER49> The problem is that search engine != video sharing site.

The sign of a good search engine is one where the user leaves quickly because the user finds the content they want quickly.

The sign of a good video sharing site is one where the user stays because the user keeps finding videos they want to watch.

So, in fact, I would find it perfectly acceptable if Google does measure YouTube's performance (and product quality) by a metric related to time spent on site.

</comment></comment></comment><comment><USER50> I like the idea of turning off comments, and then linking to a Reddit post in the video description. An alternative to that, should you not be balking at required G+ integration, is visiting the comment management[1] page. It should be possible to build a vetted user base with the tools there.

You'd have to do some heavy upfront work approving comments and adding approved users, but I believe it would ultimately pay off more than piggybacking on another free service to de-spam comments. Instead, it would be sort of a throwback to the old BBS days when sysops of some boards would call you to verify your account before adding you as a user.

And clearly Google is going to address the nonsense comments somehow, since so many high-profile users are complaining now and threatening to leave. I'm genuinely curious how this will all play out; it may be a good test as to whether management and devs at Google still have "chops".

[1] [https://www.youtube.com/comment_management](https://www.youtube.com/comment_management)

</comment><comment><USER51> >It's abundantly clear now that there are more than enough people who are willing to be jerks under their real names.

I hate this argument, because the argument has never been that no person would be rude under their name, it's that there would be _less_ rudeness:

I think axiomatically we can assume that real-name policies won't make people more rude (except maybe on the topic of real-name policies). Here by rude I mean the stupidity of the sort you basically only find in online comments.

So we can then say that there just as many (or less) people being rude on the same site with real-name policies as a site without. I feel less incentive to be rude when my name is next to the comment. I use YouTube. Therefore there is less rudeness thanks to this policy.

For every website I use that has a real-name policy, it has been effective in reducing the amount of rudeness by 1 person's worth.

I would really hope for some scientific studies on how much awfulness we could avoid by people owning up to what they say.

<comment><USER22> > I hate this argument, because the argument has never been that no person > would be rude under their name, it's that there would be less rudeness:

The counter-argument to this is that real names policies oppress the very people that were enabled by pseudonyms on the internet: women (especially in tech), minorities, and whistleblowers, because they're at risk of being ostracized in real life based on their online comments if their real names are associated with said comments.

That said, I think the Real Names argument here is a red herring -- hundreds of employees at Facebook and Google have rehashed this argument over and over again to death. The real uproar here is the change in the "social contract" between users and YouTube; similar to people being upset about ads being added to Twitter or about developer APIs being shut down or when a free service goes to a paid model.

</comment></comment><comment><USER52> In the entirety of my YouTube use (circa 2006!) I think I've left ~3 comments. I've never seen comments as a core feature of why I use YouTube so this won't change my perceived usefulness of it.

This reminds me of Facebook's changes in ~2010: They changed the entire layout of the site twice in the same year and there was noticeable backlash, but everyone quickly got over it and (more importantly) usage kept going up. At this point YouTube accounts for 18% of US traffic[1]... I don't think there's a substitute premium video service that has the infrastructure to support that level of usage.

[1] [http://allthingsd.com/20131111/netflix-youtube-half-your- bro...](http://allthingsd.com/20131111/netflix-youtube-half-your-broadband- diet/)

</comment><comment><USER53> Is there any development into an open and free video sharing site similar to what YT used to be? Something where the users of the site are actually the customers and are treated as such?

There is plenty of content I'd subscribe to see on YouTube.

If there is, it's something we should promote. If there isn't, we should build it.

A note to Google: when users are looking to get away from your otherwise incredibly successful services, it might indicate there's a very serious problem that should be corrected immediately. People want alternatives to Search, Mail, and now YouTube based on your policies and how you mistreat and ignore users. Perhaps something needs to change before this evil spreads to everything Google owns.

<comment><USER6> > open and free video sharing site

> the users of the site are actually the customers

Well which is it? Do you want it to be free, or do you want to be treated like a customer? Because you don't store and serve millions of videos on sunshine, it takes data centers and lots of bandwidth.

<comment><USER53> Both. They aren't mutually exclusive. I don't believe ads are a valid source of monetization. Once you start showing ads, you invariably become evil.

Free to use, free content by default, with premiums and ratings/comments to help people decide what's worth paying for.

There are a number of shows I watch on YT that I find very entertaining. If the latest 3-5 episodes, posted daily are available to a channel subscriber for something like $2.99 a month, and episodes older than that are free, you can either watch things for free or get access to them as they're made and be more involved with the author via comments, etc. There are more options than "free" or "paid" or "advertisement supported." Unfortunately we're still stuck in a world that's riding the coattails of the cable industry, which is now dying, so perhaps that's a bad model to emulate.

</comment></comment></comment><comment><USER39> FWIW I don't think that G+ is a bad system, or even beyond succeeding. I just think the majority of content posted is mindless.

<comment><USER54> That's a given. As I've been railing for years on G+, at Web scale, Sturgeon's Law is six sigma compliant: 99.99966% of everything is crap.

G+ has a filter problem. Robert Scoble's been on them about this from the start. Clay Shirkey has also observed (in the general case) that it's not a data overload, but filter underload. Human information handling capacity is limited and we can only process so much.

My preferred mode of using G+ is through Notifications and Search. Both need much love, but they're vastly better than Streams and Communities.

All of which I've written on at length on G+.

</comment></comment><comment><USER55> Why do we even need comments on YouTube?

<comment><USER56> It's kind of like reddit. On some very niche channels, there's actually "ok" discussions. Usually requests for more information that wasn't in the video...that sort of thing. It's not _great_ discourse, but I've found it useful from time to time.

</comment></comment><comment><USER57> Oddly, I tend to use Bing video search to browse youtube and watch videos now. The experience is better.

</comment><comment><USER58> I wasn't aware so many people cared about YouTube comments.

I'd actually forgot they existed after installing a plugin to have them removed a couple of years back. When I did notice comments, I can't remember an instance where a comment added value to the video.

They always just seemed to oscillate between the "yeah, awesome!" variety or quickly devolving to name calling and borderline hate speech.

I think I'll leave the plugin enabled and not bother with it at all.

</comment><comment><USER59> I think it would be interesting to have a tagging system on comments. For example you could tag comments as "abusive" "trollish" "insightful" "funny" etc. If enough people tagged a comment as abusive or trollish it would be hidden. Of course there are still huge problems with this, but it would be an interesting experiment.

</comment><comment><USER60> As the old adage goes: NEVER EVER build your business as completely dependent atop a Microsoft product. Or if you must, expect to go out of business at some point. In the 21st century, you can replace Microsoft with Google or Facebook or whatever else pops up that gets to their level. I'm willing to bet people will next be burned by relying too much on AWS.

</comment><comment><USER30> _... now her regular, good commenters comments hover at the bottom of the pile, while hateful trolls whose messages generate a lot of replies are judged "good" by G+ and promoted to the top._

Can someone link to an instance of this? I checked out three or four of her videos and the top comments all seem non-hateful, non-trollish.

</comment><comment><USER61> oh thank god someone said it - YouTube is effectively unusable, it stinks. It's like visiting the X factor shopping mall, with bikinis. (Possibly I have a YouTube bubble I should not admit to but I am assuming that's the default)

I just cannot imagine staying on the front page for any more than 3 seconds.

</comment><comment><USER62> So your videos are going to be available as torrents from your own site? Good luck growing your audience.

EDIT: turns out that she was considering hosting _commentary_ on her own site, but has no plans to take her videos off YouTube, and criticized BB for a misleading headline: [https://twitter.com/vihartvihart/status/401035312819736576](https://twitter.com/vihartvihart/status/401035312819736576)

I don't care for the integration of G+ in YouTube either, but a) there was no shortage of hateful BS in YouTube comments prior to this (as well as some outstanding humor) and b) you can disable comments and even ratings for any video that you upload and/or make them private (eg for fans or even paying subscribers).

</comment><comment><USER63> _promoting hateful inflammatory comments because they provoke responses_

Please don't feed the trolls.

</comment><comment><USER64> I can't believe no one has said anything about this yet, but the big problem with youtube comments is the way they're ranked. By replies, not by upvotes. Whoever decided on that needs to be fired.

</comment><comment><USER65> I hope Google manage to sort this out some time soon. In the short term, just undoing everything and going back to the old comment system might actually be a good idea.

</comment><comment><USER66> I mean this I. All seriousness, I prefer YouTube comments the way they were. These comments provided a great data point for determing how large oercebtages of humans really are. Forcing these G+ real name stuff is just like sticking your head in the sand and pretending that much of the world online, not just on places like Stormfront, is a cesspool of racism, ignorance, and hate. Myself, I prefer to see things as they are.

</comment><comment><USER67> I have resisted the Google+ Tyranny for long. I have refused to vote my fav. apps on Android, I refuse to comment on youtube videos and so on.

</comment><comment><USER68> Not that they wouldn't have ruined it, but Google must be kicking themselves for not trying more aggressively to buy Twitter years ago.

</comment><comment><USER69> Has anyone used any YouTube competitors? Ms. Hart wants to stream her videos through bittorent, but how much trouble is using vimeo instead?

<comment><USER70> I'm not sure Vimeo is really the right platform. Vimeo seems a lot more targeted towards the art of videography itself, so comments about technique and editing and so on are a lot more common, rather than the actual content of the video.

<comment><USER71> This probably happened because vimeo offered better quality encoding early on.

<comment><USER72> It also has a lot to do with their terms. All content must be 100% original.

</comment></comment></comment></comment><comment><USER73> [http://youtu.be/jQjocZXHOg4](http://youtu.be/jQjocZXHOg4)

to the point video from discussion on the site about the article.

2c.

</comment><comment><USER74> Why not post her original comments? [http://vihart.com/](http://vihart.com/)

</comment><comment><USER75> I really have zero idea why I should care? I ignored all comments except when I thought it would be funny. So people come to YouTube to comment??????? I thought that was like only .05% who did?

Where am I being an ignorant YouTube user? Just seems like a big to do about nothing.

<comment><USER76> Her video are very educational and attracted quality comments. Now, those quality comments are hidden, and low quality comments are moved to the top.

This is the issue.

</comment></comment><comment><USER4> This, perhaps more than anything else, should be a huge red flag for Google. Vi Hart is the _epitome_ of what Youtube was born to be, an enabler of talent discovery like no other. Losing this would be a huge blow.

</comment><comment><USER77> This is the perfect time for Youtube alternatives to come into the market.

</comment><comment><USER78> I'm just waiting for MySpace to allow simple video sharing and a subscribe box THAT ACTUALLY FUCKING WORKS, and they'll take over.

</comment><comment><USER79> I just installed a userscript to hide the comments.

</comment><comment><USER80> Never saw the issue with YouTube comments. Always was much ado about nothing. So people were immature - it's funny. So people were insulting - grow up, they're having fun.

This whole movement to control YouTube comments reeks more of management's personal embarrassment that their customers weren't as serious and high class as they. Again, grow up. Not everyone is like you - not even your customers.

</comment><comment><USER81> I don't think this is a problem with G+ per se, just a bad sorting algorithm.

What would a good comment sorting algorithm even look like for Youtube? Something like HN/Reddit votes would be worth a try but I wouldn't be surprised to see the trolls float to the top there either.

</comment><comment><USER82> Mediagoblin!

</comment><comment><USER83> NO. Google is trolling. www.gifti.me/i/iPwWl.gif</comment>


Telia to Pay Nearly $1B to Settle Uzbek Bribery Claims - <AUTHOR> https://www.wsj.com/articles/telia-to-pay-nearly-1-billion-to-settle-uzbek-bribery-claims-1506027280?mod=rss_Technology <comment><USER2> I work for one of the investigative reporting teams that initially uncovered the bribe.

[https://www.occrp.org/en/corruptistan/uzbekistan/gulnarakari...](https://www.occrp.org/en/corruptistan/uzbekistan/gulnarakarimova/)

Doing this type of journalism requires access to large amounts of documents and data, and we build custom tools for that. We're currently looking to hire both front-end and data engineering devs.

So if JavaScript and billion dollar bribes are your thing, please come help us!

* [https://www.occrp.org/en/53-other/jobs-and-tenders/7015-fron...](https://www.occrp.org/en/53-other/jobs-and-tenders/7015-front-end-developer-m-f)

* [https://www.occrp.org/en/53-other/jobs-and-tenders/7016-inve...](https://www.occrp.org/en/53-other/jobs-and-tenders/7016-investigative-data-developer-m-f)

jobs @ occrp.org

<comment><USER3> How do you get the data? I'm curious because there is a phenomenon here in Prague, Czech Republic, in which there are mostly empty restaurants and stores will obviously have no hope of making rent. Like if you calculate how many customers go inside each day, and you assume they all bought the most expensive item, the total revenue would be less than the cost of rent for the location. Cynical Czechs all say that these companies are fronts for laundering money, but would it be possible for me, as a normal civilian to get hold of documents which would prove that? I thought that the finances of private companies were more or less secrets.

<comment><USER4> whistle blower and other people working for such companies

</comment></comment></comment><comment><USER5> So to recap, a Swedish telco bribed officials in Uzbekistan and the settlement goes to US and Dutch authorities, because the money was wired through New York bank(s)?

Granted, $1B is not a huge amount in the grand scheme of things, but shouldn't the money go to the Uzbeki people, who were the ones getting 'screwed'?

<comment><USER6> As for the Dutch part. The Dutch daughter companies paid the bribes, which is illegal under Dutch law and this is a settlement with the Dutch Public Prosecutor. Uzbekistan should separately recover that money from the Karimov family.

<comment><USER7> Whenever I see these types of laws actually being applied, I wonder why the companies involved don't just outsource the payments to subsidiaries in jurisdictions that don't have (or don't enforce, which is most of them) such laws. Are there any specific legal barriers to that?

<comment><USER8> Dutch legal system is often chosen because you don't want to be a counterparty to an agreement in a shitty jurisdiction.

Typically companies worry more about their counterparty screwing (e.g. not delivering, delivering late, delivering low quality, or not paying, paying late or paying too little) them than the government.

You can't have your cake and eat it too. Jurisdictions that turn a blind eye to bribery indicate strong levels of corruption, which means you're vulnerable to your contract not being honoured by your partner and being unable to enforce penalties.

</comment></comment></comment></comment><comment><USER9> Since I grew up in a country with lots of corruption, I'm personally a fan of laws that punish companies for bribes in other countries. It's not perfect, but funny enough, I do trust the law in (some) other countries more.

</comment><comment><USER10> So the bribe wasn't for enough and wasn't the right people?

<comment><USER11> The bribe was for a rich and powerful family in Uzbekistan. The US and Dutch authorities didn't like that.

</comment></comment><comment><USER12> Telia is paying billions to US for conducting business in Uzbekistan in the only way it can be done.

please remember this next time EU fines Google.

<comment><USER13> If that is the only way business can be done in Uzbekistan then Telia had no business case in Uzbekistan. It's a no-brainer.

And if you are going to argue with China taking the business, well, let China do the bribery and take the business. The free, open economy will outperform closed corrupted systems in the long run.

<comment><USER7> With the minor caveat that the "free, open economy" (which is really neither free nor open, but I digress) contains strong incentives to prioritize growth and short term profits over other considerations. From the perspective of most shareholders, the only thing Telia did wrong was getting caught. I'm sure they'll do better next time.

</comment></comment></comment><comment><USER14> Can't read the article...

<comment><USER15> Even using a search engine link or private mode doesn't work for me. It asks for cookie consent, but seems to be tracking me before that already, which is illegal here (EU). Unless nobody can read this without a subscription...

<comment><USER16> A decent workaround for WSJ right now is facebook referrer. If you don't want to manually set the referrer, you can use this redirect link [http://www.facebook.com/l.php?u={LINK_HERE}](http://www.facebook.com/l.php?u={LINK_HERE})

</comment></comment></comment><comment><USER17> flagged for the link i can not read.</comment>


Debunking Michael Lewis' Subprime Short Hagiography - <AUTHOR> http://www.nakedcapitalism.com/2010/03/debunking-michael-lewis-subprime-short-hagiography.html

<comment><AUTHOR> I don't get two parts of Smith's debunking. If someone could explain that to me, I'd greatly appreciate it!

\- The 'long side' at the time and with hindsight seemed so much larger; blaming the few (known) shorts who ultimately profited for enlarging the market seems counter-intuitive, to say the least. How could they have gone short on dozens of billions of synthetic products? Can anyone confirm her numbers?

\- Also more philosophically, whose 'fault' is it to profit from madness? The one who recognized it and bet against it, thereby fueling the fire, or the one who invented madness in the first place? She seems to deem the shorts responsible for Wall Street's foolishness not being able to come up with liquidity fast enough and therefore going virtually bankrupt and needing a bail-out, which they undeservingly get. So why exactly does she consider the shorts responsible for Wall Street's failure in foresight/calculation?</comment>


Making the HTTPd run 20% faster with qrintf-gcc; a sprintf-optimizing compiler - <AUTHOR> http://blog.kazuhooku.com/2014/10/announcing-qrintf-and-qrintf-gcc.html <comment><USER2> Very interesting, that printf has that big impact on execution of standard programs. Printf is very powerful (and one of the reasons for the success of C -- for example when you compare it with the standard library existing in Modula 2 or (old) standard Pascal), but that power also comes with a cost.

It would be interesting, how the situation is in C++ with its newer stream based output, that is more based on compiler support (as much I know). Does anybody have experiences with it?

<comment><AUTHOR> That's a very good question.

My understanding is that the main motivation behind the introduction of iostream was to make a type-safe variant of printf. So with iostreams the _type_ of the value is determined at compile-time, but the representation (e.g. should it be stringified as dec or hex? should it be left-align or right?) needs to be determined at run-time.

In other words, the design issue is only partially solved with iostreams in terms of performance.

<comment><USER2> Thanks for the answer. Yes, I was aware, that the focus of iostreams was not on performance. But at least I would have some hope, that since less runtime- parsing would be needed (at least in standard cases), a performance benefit could arise. One of the disadvantages of printf is that even in simple cases (e.g. "%s: %d") rather much parsing is needed.

</comment></comment></comment><comment><USER3> 1\. nothing generic is as fast as making your own custom solution

2\. a lot of libc is lowest common denominator / tons of bloat. printf/sprintf probably does extra locale, multibyte charset, and thread locking shit you don't want.</comment>


Oculus Rift Virtual Reality Headset Coming to iOS Devices - <AUTHOR> http://www.macrumors.com/2013/10/29/oculus-rift-virtual-reality-headset-to-coming-to-ios-devices/

<comment><AUTHOR> This could be a pretty awesome development.

One issue with the story, though. They say that, "the initial mobile version of the Oculus Rift will work solely with iOS devices as Android is not designed to work with virtual reality."

I love iOS and everything, but how is it inherently better for VR than Android?</comment>


It's time to split Linux in two - <AUTHOR> http://m.infoworld.com/d/data-center/its-time-split-linux-in-two-249704?source=rss_&mm_ref=http%3A%2F%2Fplus.url.google.com%2Fmobileapp

<comment><USER2> Stories like this makes me wish HN had a "hide" button.</comment>