Facebook's S-1 Filing - <AUTHOR> http://www.sec.gov/Archives/edgar/data/1326801/000119312512034517/0001193125-12-034517-index.htm <comment><USER3> Facebook is heavily (heavily!) reliant on display advertising, all of which is a) challenged by the switch of its userbase to mobile, and b) going to hit critical mass eventually. No matter how smart you make display advertising, there's still a cap on how much you can foist onto users before you piss them off.

IMO, Facebook's future depends on two things:

1) Figuring out how to serve up contextually relevant ads on mobile platforms in a nonintrusive and, ideally, useful way.

2) Figuring out how to serve up contextually relevant ads _outside of Facebook_ , to Facebook Connect-backended partner sites and apps. (Sort of like an AdSense/AdWords hybrid, but based on very intelligent user-interest and browsing data).

I'm betting on #2's being the runaway breadwinner for Facebook in the long run. The longterm strategy seems to be to reduce reliance/dependence on Facebook.com in favor of Facebook Connect.

<comment><USER4> I've been saying this for a while now (<http://news.ycombinator.com/item?id=3041689>). Facebook's engagement is shifting to mobile. Their entire business model relies on web. Their app ecosystem has been crashing as a result, and display advertising is likely to follow.

Facebook is filled with smart people. They understand the trends better than we do. As you'll note, 4 of their top 5 Risk Factors relate to the web-to- mobile shift and the problems inherent with that.

From the filing:

#2 - "We generate a substantial majority of our revenue from advertising. The loss of advertisers, or reduction in spending by advertisers with Facebook, could seriously harm our business;"

#3 - "Growth in use of Facebook through our mobile products, where we do not currently display ads, as a substitute for use on personal computers may negatively affect our revenue and financial results;"

#4 - "Facebook user growth and engagement on mobile devices depend upon effective operation with mobile operating systems, networks, and standards that we do not control;"

#5 - "We may not be successful in our efforts to grow and further monetize the Facebook Platform;"

<comment><USER5> > _and display advertising is likely to follow._

I think this is correct, and it explains why the IPO exit is happening now. Most of the insane growth (in profit as well as valuation) has already been squeezed out.

<comment><USER6> I think the only reason they went public was because they had to. Mainly the 500 investor limit.

<comment><USER5> > I think the only reason they went public was because they had to.

No, hitting the investor limit means only that you have filing obligations with the SEC. There is no obligation to trade your stock publicly.

</comment></comment></comment></comment></comment><comment><USER7> They are doing a dual class offering. The class B shares (i.e. those held by Zuckerberg and other insiders) are going to have ten times the voting rights as the class A shares.

I wouldn't by into such an ownership structure, though to be fair, google has such a structure and those that bought that at IPO have done very well so far.

From the risks section:

 _As a result of voting agreements with certain stockholders, together with the shares he holds, Mark Zuckerberg, our founder, Chairman, and CEO, will be able to exercise voting rights with respect to an aggregate of XX shares of common stock, representing a majority of the voting power of our outstanding capital stock following our initial public offering. As a result, Mr. Zuckerberg has the ability to control the outcome of matters submitted to our stockholders for approval, including the election of directors and any merger, consolidation, or sale of all or substantially all of our assets. In addition, Mr. Zuckerberg has the ability to control the management and affairs of our company as a result of his position as our CEO and his ability to control the election of our directors. Additionally, in the event that Mr. Zuckerberg controls our company at the time of his death, control may be transferred to a person or entity that he designates as his successor. As a board member and officer, Mr. Zuckerberg owes a fiduciary duty to our stockholders and must act in good faith in a manner he reasonably believes to be in the best interests of our stockholders. As a stockholder, even a controlling stockholder, Mr. Zuckerberg is entitled to vote his shares, and shares over which he has voting control as a result of voting agreements, in his own interests, which may not always be in the interests of our stockholders generally._

<comment><USER5> > _and must act in good faith in a manner he reasonably believes to be in the > best interests of our stockholders. As a stockholder, even a controlling > stockholder, Mr. Zuckerberg is entitled to vote his shares, and shares over > which he has voting control as a result of voting agreements, in his own > interests, which may not always be in the interests of our stockholders > generally._

So he must act in good faith except when he doesn't. Got it.

<comment><USER8> Presumably he must act in good faith until he resigns from the board.

<comment><USER9> No, he must act in good faith when acting in his capacity as a board member and corporate officer. When acting in his capacity as a shareholder, he has no such obligation. The line between the two roles is usually pretty clear.

Think of a member of a military. They have a clear duty to act according to the policy and orders of their superiors. But in most nations, they can also vote, in their personal capacity as citizens, to change the top level of leadership, and they have no obligation to exercise their vote in furtherance of anyone's agenda but their own.

Zuckerberg's position is similar. What's out of whack is that he controls a majority vote of the "citizenry" (shareholders) himself.

</comment></comment></comment></comment><comment><USER10> One of the interesting gems in this filing is at the very end, it details stock grants for acquisitions so you can infer the running rate of talent acquisitions. So for example, "On February 28, 2011, we issued 681,357 shares of our Class A common stock as consideration to a company in connection with our purchase of certain assets from the company." You can cross reference these with news and correlate approximate acquisition cost based on the estimate value of price per share assuming, say, a valuation of $100 billion. So I'm guessing that the company I mentioned is Octazen and assuming a $100 billion valuation (~$50 per share), this comes out to about $35 million (assuming an entirely stock acquisition - note that Facebook spent, for example, $20 million aggregate in cash on acquisitions in 2010).

</comment><comment><USER11> A small tidbit. FB paid Zuck $783,529 (3) in "other" compensation from his base 500k salary.

(3) The fine print.... The amount reported represent approximately $692,679 for costs related to personal use of aircraft chartered in connection with his comprehensive security program and on which family and friends flew during 2011.

Like a boss.

<comment><USER12> For someone worth close to $30b, compromising on things like flying and security seems silly. Amazed they aren't spending more.

<comment><USER13> Indeed.

One should also remember that in the infinite wisdom of the Congress and whoever was President at the time, any cash salary over $1 million gets an extra tax on top of normal income taxes. Better to pay for his security in before tax dollars.

</comment></comment></comment><comment><USER14> It turns out that Zynga only accounts for 12% of their revenue.

"In 2011, Zynga accounted for approximately 12% of our revenue, which amount was comprised of revenue derived from payments processing fees related to Zynga's sales of virtual goods and from direct advertising purchased by Zynga. Additionally, Zynga's apps generate a significant number of pages on which we display ads from other advertisers."

It appears they would still be profitable without Zynga.

<comment><USER15> "Zynga's apps generate a significant number of pages on which we display ads from other advertisers"

Are those ads counted toward the 12% statistic?

<comment><USER16> 85% of revenue is from advertising. So either Zynga controls 80% of all non advertising revenue (aka the remaining 15%) or that 12% figure includes advertisements served on Zynga pages.

Is it reasonable to conclude that Zynga constitutes 80% of FB's credit ecosystem?

<comment> jim-greer No, the 12% includes advertisements Zynga _buys_ from Facebook, but not ads that appear on their pages.

"In 2011, Zynga accounted for approximately 12% of our revenue, which amount was comprised of revenue derived from payments processing fees related to Zynga's sales of virtual goods and from direct advertising purchased by Zynga. Additionally, Zynga's apps generate a significant number of pages on which we display ads from other advertisers."

</comment></comment></comment></comment><comment><USER17> <Interesting/> "Mobile" appears as risk factor in 2 instances.

 _\- Growth in use of Facebook through our mobile products, where we do not currently display ads, as a substitute for use on personal computers may negatively affect our revenue and financial results;_

 _\- Facebook user growth and engagement on mobile devices depend upon effective operation with mobile operating systems, networks, and standards that we do not control;_

<comment><USER18> They will be able to exert any control they want on the Windows Phone through Microsoft. Also, what prevents them from showing ads in mobile apps? They did a great work locking everyone out of functionality that would enable direct FB access, app developers can only access FB as an FB app, so no ad-less competition there.

</comment></comment><comment><USER19> I'm curious as to what facebook did to generate $382k of revenue in 2004. Seems like a great start for a company of their size at the time. IIRC, they didn't turn on ads for a while afterwards.

Link: [http://www.sec.gov/Archives/edgar/data/1326801/0001193125120...](http://www.sec.gov/Archives/edgar/data/1326801/000119312512034517/g287954g71g62.jpg)

<comment><USER20> Not sure about 2004 but I bought an ad on facebook in 2005. It was for a specific university and that was about the extent of the targeting if I remember correctly...

</comment></comment><comment><USER21> It looks like the accountant put in the perfect round figure of 1000 million for 2011 Net Income& then backed out all the other entries :) I used to do exactly that in my Accountancy 101 exams - Q.write the income statement for Acme Corp. What do you want Net Income to be ? XXX $. That means, TCO must be XXX - yyy, R&D must be XXX - zzz, and similarly back out everything else. Not saying they actually did that, just that seeing such perfectly round numbers reminded me of those exam problems.

</comment><comment><USER22> Key information on revenue is on page 50. 85% of revenue comes from ads, which grew 69% Y/Y mostly driven by user growth (39% Y/Y) and showing a bunch more ads starting Q4 2010:

2011 Compared to 2010. Revenue in 2011 increased $1,737 million, or 88% compared to 2010. The increase was due primarily to a 69% increase in advertising revenue to $3,154 million. Advertising revenue grew due to a 42% increase in thenumber of ads delivered and an 18% increase in the average price per ad delivered. The increase in ads delivered was driven primarily by user growth. The number of ads delivered was also affected by many other factors including product changes that significantly increased the number of ads on many Facebook pages beginning in the fourth quarter of 2010, partially offset byan increase in usage of our mobile products, where we do not show ads, and by various product changes implemented in 2011that in aggregate modestly reduced the number of ads on certain pages. The increase in average price per ad delivered was affected by factors including improvements in our ability to deliver more relevant ads to users and product changes that contributed to higher user interaction with the ads by increasing their relative prominence.

<comment><USER23> The key information is on page 54-55: Why the massive jump in Q4 2011 revenue over Q3? It looks like there is a seasonality factor, but their explanation only covers Q4 2010, to Q4 2011.

This is going to be a super volatile stock. If the Q1 2012 revenue is flat QoQ, this is probably a $50B company, if it is up 15%, then this is probably a $100B company.

<comment><USER22> I was actually most curious to see if they had developed a source of revenue other than ads. It seems like the answer to that is mostly no, although they are working on payments.

I agree that ads revenue growth will be key for them in the short term. The Q4 2011 vs 2010 growth was 44% and it seems like perhaps the growth rate is slowing down.

Of course they're not yet showing ads on mobile..

<comment><USER23> Given that Google has made a ton of huge bets but doesn't make a dime outside of advertising, it is hard to think Facebook will move the needle with an alternative revenue stream. Even if they hit a Groupon sized home run with an alternative revenue stream, it only moves the valuation by 10-20%.

I think on balance mobile is not really an opportunity. They are losing the game revenue to the mobile/tablet platforms and in-app mobile monetization is a minimal opportunity for a task based application.

I don't use facebook, but can you explain what it means to be working on payments? I thought that was just their taking a 30% cut on game payments on their platform. That kind of margin doesn't exist for more general "payments".

Even with all my negativity, I am still cautiously bullish on Facebook. They are only making 50 cents/month per active user. I see no reason they can't double that.

</comment></comment></comment></comment><comment><USER24> Zuckerberg's letter is really fantastic -<http://techcrunch.com/2012/02/01/facebook-ipo-letter/>.

I'm really proud of him for clearly and loudly representing the hacker way when the whole world is watching.

<comment><USER25> What makes Zuckerberg a hacker?

<comment><USER26> he made a website used by 800 million people?

You might not necessarily agree with the extent the word "hacker" is applied to nowadays, but considering you are in a site called "hacker news" you probably should

</comment></comment></comment><comment><USER27> Curiously, Sean Parker appears to not be on the top shareholders list[1], despite previously having a large %. Did he sell all of it on SecondMarket?

1\. [http://techcrunch.com/2012/02/01/facebooks-s-1-and-the- large...](http://techcrunch.com/2012/02/01/facebooks-s-1-and-the-largest- shareholders-who-owns-what/)

<comment><USER28> That's not a list of top shareholders (despite the headline). I think they only need to report the holdings of officers, directors, and anyone with more than 5%. Sean Parker does not fall into any of those categories, so they don't report his ownership.

<comment><USER27> Ah, that explains it.

</comment></comment></comment><comment><USER29> Facebook's revenue will eventually shift from display advertising to data selling. There will come a time when no display campaign will run without input from Facebook.

Before any impression on any online media, advertisers will make a query to Facebook to find out which of the ads should be shown to this user. And Facebook will charge a small fee for each such query.

</comment><comment><USER30> Wow.. $3.7 billion in revenues in 2011; $1 billion in profits. Out of curiosity, what were GOOG's revenue/profit numbers when they filed for IPO?

<comment><USER31> Looks like jacquesm lost a bet <http://news.ycombinator.com/item?id=689789> :).

<comment><USER32> To be fair, he said multiple billion in profit not revenue. Still has some ways to go.

<comment><USER28> The story was about revenue: <http://news.ycombinator.com/item?id=689712>

It's hard to believe that a fb board member could make more accurate revenue predictions than random people with strong opinions commenting on HN ;)

</comment></comment></comment></comment><comment><USER33> Interesting salary history: 100% raise over 2 years.

 _Molly Graham, the daughter of Donald E. Graham, a member of our board of directors, is employed by us. During 2009, 2010, and 2011, Ms. Graham had total cash compensation, including base salary, bonus and other compensation, of $98,058, $133,620, and $189,168._

<comment><USER34> I would think that is a fair compensation considering Facebook doubled its profits over that time also.

<comment><USER35> I doubt she was responsible for the doubling of profits. (And what of all the other employees...)

<comment><USER36> If you take a simplistic view of it, without assigning value to each person, doubling a person's salary is, while doubling profits, giving a raise that fits the success of the company, not a raise that says she played more or less than an average role within the company.

</comment></comment></comment></comment><comment><USER37> If you are logged on Facebook, never go on the website but still see the like- button that are scattered all around the web, do you count as an "monthly active user" ?

<comment><USER38> "We define a monthly active user as a registered Facebook user who logged in and visited Facebook through our website or a mobile device, or took an action to share content or activity with his or her Facebook friends or connections via a third-party website that is integrated with Facebook."

</comment></comment><comment><USER39> $1 Billion in profit => $1/(user year) in profit for 2011, correct?

That's pretty darn good money, but not a huge amount more room for user- growth. They'll grow by having new businesses/making current ones more profitable. New business would have to be monetizable (eventually, at least), current businesses would either have to convert better or become less costly to run.

Facebook is full of some smart cookies - it'll be interesting to see how they accomplish those paths.

<comment><USER16> I was thinking the same thing. Considering they have ~42% of all users (assuming the billion internet user estimate) there is only so much growth available from relying on their current model of acquiring users and serving ads to them.

I would imagine a next logical step would be to expand its ad network beyond facebook (i.e. serve facebook ads outside of facebook itself), it would allow for a significant jump in growth potential while staying close to their core competency.

</comment></comment><comment><USER40> As someone that lives in EU (as in, not in USA) and has no clue about stock market: what would be the easiest way for me to get a couple of hundred € worth of stocks in FB? Is that even possible?

<comment><USER37> You need to buy them on the day they IPO. You will not be able to buy it at the IPO price but at the price of the first minute of trading.

On top of that, "a couple of hundred €" is probably not enough money. The fees to buy stocks on the Nasdaq is usually in the tens of euro. You'll probably have between 10 and 50 euros of fees at the cheaper online trading platforms.

You can also call your traditional bank to buy the stocks but the fees would probably be higher.

</comment></comment><comment><USER41> Per the S-1 filing, Facebook did $1 billion dollars in net revenue in 2011.

A valuation of $80-$100 billion dollars after the IPO would mean Facebook would be trading at 80 to 100x earnings.

Facebook is going to need to see some serious growth to continue to command a PE ratio like that long term. _Serious Growth_

<comment><USER42> Alpha Centauri is an untapped market.

<comment><USER43> Think of all the arcane technology to recover from the ruins!

</comment></comment></comment><comment><USER44> The Letter from mark has to be the coolest part.

<http://theairspace.net/commentary/letter-mark/>

The Hacker Way has grown up and lambasted Wall St.

</comment><comment><USER45> Direct link to the text of the S-1:

[http://www.sec.gov/Archives/edgar/data/1326801/0001193125120...](http://www.sec.gov/Archives/edgar/data/1326801/000119312512034517/d287954ds1.htm)

</comment><comment><USER46> Looks like members of the exec team (COO, CTO, etc.) will _each_ be worth 100MM post IPO

Wonder what amt of RSUs the rank-and-file are getting?

Also, it'll be interesting to see how the culture changes when a good % of the populace are millionaires

</comment><comment><USER6> I put together a really quick valuation multiples analysis based on financial info from the S-1: [https://twitter.com/#!/daranda/status/164854828957310978/pho...](https://twitter.com/#!/daranda/status/164854828957310978/photo/1/large)

Disclaimer: This analysis is flawed

\- Using multiples is not a perfect method to understand the valuation of a business. It's one of many. It's a proxy. It's quick.

\- This chart uses 2011 financial data. Facebook is growing fast - <USER2> multiples would come down significantly if we used 2012 projections - which we don't have. If I had more than 10 minutes on this - I would use 2nd half of 2011 or Q4 2011 as a run rate.

Quick Thoughts (Not Conclusions):

\- In Ben Horowitz's argument against the bubble - he says the valuations they were seeing at AH for large private tech companies (like facebook) is in line with large public tech companies (google). So just looking at the data quickly, I was disappointed that FB appeared to have higher multiples (his blog post: [http://bhorowitz.com/2011/03/24/bubble-trouble-i- don%E2%80%9...](http://bhorowitz.com/2011/03/24/bubble-trouble-i- don%E2%80%99t-think-so/))

\- DAYAM FB has a crazy operating margin

\- And they're getting better at monetizing each user. User growth was 40% from end of 2010 to end of 2011, while revenue grew 80% ([http://allthingsd.com/20120201/facebook-has-845-million- user...](http://allthingsd.com/20120201/facebook-has-845-million-users/))

</comment><comment><USER47> So what % of the company are they selling off for $5 Billion? I'm wondering what they're claiming the whole company to be worth.

<comment><USER48> All of those numbers will be preliminary, they won't actually decide on number of shares offered and offering price (which determines their claimed valuation) until just before the offering. It depends on market conditions and what the large institutions say they're willing to pay.

</comment></comment><comment><USER49> "In the first quarter of 2012, our compensation committee discussed and approved a request by our CEO to reduce his base salary to $1 per year, effective January 1, 2013."

Awesome.

<comment><USER50> I never understood why management sometimes take $1 salary. Doesn't the IRS see that as non reasonable compensation?

<comment><USER51> CEOs are still paying taxes on their non-salary compensation.

<comment><USER50> So what exactly is the purpose or benefit?

<comment><USER52> Probably to receive stock options in compensation. Sergey Brin, Larry Page and Eric Schmidt have also done the same. They seem to be exempt from payroll taxes in the United Sates.

[1]: [http://www.sec.gov/Archives/edgar/data/1288776/0001193125060...](http://www.sec.gov/Archives/edgar/data/1288776/000119312506010016/d8k.htm)

<comment><USER53> Sometimes the explanation is more optimistic than that--sometimes the CEO is rich enough it makes little difference. E.g. John Mackey (Whole Foods CEO) switched to a $1 salary because he felt he no longer needed to work for money [1].

I mean, think about it: Mark owns over $10 billion in Facebook stock--he makes over a billion dollars by pushing the stock price up 10% (or loses over a billion if the stock drops 10%). Either way, a $15 million salary would be fairly insignificant...

[1] [http://www.businessweek.com/bwdaily/dnflash/content/may2007/...](http://www.businessweek.com/bwdaily/dnflash/content/may2007/db20070509_992600_page_2.htm)

</comment></comment></comment></comment></comment></comment><comment><USER54> I really wish everyone would stop talking about mobile access like it's this entirely new thing that's never been done before. Using facebook from a mobile device is absolutely, 100%, without room for debate using "the web". Sure it's a mobile device, but it's still HTTP and it's still a mobile browser based app. Just because it's not a "desktop" version of a browser does not mean the access isn't "web".

<comment><USER55> The issue with mobile is the limited screen real estate and the impact that has on being able to place ads. The mobile environment is different from the desktop environment, so it makes sense to distinguish the two. But you're right, calling the later "web" is a misnomer.

</comment></comment><comment><USER56> EDGAR keeps timing out for me, anyone know of a mirror?

<comment><USER57> <http://www.scribd.com/doc/80163402/Facebook-S-1>

</comment></comment><comment><USER58> I agree with what people say about a Facebook phone. They might offer a smartphone for a heavily subsidized price and/or a feature phone for free. They might even offer free unlimited data, the catch for either model (and the data) is the that you log in with Facebook first thing, and maybe they'll restrict you to using only Facebook services, like messenger.

</comment><comment><USER59> "We had 845 million monthly active users (MAUs) as of December 31, 2011."

That blows some estimates out of the water.

</comment><comment><USER60> The site is really slow for me, maybe it's getting overloaded or ... something else. Either way, could someone post a summary of the filing? If I remember correctly there should be some pretty interesting figures; revenue, profit and so on.

<comment><AUTHOR> Here's a screencap of the summary financial data chart:

<http://i.imgur.com/c5pHt.png>

<comment><USER61> Wow, thats pretty interesting; the earnings per share.

I would love to see that compared to users. Especially if new users flattened out somewhat compared to increasing revenues.

I am not sure, but I dont think that FB userbase went up by 4.5x in the same period as did revenues.

That means they are getting far better at monetizing the users/advertisers are willing to spend far more to advert to the users, than before.

</comment></comment></comment><comment><USER62> Filing a S1 when business is slowing down. Genius!

Subscriber rates have fallen and the future is filled with uncertainty. Let's go Public!

Google SYWP changing the game of advertising. Panic!

Exit strategy for investors to monetize their investments. Priceless!

</comment><comment><USER63> I wonder how many employees are going to ditch the company after it goes public. They might have stuck around just for the IPO so they can hit big, take the money, leave, and start their own companies.

<comment><USER64> They won't be able to exercise their vested options for several months (usually six, as I recall). And many won't have vested 100% yet. That keeps people around.

</comment></comment><comment><USER65> 3.711B in revenue and 3,200 employees at the end of 2011. That puts their revenue/employee numbers only slightly lower than Apple & Google, but beats Amazon. Impressive.

</comment><comment><USER66> An adsense product from facebook would be really interesting, but I am not interested in adverstising on facebook.com. Do they already have this?

</comment><comment><USER67> If they filed for an IPO today, how long will it be until their shares are actually available to an average investor?

<comment><USER68> Sounds like 2nd quarter, maybe May.

<comment><USER6> Technically, just cause you file doesn't necessarily mean you IPO. Depends how their roadshow goes. But yeah - prolly May

</comment></comment></comment><comment><USER69> Wow look at site 54, they pushed their revenue this year to a billion in December. How are they doing this?

<comment><USER6> 4th quarter, and December in particular, are usually huge in advertising cause of the holiday shopping season.

</comment></comment><comment><USER70> Reading this document makes me think Facebook don't know what's happening inside their own company. Facebook from all behavioural indications have been focused on maximizing short-term spend per advertiser rather than the long term revenue per user. Yet that doesn't seem to be reflected at all in their filing.

<comment><USER70> If you disagree with this statement I'd suggest you comment explaining why rather than just down-voting. Speaking as someone who bought over 35 million ads on Facebook last year, it's pretty evident that there's a mismatch between what Facebook are doing in practice and their view of what they're doing as portrayed by their SEC filing.

<comment><USER71> Rather than complaining about down-votes -- it would be awesome for you (who having bought a ton of FB ads knows that market really really well) to explain and justify your statement. Can you give us some examples of their short-term thinking?

<comment><USER70> It's pretty well known in the industry, for example they've long ignored requests for basic features (day-parting, A/B testing) that would improve conversion rates for advertisers because they would result in a short-term drop in advertiser spending even though making Facebook an effective advertising platform would be a better long-term solution (revenue wise).

<comment><USER71> Thanks.

</comment></comment></comment></comment></comment><comment><USER72> I just read through the entire S-1 before reading anything in the media about it. I liveblogged the tidbits I found interesting:

<http://hc8217.tumblr.com/>

</comment><comment><USER73> "Effective January 1, 2013, Mr. Zuckerberg's annual base salary will be reduced to $1."

In the business world, we can now call this "Doing a Jobs".

<comment><USER74> Or a Elon Musk, Sergey Brin, Larry Page, Mike Bloomberg..

<http://en.wikipedia.org/wiki/One-dollar_salary></comment></comment>


Ask HN: What is your preference for sketching layouts - <AUTHOR>

What software or process do you use when designing something new e.g. a new site or a procedure your users will be going through while using your software?<p>I use PowerPoint for creating layouts and pen & paper to visualize the interaction processes. <comment><USER2> I've used Balsamiq Mockups in the past and it's been absolutely swell.

</comment><comment><USER3> Paper and pencil. Don't constrain yourself with tools.</comment>


Simplicity and the ideas Go left behind - <AUTHOR> https://sourcegraph.com/blog/live/gopherconindia/111854129512 <comment><USER2> One thing that I've appreciated now that I've spent a decent amount of time writing Go as an individual developer is that it's much easier to jump into open source code and make small improvements and fixes because the language is very "context-free." When you're reading code, the control flow is always spelled out, property accesses never magically invoke getters, and it's generally hard to make things too complicated. There are things that annoy me but the downside is almost always bounded.

<comment><USER3> Code readability is the original intent behind striving for simplicity.

Though I find some of the design choices a bit frustrating, e.g., generics, lack of min/max; for each design choice I disagree with there are _dozens_ of other choices I _do_ agree with. Structural typing, built-in concurrency, a rich standard library, the syntax, the list goes on.

There is a certain brutal elegance to the way the Go standard library is designed, it is really easy to read and comprehend. It took me less than half an hour to make sense how the net/http server was implemented.

This doesn't only apply to the standard library: because the language style is standardized--there are no coding styles, there is just _a_ coding style-- other libraries or programs are very easy to understand. If the program architecture is easy to understand, it doesn't require any significant domain expertise to understand.

Languages aren't supposed to be cargo cults, though some culture can be _nice_ , let's not kid ourselves: programming languages are means to to an end. Go is pragmatic, it gets things done, it is a tool, and most importantly, it doesn't get in the way of design or architecture. You are free to build programs in any style or way you want.

Ultimately, languages are just expressions of grander designs that are far more important than arguments for and against a particular syntax or language feature.

</comment></comment><comment><USER4> This oversells golang's simplicity I think. Not a lot, but enough to rub me the wrong way a tiny bit.

\---

> Go programs are built from just their source, which includes all the > information needed to fully build the program.

Still have to deal with GOPATH, vendor your dependencies, and have everything a `go generate` comment wants to invoke. It's _certainly_ better than makefiles, but it's hardly just the source.

> C# is joined at the hip with Windows. Objective-C and Swift are for Apple. > Java and Scala and Groovy might benefit from JVM bytecode and its > independence… until you realize that Oracle isn't interested in supporting > Java on anything other than Intel hardware.

C# has Mono, you can use Objective-C with gcc, the JVM has a bajillion implementations. I suppose Swift is more or less unportable at the moment. 1 out of 4 ain't great.

> Go is helping pioneer a command-line renaissance that reintroduces a > generation of programmers to the idea of writing tools that fit together > like segments in a pipe (the original Unix philosophy).

This never went away. Heck we were going over this in college, which for me was in Scheme, Java, C, and C#.

<comment><USER5> I like the fact that the Go guys continue to avoid talking in detail about Rust and Clojure.

That tells me that the don't think they can win the comparison.

<comment><USER6> The core goals behind Rust and Clojure are very different from those behind Go. This article/presentation would not be appropriate for those languages. I don't think anyone would say that Rust or Clojure are simple languages, or that simplicity is a core goal for them. Rust's core goals are performance, memory safety, and lack of race conditions (AFAICT). And clojure is a LISP which puts it in its own category, really.

It's like saying a jeep can't compare to a ferrari or a minivan - other than having 4 wheels, they're really not at all designed to do the same kinds of things... Sure, maybe driving to the corner store they're all pretty much the same, but which do you want in 8" of mud? Which do you want in a car chase on the highway? Which do you want to bring your 4 kids to soccer practice?

<comment><USER7> > Rust's core goals are performance, memory safety, and lack of race > conditions (AFAICT)

We usually formulate this as "memory safety without garbage collection," which has secondary implications on speed and concurrency, but yes. (Also, 'data races' rather than 'race conditions,' technically).

<comment><USER6> Thanks for clarifying :) Yes, I should be more careful about specifying data races vs. race conditions :)

</comment></comment></comment></comment></comment><comment><USER8> Consider the following:

it is actually more difficult to code in a language that's simple

Why? Because a more feature-complete language allows you to ELIMINATE the concept of `nil` through an `Option` type.

An `Option` type is an `enum` that consists of either `Some(x)` or `None`. That means it is always checked. You can never accidentally use a value that is `None` because the type checker would not let you use `Option<T>` instead of `T` itself.

The code snippets on the websites are far from simple. You HAVE TO remember to do `if err != nil` in every single function. A more advanced type system would actually make this a requirement.

So what is more important, the simplicity of the language or lack of bugs?

<comment><USER9> Go depends on tools to check correctness that type system doesn't cover. Check, [http://blog.golang.org/error-handling-and- go](http://blog.golang.org/error-handling-and-go) and [https://github.com/kisielk/errcheck](https://github.com/kisielk/errcheck)

<comment><USER8> That's the answer for everything in the Go community. More ad-hoc tools to replace the type system. Have concurrency bugs? Use a tool that detects some types of data races. Have problems with errors? Have a tool that detects not checking for errors.

How is approaching every single problem with a different tool more simple than using the type system as the one tool for static checking? The Go ecosystem is creating a ad-hoc, informally-specified, bug-ridden, slow implementation of half of the type checker of Haskell.

<comment><USER10> The jury is out on whether, for large time frames and for large communities, having a centralized type system is better than having a decentralized set of independent tools.

I'm not very excited by GHC's model of language extensions, [https://downloads.haskell.org/~ghc/6.12.2/docs/html/users_gu...](https://downloads.haskell.org/~ghc/6.12.2/docs/html/users_guide/flag- reference.html#id598783). And in spite of the large number of Haskell extensions, there are still pragmatic niches that aren't covered, see for example Rust's encoding of memory management in the type system.

In a sense, GHC contains a ad-hoc, informally-specified, bug-ridden, slow implementation of half of the type checker of Coq ;) Which is to say that there are many flavors of sophisticated type systems, and it's not clear which flavor is most conducive for writing good software on a tight time budget.

</comment></comment></comment></comment><comment><USER11> This answer is slightly infuriating:

> Q: Lack of generic collection classes like in Java's Guava library?A: For > 90% of cases, slices and maps do what you need. For the other 10%, you might > consider whether your package should own the logic of those special > containers, instead of using an external package.

I read this as:

"We're not willing to put in the hard work on thinking of a decent generics implementation, despite decades of working solutions with a myriad of choices in tradeoffs, so you'll have to do the hard work of integrating a dozen different collections libraries and who knows how many different, after-the- fact, mediocre strategies to the generics issue, each slighly off, all of them conceptually incomplete somehow, and with the slight bugs that come from not having a well-trodden path for an essential component of most programming languages."

<comment><USER12> I am not a member of the Go team, just a contributor. I represent only my own opinions, please don't put words into my mouth.

<comment><USER11> This is my own personal opinion on core dev's position and no one else's, but to me generics and dependency management have always been the pink elephant in the room.

I can wait for features; I'm patient. But the downright refusal of Go's core team to even begin to address this issue is not just a technical problem, but a communications one. This is clearly big for a lot of people, and I have yet to see any serious responses aside from either "you domain model's wrong if you need generics" or "deal with it".

In contrast (just picking this language for its community outreach, not because of any perceived technical competition), Rust's core devs have been forthcoming about practically _every_ objection they've gotten. Their answers are clear, detailed, not demeaning, and constructive. When they don't know, they're honest about it, and when answers are hard, they take the time to explain. But I have _never_ heard of anyone being belittled for not understanding lifetimes or the borrow checker.

Yet it seems that somehow if I have a bone to pick with Go not being able to dispatch functions by argument or arity, or with how its simplicity ends up with codebases a lot of people would consider much more verbose than necessary, it's just that I don't "get it". The problem isn't even in the accusation; I just don't even receive examples or reasonable explanations, something I'm used to in related language discussions.

I was willing to give the language a pass on these things when it was just getting started and a lot of the classical, early product criticisms were abound. But it's gotten tiring; the number of unanswered questions is remarkable by now.

<comment><USER13> Several members of the Go team have put a lot of time into studying and prototyping various implementations of generics.

If you look through the mailing list archives you will find many emails from Ian Lance Taylor on the topic.

<comment><USER11> I'll be completely honest: it's one of the most BS reasons I've ever read in a technical discussion.

How can we talk about high performance when:

* The current "generics" mechanism (interface et al) does runtime introspection, which is just about as slow and unwieldy as it gets * There is no option for pervasive, truly high-performance data structures since everything is a map (which comes with its own type parametrization as an exception to everything else), and if you don't like the hashing algorithm, tough luck. * You have a garbage collector running in the background, which is barely tunable compared to the options other runtimes have

Talking about performance when it's convenient as an argument against generics but disregarding the other holes in the language is not reasonable, because I would say that the choice of implementation for native maps is probably far more important for high performance. Yet here we are, no one complaining.

So we can really discard the performance argument, thus there is now an ample, valid set of choices for generic programming, several of which don't go against the goals of fast compilation.

Speaking of fast compilation; pretty much everything is going to be faster than C++ templates, since the entire compilation chain in C++ is slow.

<comment><USER13> It would be unreasonable to have designed a generics implementation into Go 1 that did not cover the builtin polymorphic map, slice, and append. A simple set of orthogonal features is an important principle in Go.

For these, performance is most certainly critical.

</comment></comment></comment></comment></comment></comment><comment><USER14> It is interesting that the OP things that static binaries is related to being born in Google. The thing is that Plan9 doesn't have shared libraries, all binaries are statically linked. And the reason for this is that plan9 is a networked operating system, needing to load multiple files at runtime would severely harm startup time for a binary.

Run trace on a Linux binary and see the slew of "file not found" errors from syscalls looking for shared libs at startup and then imagine each one of these is taking place over a 9600 baud connection.

Good design realises benefits that authors never needed to consider.

<comment><USER15> Static binaries used to be common, the normal way of doing stuff. People tend to think that package management killed them, but it was actually glibc which cannot make proper static binaries as it insists on dynamic functionality for some functions, such as name resolution. Now we have Musl libc there may well be a revival in static binaries from C applications, and the C-derived ecosystem.

<comment><USER14> As a demonstration I traced date(1) on CentOS. Here are the file accesses, if you are running diskless, each of these needs a round trip to the file server. (except the final 3, of course)

access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory)

open("/etc/ld.so.cache", O_RDONLY) = 3

fstat(3, {st_mode=S_IFREG|0644, st_size=54185, ...}) = 0

close(3) = 0

open("/lib64/librt.so.1", O_RDONLY) = 3

read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@!\0\0\0\0\0\0"..., 832) = 832

fstat(3, {st_mode=S_IFREG|0755, st_size=43880, ...}) = 0

close(3) = 0

open("/lib64/libc.so.6", O_RDONLY) = 3

read(3, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p\356\1\0\0\0\0\0"..., 832) = 832

fstat(3, {st_mode=S_IFREG|0755, st_size=1921176, ...}) = 0

close(3) = 0

open("/lib64/libpthread.so.0", O_RDONLY) = 3

read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340]\0\0\0\0\0\0"..., 832) = 832

fstat(3, {st_mode=S_IFREG|0755, st_size=142640, ...}) = 0

close(3) = 0

open("/usr/lib/locale/locale-archive", O_RDONLY) = 3

fstat(3, {st_mode=S_IFREG|0644, st_size=99158576, ...}) = 0

close(3) = 0

open("/etc/localtime", O_RDONLY) = 3

fstat(3, {st_mode=S_IFREG|0644, st_size=3661, ...}) = 0

fstat(3, {st_mode=S_IFREG|0644, st_size=3661, ...}) = 0

read(3, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\7\0\0\0\7\0\0\0\0"..., 4096) = 3661

lseek(3, -2338, SEEK_CUR) = 1323

read(3, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\10\0\0\0\0"..., 4096) = 2338

close(3) = 0

fstat(1, {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 0), ...}) = 0

write(1, "Tue Feb 24 08:57:58 GMT 2015\n", 29) = 29

close(1) = 0

<comment><USER15> Ok, here is strace of date(1), which is dynamically linked, on Alpine Linux which uses Musl libc not glibc.

execve("/bin/date", ["date"], [/* 16 vars */]) = 0

mprotect(0x7777dcd5a000, 4096, PROT_READ) = 0

mprotect(0xdc2d89a3000, 4096, PROT_READ) = 0

arch_prctl(ARCH_SET_FS, 0xdc2d89a4268) = 0

set_tid_address(0xdc2d89a4298) = 2439

clock_gettime(CLOCK_REALTIME, {1424769563, 611556639}) = 0

open("/etc/localtime", O_RDONLY|O_NONBLOCK|O_CLOEXEC) = 3

fstat(3, {st_mode=S_IFREG|0644, st_size=118, ...}) = 0

mmap(NULL, 118, PROT_READ, MAP_SHARED, 3, 0) = 0x7777dcd57000

close(3) = 0

ioctl(1, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, {B38400 opost isig icanon echo ...}) = 0

writev(1, [{"Tue Feb 24 09:19:23 UTC 2015", 28}, {"\n", 1}], 2Tue Feb 24 09:19:23 UTC 2015 ) = 29

close(1) = 0

close(2) = 0

exit_group(0) = ?

+++ exited with 0 +++

<comment><USER14> That is worlds apart.

<comment><USER14> OpenBSD's ktrace is similar

31144 date CALL readlink(0x3c001c16,0xcfbe7048,0x3f)

31144 date NAMI "/etc/malloc.conf"

31144 date RET readlink -1 errno 2 No such file or directory

31144 date CALL open(0x3c001967,0<O_RDONLY>)

31144 date NAMI "/etc/localtime"

31144 date RET open 3

31144 date CALL open(0xcfbde9d4,0<O_RDONLY>)

31144 date NAMI "/usr/share/zoneinfo/posixrules

31144 date RET open 3

<comment><USER15> Yes, in many ways Musl is a BSD style libc for Linux (even down to the license). Add pkgsrc and it is pretty BSD-like.

</comment></comment></comment></comment></comment></comment></comment><comment><USER16> > until you realize that Oracle isn't interested in supporting Java on > anything other than Intel hardware.

Oracle does support the JVM on embedded hardware. It's right here: [http://www.oracle.com/technetwork/java/embedded/embedded- se/...](http://www.oracle.com/technetwork/java/embedded/embedded- se/downloads/index.html)

Also since when was Oracle the only JVM vendor. There are plenty of others that support different hardware: [http://en.wikipedia.org/wiki/List_of_Java_virtual_machines](http://en.wikipedia.org/wiki/List_of_Java_virtual_machines)

And finally since when has the choice been between slow, interpreted languages and fast, compiled ones ? Plenty of options exist in the space between.

</comment><comment><USER17> I'd argue that in most cases "easy > simple" with the definitions of Rich Hickey. Easy means you understand it quickly. Simple means it uses few concepts.

Go doesn't want to use the concept of generics. However, if your code uses "List<IP>" instead of "List", it is easier to understand, because it additionally tells you it is about IPs. Python is a language which tries to be easy by resembling pseudo code.

If you really want simple, you could as well use SML, TCL, or Lua.

<comment><USER18> > If you really want simple, you could as well use SML, TCL, or Lua.

And if you truly _want_ simple, you use Smalltalk, Scheme or Forth.

<comment><USER19> I dunno about smalltalk, but Scheme and Forth start off simple until a programmer writes tens of thousands of lines of code, at which point it gets harder to read and follow the code exactly.

<comment><USER17> No matter how much convoluted code your write, it is still a "simple language". Your code however is not necessarily simple or easy.

<comment><USER18> That tends to be the flip side of the "simple language".

And at least the 3 languages quoted are so simple that they _must_ provide the tools for building new abstractions (which are the tools for building the language in the first place), so you can cut down on code by building a reusable toolbox of abstractions.

Go is complex enough that they can get away without that, and even get praised for pushing the complexity to userland code and providing no way for users to manage that complexity.

</comment></comment></comment></comment></comment><comment><USER20> >He currently works at Canonical, where part of his work involves porting Go to ARM 64.

That's interesting. Has Canonical stated what their interest in Go is?

<comment><USER21> Probably something to do with Docker...

<comment><USER22> IIRC, Canonical joined the go community around 2010/2011 when docker has not been created. They are actually one of the early adopters of Go. Some major projects from Canonical using Go are juju[0], mgo[1], etc.

0\. [https://juju.ubuntu.com/](https://juju.ubuntu.com/)

1\. [https://labix.org/mgo](https://labix.org/mgo)

Edit: format.

<comment><USER23> Also go-qml

<comment><USER16> Interesting.

Perhaps Go becomes the language for Ubuntu Phone apps ?

<comment><USER6> I believe that is an intended purpose of go-qml, yes.

</comment></comment></comment></comment></comment></comment><comment><USER24> I was using Go recently and I ran into some simplicity issues. It is not straightforward to create a map of net.IPs or manipulate netmasks. You will have to copy to and from a separate array/integer.

<comment><USER5> Congratulations. Welcome to why you _don 't_ use Go.

Lack of generic access to data structures is one of their bigger fails.

However, they don't see it that way. One point of Go was to prevent needing to describe things before being able to compile it. Most things that people regard as "failures" in Go were deliberate choices to enable large codebases.

<comment><USER25> No, that's not why you don't use go. What the parent comment is dealing with is the fact that you can't have maps keyed by a net.IP, which is implemented as a []byte. Byte slices are not valid keys. This isn't really about generics.

<comment><USER26> It is _very_ much about polymorphism and generics.

</comment></comment></comment></comment><comment><USER27> Would we be better off if the big Apache projects were written in Go instead of Java? Would that have been harder (starting today, say)?</comment>


Ynet.co.il - Israel's largest news website under attack by Arab hackers - <AUTHOR> http://www.ynet.co.il

<comment><USER2> Another one of Israel's largest site is also currently under attack: <http://calcalist.com></comment>


Help heart failure patients and hack for $40,000 in prizes this weekend in SF - <AUTHOR> http://novartis-mhealth-challenge-sf.eventbrite.com/?discount=mashery-friends

<comment><USER2> Had to read it a few times to figure out what was going on. tl;dr: Pay $5 to build other people's ideas with the opportunity to win up to $15,000 (Novartis' revenue was $56B in 2012 [1]).

      How It Works
      • Brands present their business challenge.
      • Companies and developers create solutions over an intense weekend.
      • On Sunday, an all-star judging panel will score the top 3 mobile solutions and the winners will be announced.

[1]: [http://www.novartis.com/downloads/investors/reports/novartis...](http://www.novartis.com/downloads/investors/reports/novartis- annual-report-2012-en.pdf)</comment>


Total Political War - <AUTHOR> https://amgreatness.com/2018/03/23/total-political-war/ <comment><USER2> This is just a pendulum swing. If you remember situation 20 years ago, greatest complaint about U.S. politics was opposite - 'all politics is fake because political standing of Republicans and Democrats on most issues is same, so we have a choice with no choice'. And indeed most people couldn't even explain the difference - because there was almost no difference.</comment>


NYTimes.com daily uniques down ~40% since paywall implementation - <AUTHOR> http://trends.google.com/websites?q=nytimes.com&geo=all&date=all&sort=0

<comment><USER3> Keep in mind that most ad funded sites on the internet have excess unique/impression inventory, even 40% excess at times. So there are three numbers to consider here:

1) Increased subscription revenue

2) _Sold_ inventory they've lost

3) Effect on pricing of remaining inventory

Oddly enough, a site like the NYT might be able to make more money off ads with less impressions (#3 up there). There are two reasons for this, the first is their brand value. People want their ads on NYT, scarcer supply means they'll have to pay more to do that, and some of them will.

The second is a change in demographics. I would guess that the lost traffic is disproportionately less valuable demographics. I, for instance, am not a great demographic for advertisers. My dad is, though, and NYT is still getting his impressions.

As an example of what this might mean, imagine that anyone who made less than, say, $150k/year stopped visiting Reddit. They'd lose a huge amount of traffic, but the value of the remaining traffic would make their sellable demographics outstanding.

<comment><USER4> I did _not_ know about the excess inventory. Do you mind posting a source?

It just seems like someone would be willing to pay $0.001 CPM at least for those impressions...

(edit: this HN post, interestingly enough, seems to be the top of my google searches for this :p)

<comment><USER3> I'm the source! Although you can identify excess inventory on sites if you know what to look for and pay enough attention. Browse around the NYT site and you'll see ads for the NYT, Google Adwords, and probably Google display stuff. This is excess inventory, usually. Ads for your own company are called "house ads", the others are generally referred to as remnant inventory.

Now, someone will almost always pay $.001/CPM to serve ads, but it's usually not a great deal for a publisher. Ad serving costs are higher than you'd expect, a pageview might end up requiring calls to 10 paid ad tech services for instance (demographics, audience categorization, etc). The NYT is likely losing money when you see remnant advertising, they'd be better off not serving that impression at all.

There are also a number of companies that just won't run remnant stuff, or won't run ads for reasonable sounding CPMs. Conde Nast, for instance, has fixed CPMs that their sales people can't bend from much. They feel that selling for cheaper would dilute their value. Some of the properties even feel like cheap looking remnant ads make the site seem less "premium".

The last sentence here is pretty telling: "since the site had excess ad inventory pre-paywall, the decline won't affect the ability to satisfy demand for premium units".

[http://blogs.forbes.com/jeffbercovici/2011/04/21/ny-times- sa...](http://blogs.forbes.com/jeffbercovici/2011/04/21/ny-times-says- paywalls-working-100k-subscribers-and-counting/)

</comment></comment></comment><comment><USER5> Has the NYTimes.com paywall really influenced someone who read the website previously? When I'm browsing from chrome, I justly click Cmd+Shift+N prior to going there (launches incognito mode in chrome with a fresh set of cookies.)

When I'm browsing from my iPhone, I just click the little "x" at the top of the screen to stop the javascript from loading after the content has been downloaded - basically stops my iPhone from loading the paywall code, but loads all the content.

I always thought the paywall was really just to prevent the print subscribers from canceling their print subscription and switching over to web only - <USER2> convinces them they are getting value with their subscription. The Paywall itself was left deliberately leaky for people who only connected to it via the web.

But, based on the stats, it looks like there may be a large audience of casual subscribes that have been deterred from visiting the website - I'm sure that must be troubling for the NYT.

<comment><USER6> At $3.75/week it was less hassle for me just to pay up. Strangely I also noticed that I actually read a few more articles per week now that I'm paying for it. It's a great paper. I don't understand the aversion to spending a little bit of money to get a bunch of good content.

On a side note, the Android app used to be horribly buggy but a recent update seems to have fixed the issues. Anyone who was turned off before may want to give it another shot.

<comment><USER7> I think the aversion is that with the growth of the internet, news is becoming (or already has) commoditized. People look at the articles in the NYT and they don't see original journalistic content, they see something they can get from 50 other sites thru Google News. If the NYT wants to survive, they need to get back to their journalistic roots and increase the value proposition to potential customers...it has to be more than just "it's less of an inconvenience to just pay us."

<comment><USER6> The commenter I was originally responding to said that he switched to incognito mode or halted the page load to break through the paywall. If the NY Times had the same value as any other non-paywall site, why would he go to the trouble?

The NY Times is a good paper. The writing is good and I think the breadth of coverage is good too. They have started adding videos. Their interactive infographics are probably the best on the Internet. NYT stories frequently hit the frontpage of HN, probably more than any other U.S. newspaper website. What do you think they should do to increase the value of their content?

<comment><USER8> I can easily see myself bothering with a few seconds of technical effort to get to a sub-par page. That page has the specific thing I happen to want to look at, but that itself doesn't mean it's very good. If quality was all that mattered people would only visit one site, the best one.

</comment></comment></comment></comment></comment><comment><USER9> As a former NYT developer (I left a month ago) but still in touch with my colleagues I can say there is a drop in Uniques and Page Views.

However, nothing like 40% and also within the internal predictions as far as I can tell.

I don't know that the Subscription policy is a run-away success for the NYT but it's certainly doing well.

I say this as a person who originally thought it was a bad idea.

</comment><comment><AUTHOR> Interestingly, Google should still be counting those who click through to a NYTimes article, hit the paywall, and bounce. So the 40% drop is the result of 1) users not clicking NYTimes links anymore, or 2) fewer NYTimes links being presented to users, perhaps due to a drop in SERPs.

I'm a datapoint of only one, but #1 above certainly applies in my case. I find myself much less likely to click through, especially on my mobile device, because I'm annoyed when I find myself above the monthly free limit. After hitting the limit a couple of months, I just stop clicking thru in the first place.

<comment><USER10> That has always been the biggest question for me: how many don't? There are bounces from content, and there are bounces from commercial barriers: paywalls, subscription modals, "give us your email please" modals (really, blocking modals of all kinds), "install our android app (or continue to site)"...I doubt any site is passing out their failure rates for these business decisions.

</comment></comment><comment><USER11> Since when is Google Trends reliable enough to make valid assumptions about the visitor statistics of a website?

</comment><comment><USER12> Uniques are down, but I'm wondering how much subscriptions have gone up (if at all)?

I'm also wondering how many of those 'dropped' uniques are scrapers, quick bounces, etc?

</comment><comment><USER13> Something I find interesting to ponder is the value of brands in journalism. The NYT has a great brand and I'm sure most people would associate it with quality journalism.

Whatever the outcome for this paper (paid subscriptions and higher cpms or the opposite), I'm more interested in all the other mastheads out there with less brand equity.

As a guess I think most people will be more comfortable handing over their hard earned to WSJ or NYT than they will to their local rag.

So paywalls IMHO spell doom for all the other papers who don't have the same brand equity / reputation.

Would you pay $3.95 for your local paper before handing it to NYT or WSJ?

My 2c :)

</comment><comment><USER14> I'd highly recommending the documentary "Page One" that just came out, which is about the NYT. It really makes you appreciate the work they do.

I know we laugh at their attempts to make money online, but that fact is that it would be a huge loss if they weren't able to continue to do their work.

</comment><comment><USER15> I am guessing that they knew their traffic would decrease. What we probably won't know for a while is whether the decreased ad revenue, as a result of fewer impressions, is greater than the increased subscription revenue. Assuming subscriptions have increased.

</comment><comment><USER16> Are they making more or less money?

[http://seekingalpha.com/article/264920-the-new-york-times- ce...](http://seekingalpha.com/article/264920-the-new-york-times-ceo- discusses-q1-2011-results-earnings-call-transcript)

<comment><AUTHOR> Q1 2011 revenues were down 4%, but since the paywall didn't launch until mid- March, we'll have to wait until the next quarterly to learn the full early results of the change.

</comment></comment><comment><USER17> Yes, but how much is their profit down?</comment>


Ask HN: Off-Grid Small/Personal Solar Solutions - <AUTHOR> I need an off-grid solar kit that can generate enough energy on average each day to power: a Macbook for at least 5 hours, a router for at least 8 hours, and  a single desk lamp overnight.<p>Any recommendations? <comment><USER2> Calculate power draw:

A Macbook is 85W of power max, a router likely ~20W, and a single desk lamp is maybe 60W if you're a barbarian (seriously get a better bulb than that, though).

85W x 5 hours + 20W x 8 hours + 60W x 8 hours = 1065Wh

Obviously your Macbook doesn't draw 85 at all times, nor does your router but it's always good to have the leeway.

Now assuming a Lithium battery (which the newer AIO kits generally have), you'll be able to get 95% use of the battery in your solar kit. So say you get a 100Ah battery...

12V x 100Ah x .95 = 1140Wh

So that battery would be fine.

For charging, if you had a 100W solar panel, which gets say 60% for 6 hours a day efficiency since we don't know where in the world you are, you'd be able to charge...

100W x .6 x 6 hours = 360Wh, or 30Ah of your 100Ah battery per day. Use a kill-a-watt to use real numbers to find out if 100W of solar is enough for you and up that part of the kit if it isn't.

Something like this should do you fine - [https://www.goalzero.com/shop/kits/goal-zero- yeti-1000-lithi...](https://www.goalzero.com/shop/kits/goal-zero- yeti-1000-lithium-power-station-boulder-100-solar-kit/)

Assemble yourself and it'd be a bit cheaper.</comment>


Ask YC: Any newbie coders? - <AUTHOR>

About a year ago I started reading PG's essays and one thing that stood out was him saying 'if you don't know to code, learn to'. Since then I have had my head immersed in html/css/php/msql and nearly have something that works, looks good but would have probably cost me upto $10,000 (give or take) to create.
I just saw another post by someone that made an elearning site who has only been learning to code for 9 months.
Are there any newbie coders here? if so, have you got an app. and what language did you learn in?
I struggled with Ruby to begin with so moved onto php and found it a much easier language to get going on. Some people said to start with Python, i'd be interested in what  more experienced developers think are good languages to start off in, also any useful tips or resources for the newbie coder.
Cheerio.. Will <comment><USER2> I'm 18 and have worked for three startups in the past and am currently the lead designer on two. I really don't mean to brag by this, it just leads to my next point. Also, this doesn't fully pertain to programming per say because I am a front end designer, but hopefully this comment helps :)

When I was younger, 14 or so, I really became fascinated with server technology, databases, the web, etc... I was just starting High School so I essentially had all the time in the world to dick around with linux and php and all of that jazz, and I did. I was REALLY frustrated until maybe 6 months ago with programming in general. I would try tutorials, and could follow along and do what was written, but it never made sense in my head.

I pretty much dismissed the concept of being a programmer and stuck to what I feel is my talent, front end design. I build blogs atop Wordpress, dabbled with PHP, but never really became a programmer.

In the summer of 2006 I joined my first startup and began working with a team of really, really talented and smart guys on a Django site. This is where I was first introduced to a real smart environment. I was in a place where I knew just enough to ask good questions to help me learn. It's now 2008 and although I am STILL not a programmer, haha, I feel I have a really good grasp on database modeling, basic functional programming, etc... I know PHP fairly well and am becoming familiar with Python because every major site I have built since that first startup in 06 has been Django :)

Anyways, moral of the story is, a few years ago I could have never even dreamed of being where I am today. In the world of front end design _and_ back end programming. I went from looking up to designers like Bryan Veloso, Steve Smith, Dan Cederholm, to actually feeling like I can sit at their lunch table and talk the talk with them. I still admire those guys of course, but now I feel like I am closer to them.

So, my advice is to just dive into anything you can, just like you have. It really doesn't matter what language you learn first. Focus on learning the thought processes behind building something. You can write a book in spanish or english, the meaning will be the same. So focus on problem solving, finding solutions.

Also, surround yourself with smart people. Stay passionate. If you're passionate about becoming a programmer, you will, and you'll do it the right way. The best way to learn something, hands down, is to just do it. Don't try learning PHP through tutorials on how to make a shopping list, start learning PHP by building the webapp you want to build :)

This all kind of just spewed out of my mind, I hope it makes some sense :)

<comment><USER3> I've been coding for ages now, but I still feel like a beginner. There's always new stuff to learn. :)

I'd agree with this advice: be passionate about what you do and keep on building stuff, it's the best way to learn.. not only that, try to think about what you're doing and why. It's better (and more fun!) to actually understand how things work.

Learning from smart people is also a great way to learn.. it can be hard to find these people though. I'm tipping this is a good place to find smart/talented people. I think you're in the right place. :)

</comment></comment><comment><USER4> I started coding around 9 months ago, so it might have been me blabbering on about that.

I did the html/css/php/msql with the addition of some javascript thing as well, primarily because it seemed like the easiest thing to do, and because I could get results fast. Which I did.

I find it to be great fun, particularly the fact that I now can mock-up whatever ideas I have without having to convince someone else that it is a great idea.

I'm currently doing an online project management tool, which I think will turn out pretty well. Particularly since I am normally a manager, so I know what functionality it needs. I've run into some database problem, which I have learned is called EAV (<http://en.wikipedia.org/wiki/Entity-Attribute- Value_model>) that I'm currently trying to solve. Not all that easy, but a great learning experience.

</comment><comment><USER5> One PhD CS candidate (a friend of mine) once told me "It's all about controlling your frustration. Each day I come across at least half a dozen things that I don't know. I'm still learning". He later dropped out :) That said, as others have pointed out, it's all about passion, measuring progress and good execution. It won't happen overnight but some day it will.

<comment><USER6> I totally identify with this; I've been coding for over 10 years and the only thing that has been truly consistent about my experience has been that frustration with my inability to learn everything I want to learn. I have a stack of books to read that would probably be as tall as me, a gaggle of programming languages I want to learn, and 3-4 languages I want to be an expert in.

That doesn't include the math, Bible scriptures, Chinese, Gaelic, and carpentry I want to learn.

Persistence. What else is there, until the Matrix-style skull-jack gets implemented?

<comment><USER7> I have the same problem! How do you deal with it? Whenever I'm exposed to a new thing I want to learn, I ask if it's something I can and will apply relatively immediately, or something I'd learn only to incorporate it into my 'zombie plan' (or any other unlikely contingency). If it's for the far off future, I stick a pin in it and come back if the urge becomes more than a whim.

Also, I try to limit the time I spend ingesting info (discounting recreation) to about 20% of the time I spend creating.

<comment><USER8> I had this same problem for quite a while. I had force my mind to accept that I probably didn't pick up everything the first time around. I didn't let that stop me in my tracks. I simply went onto the next thing. Eventually, something would come up, usually a compiler error, that would force me to flip back to some section I have previously read. I would find out what was causing the error and fix it. I have stopped trying to learn it all, and instead I read once and then reread only what history has pointed out I failed to pick up on the first round.

</comment></comment></comment></comment><comment><USER9> Yeah, I'm new to web development and I'm 26... I started reading about php/mysql in January, and began developing my first application in February, and I'm about a month away from being able to launch it.

I didn't start from scratch though -- I knew visual basic for applications from my MS Excel jockey days, and took a couple of java courses in undergrad. Those give you the underpinnings behind programming logic, which extends to other languages pretty easily. Making my VB skills transfer into PHP and web development has been satisfying. It feels like I'm actually creating for the first time.

I had exposure to the 'online environment' at an internet startup for a year prior to this as well, which probably made the environment a little less mystifying.

One insight I'll give you is that I learned more in a week of sitting and coding than I did in the month of reading 3 hours a day. Try stuff out, test it, see what works and understand what your natural tendencies are and your common mistakes. Ask for help when you need it, but never avoid a sticking point, always push through.

</comment><comment><USER8> I would consider myself to be relatively new to coding. I can read code in almost any programming language, however, I have never been involved in a large scale project. I just never could find the time to get involved with something that would take longer than a weekend to work on; that is my own fault. Now that I am unemployed (I resigned to move back to Ohio due to the cost of living in Rhode Island) and have no hope of finding a job in finance anytime soon due to the credit crunch, I have decided to pursue a second undergraduate degree. I will be working on a computer science degree at Bowling Green State University in Ohio. I hope to use my time there to get a team together for early 2010's YC.

</comment><comment><USER10> I started coding a couple of years ago with Java for a desktop app. I really didn't know where to start, so I picked it because it was available. I dabbled in web stuff to have a web site (css, xhtml, php, a little mySQL), and now I am back to that as I need a much better website in order to start marketing.

I still feel like a newbie, though.

<comment><USER8> Many people will probably disagree with me on this, but I found Head Start Java to be a good introduction to Java. I picked it up when I wanted to learn the language. I started a program that focused on drilling a user in Jeopardy questions (I have a huge fascination with Jeopardy), but I didn't really like Swing, so I have added the project to my long list of things that I have started but never finished.

<comment><USER10> I started with Java Swing (O'Reilly) and Complete Reference (Schildt). It's funny--Java's tough, but I really didn't know the difference because I had no GUI language with which to compare. I had done a lot of (non-GUI) work in Mathematica (which I love), so I found Java cumbersome, but I also was interested by the story of the development of OOP and I figured it was worthwhile to learn.

Now I've found Python, which has a lot of the characteristics of Mathematica, and is very fun. But I have to fix my Java printing issues before I can play with it. (If I can figure out how to deploy it as a GUI desktop app I could better justify spending more time with it).

</comment></comment></comment><comment><USER11> Although I've been coding for a few years, I've always been sort of a newbie because I haven't really worked on one particular platform or technology over a long period of time. I have just picked up stuff by building things.

I built this site more than four years ago - <http://stp.unipune.ernet.in/zsi/> (I also did the backend data entry pages, which are not online).

When I took up the project, all I knew was HTML. I learnt to implement LAMP from scratch on the job.

I deliberately put myself in a situation where I had no choice but to learn, the same way people really learn to swim - by diving in at the deep end.

I'm pleased to see that the website is still up and running.

I haven't quite kept up with the latest web development technologies or languages, mainly because I haven't got down to building anything fun for a while. I'm itching to start doing something again and when I do, I guess I'll pick up something new.

What project are you working on? If you are looking for someone to work with, I'd be interested (I'm based in the UK too).

<comment><AUTHOR> there's a lot to be said for jumping in at the deep end - especially if you have some friends that can help you when you reach a mind block or dead end.

as for my project, it's very early days, i'll let you know when i have something more substantial to show you..

<comment><USER11> fair enough. good luck with it.

</comment></comment></comment><comment><USER12> I started programming in Java almost 2 years ago, so I'm still very new to everything. I hardly ever write anything in Java now though, I have to use C and C++ in school, but for a quick project my first choice is usually Python, and lately I've been playing with Scheme.

Something I liked doing when I was first starting is to check out the source to some open source tool I was using, or just to some random project I was interested in. I used to be amazed when I would look at some piece of _real_ code and think, hey, there actually isn't some magic quality to it that makes it so much different than something I could write!

</comment><comment><USER13> I learned C as my first language, then only much later on moved on to functional languages. Don't get stuck in PHP-think mentality, and definitely make sure to understand the things about Python or Ruby that make them functional ASAP.

Learning to understand macros in Lisp also really helps you think better, that's what people keep repeating. From what I understand, it blurs the line between that interface of the language to the compiler/interpreter, which seems cool.

I'm definitely a newbies still (in all Lisp, Python, Ruby).

</comment><comment><USER14> What's a good resource for best practices or for tutorials to develop programs the correct/proper way, so I don't have to waste time going down bad paths and making the same mistakes others already have made? While trying to develop applications, I feel like I'm figuring out stuff that's already out there and sometimes have to backtrack because of something I didn't think about. Someone may say there is no one proper way and many ways to do something, but I want to know the many proper ways and not do the many wrong ways.

</comment><comment><USER15> I'm one of those dime-a-dozen arty "ideas" guys who can design cool looking stuff but can't code himself out of a paper (or plastic?) bag. Recently I've taken up learning html/css/php an man does it make my head hurt. Absolutely love learning new things though so I think it is really good. Basically the way look at it is that I may never be good at programming but I had better be able to sit down with programmers and at least have SOME idea what the hell they are talking about.

</comment><comment><USER16> I asked a freelancer friend of mine a few months ago: "If I want to work for myself, what language would I learn to reach that point in the quickest fashion?" He told me to learn JavaScript/Ajax. Of course I see now that nothing is so simple... I've had to catch up on how to utilize other tools I'd rarely touched before (like CSS), and I feel compelled to learn PHP, MySQL, etc at the same time. So while I was hoping to reach some level of employable proficiency by summer, it's looking more like it'll be the end of the year.

I'm at work so I don't have time to read the other comments, but I'm sure someone's mentioned SICP and various videocasts, and yeah Python is supposed to be a good learning language. I've heard starting with JS might not be so great b/c of its idiosyncracies. No, still working on apps/sites, nothing finished.

</comment><comment><USER17> I have been programming for almost years and I think I'm close to getting the hang of it. <http://norvig.com/21-days.html>

</comment><comment><USER18> Well I am pretty fresh i've stuck to LAMP just like you. Its a good base. I built some of this, though had some help from a friend.

www.scribblesheet.co.uk

<comment><AUTHOR> definitely help from friends cannot be underestimated!

</comment></comment><comment><USER19> 1) Take your time and don't comapre yourself to anyone else. You are never too old or too late as long as you enjoy yourself

2) Since you are self educating, pick tools that are beside being useful are also challenging. By challenging I mean complicated and non trivial, this should intrigue you better and help keep motivated, and by useful I mean popular large nice community, lots of extension etc ...

3) Code!

</comment><comment><USER20> I'm very raw. The necessity of making a living in my non-hacker field of training slows down the learning process, too. That's why I'm taking the summer off and then going to grad school in CS. Between the two, I should be an uber-hacker in three years and I'll be building stuff the whole way.

</comment><comment><USER21> Find a place to work under "masters" who know their stuff. Surroundings/teams help you grow and develop your abilities. It's not a talent. It's a learned talent! Code on.

</comment><comment><USER15> I am</comment>


First impressions of Google wave - <AUTHOR> http://coliveira.net/software/first-impressions-of-google-wave/

<comment><USER2> Yup, those are first impressions alright. Here is some more developer focused impressions by folks who have spent a little more time with Google Wave.

<http://www.dynamicalsoftware.com/news/?p=51>

I'd be interested in other folks impressions of wave. What's your take on it now that the bloom is wearing off?</comment>


Climate for Angel Investing Continues to Look Bleak  - <AUTHOR> http://blogs.wsj.com/independentstreet/2009/03/31/climate-for-angel-investing-continues-to-look-bleak/ <comment><USER2> This is yet another of those studies that's completely misleading because it's mostly about angels investing in restaurants etc. Startup investing is a tiny fraction of angel investing.

<comment><USER3> Actually, the article talks about "the number of accredited angel investors – who tend to be angels who join organized angel-investing networks and invest in high-growth start-ups that go on to win venture capital". Sounds like a tech startup to me. This makes sense in this economy- even wealthy investors have less disposable income to spend on high-risk investments.</comment></comment>


The World's "Blackest Black" Makes Its Debut–On a Building - <AUTHOR> https://www.fastcodesign.com/90160002/the-worlds-blackest-black-makes-its-debut-on-a-building <comment><USER2> "You can't just buy Vantablack and paint it on. SNS has to be involved with the application process of the highly flammable liquid, which has to be applied in a sprayed method overseen by the company. The building was coated ..by a team of British and Korean painters that had to be trained by SNS directly"

Quite the process for a shade of paint. This also assumes the building exterior will maintain showroom status. Any dirt or weathering and poof! it looks like normal black.</comment>


Daily sketching in 2016 - <AUTHOR> https://medium.com/@zachlieberman/daily-sketches-2016-28586d8f008e#.eo14g9nw2 <comment><AUTHOR> this is a write up of a year of doing code based sketches -- last year I started to do a sketch per day here:

[https://www.instagram.com/zach.lieberman/](https://www.instagram.com/zach.lieberman/)

I am happy to answer any questions about this if it's helpful</comment>


Students at Olin build Automatic Lock Cracker (Master Combination Lock) - <AUTHOR> http://hackaday.com/2011/03/09/automatic-lock-cracker-makes-breaking-and-entering-a-breeze/

<comment><AUTHOR> I find it interesting that their device takes a maximum of 2 hours to run through all of the combinations. I lockpicked a Master lock just two days ago (I had forgotten the combo), and by hand it took around 30 min. Master uses certain rules when they create the lock combinations that allow one to reduce the range of possible combos down to a flat 100. Source: <http://aaronjasso.com/features/lock9.php></comment>


Man charged with felony for passing out jury rights flier in front of courthouse - <AUTHOR> http://fox17online.com/2015/12/01/man-charged-with-felony-for-passing-out-fliers-in-front-of-courthouse/ <comment><USER2> The money quote from the comments: "He should take it to trial. Lets see how that judge likes this jury nullification flyer being entered into evidence and presented to a jury."

</comment><comment><USER3> > Jury nullification occurs when a jury acquits a defendant, despite evidence, > because they either believe the law is immoral or wrongfully applied.

Historically, "wrongfully applied" meant "victim was an uppity negro who deserved what that nice white defendant did to him".

Also, there is nothing in the nullification power that limits its use to acquitting. That same power can also be used for anti-nullification, to convict when the jury thinks the defendant should be punished despite the evidence and law saying not guilty. Historically, this too has tended to be used for racist reasons.

The typical counter to this from nullification advocates is that the judge or an appeals court can overturn a conviction when a jury uses anti-nullification to convict.

The problem with that is simple: the judge or appeals court generally has no way of knowing that it happened. In most cases, the prosecution does present witnesses and evidence and a somewhat plausible case. The judge cannot tell that the conviction was from anti-nullification rather than from the jury believing the prosecution's case.

An important aspect of a good justice system is that similarly situated defendants are treated equally. Routine nullification instructions would severely undermine that. If we require a unanimous jury of 12 to convict, then it only takes about 5% of the jury pool to believe that a given law should be nullified to result in 50% of juries having a member who will nullify.

Nullification should only be a last resort, for use after the normal political process for changing bad laws has failed. It needs checks and balances to prevent its massive misuse--and the only method anyone has been able to come up with is the hack of not telling people about it. The theory is that in the kind of breakdown of the system where it is appropriate the jury will discover it on their own.

<comment> jack-r-abbit While all of what you said might be true... it shouldn't be a felony to hand out flyers telling people what others had decided not to tell them. If the jury has a set of rights then they should be made aware of those rights, even the unpopular ones. If people feel strongly enough that a particular jury right should be revoked, then they should pursue steps to revoke it. But they really shouldn't be arresting people for passing out that information.

<comment><USER3> > If people feel strongly enough that a particular jury right should be > revoked, then they should pursue steps to revoke it.

It's hard to see how the nullification and anti-nullification powers could be revoked without massively changing the role of the jury. Nullification follows from the double jeopardy rule and the jury not being liable for a "wrong" decision (except in special cases, like a juror selling their vote). Anti- nullification follows from the latter and from judges and appeals courts not having a way to detect anti-nullification.</comment></comment></comment>


Rhabdomyolysis and neuropathies as a result of squatting in 'skinny jeans' - <AUTHOR> http://jnnp.bmj.com/content/early/2015/05/27/jnnp-2015-310628.full

<comment><USER2> I don't really understand why this article is here. The most interesting thing here is that the Journal of Neurology, Neurosurgery, and Psychology is resorting to clickbait.

As an aside, from what I know about rhabdomyolysis, it's a condition that can appear when people who are very much sedentary perform very rigorous exercise. Though I don't know anything about this individual, I would suspect that the primary cause for this person was the fact that they helped the family member move for several hours, and that the skinny jeans part is really more of an aside.

<comment><USER3> > As an aside, from what I know about rhabdomyolysis, it's a condition that > can appear when people who are very much sedentary perform very rigorous > exercise.

From what I understand, it can also occur when people who are active and fit perform certain workouts (those which emphasize isometric exercises)x in excess.

This is arguably more dangerous and problematic, because it's not as well- known, and companies like Crossfit[0] have been criticized for simultaneously promoting it and failing to provide adequate warning.

[0] [https://encrypted.google.com/search?hl=en&q=rhabdo%20crossfi...](https://encrypted.google.com/search?hl=en&q=rhabdo%20crossfit)

<comment><USER4> Rhabdomyolysis has a very large variety of causes including extreme physical exercise especially exercising while dehydrated. It can occur in any sport or exercise program.

That's not the point of this article though. It seems they believe the injury was caused by prolonged squatting and was further exacerbated by compression from the jeans as the legs started to swell. The jeans had to be cut off. That's what I got from it anyways, it was difficult for me to get the jist because it was written in "medicalese."

</comment></comment></comment><comment><USER5> "Later that evening, while walking home, she noticed bilateral foot drop and foot numbness, which caused her to trip and fall. She spent several hours lying on the ground before she was found."

This last sentence raises a lot of questions if you think about it. We're talking about a presumably healthy 35 year old woman here. (At least, if she had any prior medical problems, the article does not see fit to mention it.) This woman experiences numbness of both feet and and an inability to lift her feet ("foot drop"). She falls. It makes sense so far.

But why does she lie on the ground for hours? She might not have been able to walk, but she should have been able to crawl - the article makes a point of mentioning that muscle power at knees and hips was normal. Was she unconscious, and if so, why? Was she in debilitating pain, and the article just doesn't mention it? Why didn't she take her jeans off once she noticed her legs swelling so much that her jeans were cutting off blood circulation to her leg muscles (which sounds pretty unpleasant!)?

I know this is just supposed to be a short summary, but it rises more questions than it answers.

</comment><comment><USER6> The experts in the field of squatting will tell you that skinny jeans are the wrong attire. You should be squatting in Adidas track pants. Flat caps are optional.

<comment><USER7> WTBBQ? I pasted this into the Goog and the internet is full of people squatting in track pants and flat caps. Why are they doing that?

<comment><USER8> Squatting is a common posture when hanging out in certain cultures (notably, but not limited to, slavic countries), and it also turns out that there is a large overlap between these cultures and the cultures in which wearing track pants and flat caps is common everyday attire.

</comment></comment></comment><comment><USER9> while you're there, answer the poll at the right sidebar!</comment>


A Novel Approach For Computer Worm Control Using Decentralized Data Structures - <AUTHOR> https://pdf.yt/d/E2ZwuLAVfC44kEQk <comment><USER2> Haha, I had the same idea. The since (valid) transactions are passed freely to all nodes in the Bitcoin network, one can just use the network as a signed messaging platform.

You don't need to query blockchain.info, all you need is a Bitcoin client that listens for incoming transactions.

I've been writing an implementation on and off for a while now. The general idea is as follows:

The botnet client connects to "n" Bitcoin nodes. If the same transaction is relayed by ceil(n/2) nodes, then we say that transaction is "confirmed" and examines the transaction to see if it's sent from botmaster's address (in fact we don't even have to use the botmaster's address, with BIP-0032 ([https://github.com/bitcoin/bips/blob/master/bip-0032.mediawi...](https://github.com/bitcoin/bips/blob/master/bip-0032.mediawiki)), we can use related public keys)

You don't even have to use transactions ("tx" messages), you can use the block messages if you are willing to tolerate an (on average) 10 minute delay, this would drastically reduce the network traffic sent/received by the botnet client.

But these guys forced my hand, so I suppose I'll have to release what I have so far. The current botcoin client (c++11 with boost::asio) connects to the network, and gets transactions. Data extraction from transactions is unfinished. The current problem I'm working on is making sure that people cannot easily scan the Blockchain to look for c&c transactions. This can easily be done by encrypting the messages with a client specific key. However, I would like to have perfect forward secrecy, that is, suppose a sample client was obtained by researchers, past c&c messages should not be able to be decrypted (otherwise the blockchain contains a log of all of your C&C messages).

[link redacted]

<comment><USER3> > You don't even have to use transactions ("tx" messages), you can use the > block messages if you are willing to tolerate an (on average) 10 minute > delay

Does this mean you can send messages without transfering bitcoin from one account to another?

<comment><USER4> I think the meaning is that you still post messages in transactions, but the difference is how the bots listen. Instead of listening for individual transactions (which would be a huge amount of traffic) only listen when a new block is found, every 10 minutes. The block will contain the transaction.

</comment></comment></comment><comment><USER5> Author here! I'm surprised to see this up on HN, I checked the front page, and here it was. This was written for a computer security class, and definitely hasn't been proofread yet. If anyone has any questions, I can answer anything you like.

<comment><USER6> I'd like to schedule a time to discuss this with you further. I've written a framework which starts virtual instances based on payments. Here's the implementation: [https://www.stackmonkey.com/](https://www.stackmonkey.com/). A control system for the network created by the framework based on your premises might be interesting, especially if the process were tied to a pegged sidechain.

</comment></comment><comment><USER7> Another similar idea (from back in 2008[1]) is to use the Bittorrent DHT as distributed storage for C&C commands. I have no idea anyone has implemented a real-life bonnet in the intervening six years, but it seems plausible enough.

[1]: [https://iseclab.org/papers/securecomm08_overbot.pdf](https://iseclab.org/papers/securecomm08_overbot.pdf)

</comment><comment><USER8> Can't worms simply relay to each other the message signed by the botnet master? No Sybil attack there.

The trend of throwing blockchains at problems for which they are totally uncalled for is profoundly annoying.

<comment><USER6> The use of the blockchain here appears to be based on the fact shutting down the Bitcoin network is considered to be impossible, at least for the immediate purpose of stopping the control of a botnet. I assume a Sybil attack can still occur within a peer-to-peer network that uses signed messages because of the location and addresses of the nodes can't be signed as well. i.e. the node you are talking to may be repeating previously re-transmitted signed messages, or simply not sending messages at all. It's not as if the master can sign a message vouching for the entire network's current state...

<comment><USER8> You just timestamp the messages and give them a TTL. The worms can use ntp to sync.

</comment></comment></comment><comment><USER9> So something I've been wondering about with all the talk around The Pirate Bay recently is why aren't people using the blockchain to store data needed to bootstrap your joining of a decentralised network.

It could be as simple as storing the magnet links themselves.

<comment><USER10> On the Bitcoin blockchain, you can't fit a magnet link in the very small amount of data you're allowed to include in a transaction. You could split them across multiple transactions, but that leads into the second problem: It's not entirely clear how you'd make a directory so people could actually find these torrents.

As more general-purpose blockchains come out (Ethereum, for one example), this will get easier.

<comment><USER11> _" All problems in computer science can be solved by another level of indirection"_

Since you can easily fit the Magnet hash in an OP_RETURN value, all required is to move the torrent's description (title, description, categories, magnet URL) into a torrent of its own. Indexers find the first hash via the blockchain, use it to fetch the full torrent description via DHT, which in turn allows it to find the torrent via the magnet URL (or alternatively, includes the .torrent file directly, but this trades network efficiency for hosting overhead)

To speed up bootstrapping new indexers, occasionally "rollup" descriptions could be published, which are just torrents that aggregate a large number of descriptions (bucketed say, by date, DHT swarm size, or similar). Add an identifier and public key to these roll-up releases, and you effectively have a trusted "channel" \- one guy or group with editorial control over the index they publish, and magically you have something very close to ThePirateBay again.

</comment></comment></comment><comment><USER12> FWIW, keybase.io do the same; they store the root of the merkle tree into the blockchain with a similar principle of throwaway addresses, making it the whole database they handle basically unforkable.

<comment><USER13> Here's the doc on that: [https://keybase.io/docs/server_security/merkle_root_in_bitco...](https://keybase.io/docs/server_security/merkle_root_in_bitcoin_blockchain) . Since users on Keybase append their "announcements" (proofs, username announcement, etc.) to a public signature chain which is verifiable, the Bitcoin merkle step is designed to prove that Keybase is (a) showing everyone in the world the same thing, and (b) not omitting anything from the ends of people's chains.

</comment></comment><comment><USER14> The main problem I see with this is that you would have to have each client in the botnet sync with the Bitcoin network. This is a lengthy task and results in gigs of data.

Hardly inconspicuous.

But I like the idea.

<comment><USER15> You don't need the entire blockchain for this.

And new blocks are "only" ~400KB in size - at 1/10min, that's less than 700B/s. (Of course, it'll be more in practice. But still, not much.)

</comment></comment><comment><USER16> is this a published paper? O_o

<comment><USER17> No, it's not, and it's a pretty useless idea.

An expensive, slow, and extremely CPU and network intensive protocol is not what you want to use for stealthy malware communications. It could be done; you could also hammer a nail with a trout, but you'd look pretty foolish in the process.

<comment><AUTHOR> Yes, I agree with you on the part that it is not the most efficient network protocol, but you're overlooking the fact that blockchain is almost impossible to take down and is censorship-free. Even if they manage to locate the C&C; they simply couldn't shut it down, since BC is decentralised and a distributed database.

<comment><USER18> There's also the disadvantage of having every communication between the malware and the controller publicly logged, and the fact that that every command issued would have a small transaction free.

</comment></comment></comment></comment><comment><USER19> really? a pdf with drop shadow on every word? if you didn't want me to read it, just say so.

</comment><comment><USER20> I'm still struggling to fully understand how bitcoin works.

I guess I can understand what the blockchain is, but I struggle to understand how the number of bitcoin can be stable, and how transactions are achieved. I guess I like drawings better.</comment>