Hacker News Reader

Comment by yafujifide | Hacker News Reader

Ryan X. Charles here. AMA.

Why do you believe that a JavaScript port of bitcoin is an important project? What is lacking in current implementations / why would you want to run bitcoin inside a browser / do you think it's possible to do serious crypto correctly in JS[0]?

[0] http://matasano.com/articles/javascript-cryptography/

There is no working javascript full node. I believe the future of bitcoin is brighter if there are many independent implementations of bitcoin running as full nodes.

I want bitcoin running in a browser because browsers work on every platform and can bring bitcoin to more people. Also keep in mind that reddit is primarily a website, to using javascript is a pretty appropriate first choice of language for bitcoin stuff.

Can you do serious crypto in C? Only if you know what you're doing and don't screw up. Same goes for javascript.

>Can you do serious crypto in C? Only if you know what you're doing and don't screw up. Same goes for javascript.

Overall I am sympathetic to your cause, but this raises alarms. JavaScript crypto is nonsense, you could have the implementation silently replaced with a naughty one at the hosts leisure.

EDIT: To respond to all of you at once - everything I've seen so far says that he was aiming for JS in the browser. Did I miss something?

That's not really the case - yes, crypto in the browser is possibly nonsense, but crypto under e.g. Node.js is anything but.

We're not talking about client-side javascript, are we? I assumed he meant node.js/server side.

Yes exactly. I think people who are not whatsoever involved in the javascript world assume that javscript means "delivered by a webserver", which is just not necessarily true.

For what it's worth, I (the acuser) am super familiar with JavaScript, I just thought you were making a web app. Sorry to cause confusion.

> JavaScript crypto is nonsense

What makes you think this?

That's also true of C with an auto-update framework. That's also true of closed-source C.

There are plenty of ways to avoid that particular trap of JS crypto (or more specifically web crypto). Bundling it inside an extension comes to mind.

All that said, I'm not even convinced this attack is within the threat model of Redditcoin, given that it's resources for a specific website that is also the JS origin.

That has nothing to do with javascript-the-language, but rather the way the web works. Obviously even with https, javascript delivered by a web server has a vulnerability whereby the web server may be compromised, which is outside of the users control. Any javscript delivered by a web server should be executed with that understanding. i.e., delivering a wallet from a web server is probably not the right thing to do. Note that javascript can also be run in the form of a browser extension, server-side node, node-webkit, apache cordova, etc. Javascript-the-language is not intrinsically vulnerable to a compromised webserver.

It's fair to say that JavaScript-the-language is not intrinsically vulnerable to this, but how else are you planning on delivering the JavaScript to clients? I may be misinterpreting your goals.

Not in the form of a webapp. It would have been a browser extension and/or mobile.

Thanks for clarifying.

This seems pretty much correct.

A usable browser implementation of a wallet could be secured fairly well and if it gained any popularity would put pressure on browser makers to deliver better solutions.

npm can use server-side resources.

But where do you store the 25GB blockchain in a client-side full-node implementation?

Isn't this just an implementation only for Node?

I don't think anyone is going to run a full node in a browser any time soon, but if they do, IndexedDB.

Bitcoin's cryptologic is open-source; it doesn't have to be secure from tampering in the same way a videogame console has to be secure. A videogame console doesn't want you modifying game code or running your own code on the hardware. Nobody cares what you do to your bitcoin client; you'll just lose your coins in some invalid[1] transaction or maybe you find some amazing flaw in bitcoin's math - which you could have found in any other programming language anyway.

That said, a browser-based bitcoin client does expose its user to potential XSS exploits 'n such; especially if the private key is in the browser's memory.

1. https://en.bitcoin.it/wiki/Raw_Transactions , basically if you mess this stuff up you lose coins.

That's a fair point, except that (contrary to "Nobody cares what you do to your bitcoin client"), I would suggest that most people do not have their own bitcoin client, and are in fact running code written by somebody else. Those users will likely be very upset if a client loses all their coins.

Or, if there is a large enough user base running some faulty logic, this could cause a big ugly fork in the blockchain. Not good.

Yes, that is the primary concern. "We" in the bitcoin community haven't yet figured out how to write 100% correct alternative implementations of bitcoin. We will have to figure out how to do that first before I would ever recommend anybody actually run an alternative implementation as a full node and rely on it for seeing the blockchain.

So why create a new bitcoin derivative to do something like creating a divisible bearer reddit stock certificate held in trust vs. something like open transactions or a webservice? Especially since it would be a relatively small network easily taken over by some large mining pool if it ever became useful. Your prone to the US legal system requirements in this case since I'm guessing reddit is a US corp.

Had I been consulted before "reddit is issuing shares on a cryptocurrency" was announced, I would have suggested doing something with less legal headaches first. It would take a $100 billion dollar company, much larger than reddit, to actually make such a project legally possible.

Could you go into detail what the major legal hurdles were in this case?

Issuing shares to millions of people would have made reddit a public company. reddit did not want to be a public company. This is a contradiction.

I did not realize Reddit Notes (crypto or not) are supposed to be "shares" of anything? Much less shares of Reddit as a company.

It's been said many times since the beginning, including in this article:

>Announced in September 2014 as part of a fundraising round that raised $50m from VC firms including Andreessen Horowitz and Sequoia Capital, Redditcoin was a key part of an audacious plan by Wong to give part of the company’s equity back to users.

>Wong wrote in a blogpost: “The investors in this round have proposed to give 10% of their shares back to the community, in recognition of the central role the community plays in Reddit’s ongoing success.”

Why isn't this being brought to Reddit's userbase? This seems like something where a lack of transparency will really hurt the company.

Why isn't what being brought to the reddit userbase? That they fired me? That reddit notes is now paused? They are probably waiting for the right time to make an announcement I guess. They probably didn't realize that by firing (or letting me go, whatever) that they would draw the interest of the media.

Sorry - it's really all of the above. To be more clear, I will break this into some sub-questions that are hopefully less obsequious.

The "reddit is giving 10% of its shares to its users" thing was very positively received. My understanding was that redditcoin was part of that effort. Is the 10% thing still going to happen in some way? If not, why not?

Regardless of the answer to the question above, hearing that redditcoin is being cancelled would likely lead members to conclude the new leadership doesn't want the community shares system that was so touted previously. Is that the case, if you know?

And then the final, more meta question is: Why would Reddit's staff, of all people, think they could do something involving Reddit quietly?

> The "reddit is giving 10% of its shares to its users" thing was very positively received. My understanding was that redditcoin was part of that effort. Is the 10% thing still going to happen in some way? If not, why not?

I think they intend to make the 10% thing happen eventually, although the project is currently paused. I estimate 1+ year before any aspect of the project resumes. However, I am not privy to the conversations the executives have had about it, so I don't really know.

> Regardless of the answer to the question above, hearing that redditcoin is being cancelled would likely lead members to conclude the new leadership doesn't want the community shares system that was so touted previously. Is that the case, if you know?

I don't know.

> Why would Reddit's staff, of all people, think they could do something involving Reddit quietly?

Ha. No idea.

Interesting. I appreciate your candidness!

I've already seen plenty of discussion about it on r/bitcoin et al. I'm pretty sure most people "in the loop" have already heard about this.

It popped up a couple days ago, but I'm not the sure the userbase as a whole cares much about it.

http://www.reddit.com/r/SubredditDrama/comments/2u4ypn/reddi...

It was, everyone who really cared about it in the slightest knew

http://www.reddit.com/r/Bitcoin/comments/2uadvd/the_real_rea...

http://www.reddit.com/r/Bitcoin/comments/2u4nv4/ryan_x_charl...

http://www.reddit.com/r/SubredditDrama/comments/2u4ypn/reddi...

http://www.reddit.com/r/Buttcoin/search?q=ryan+charles&restr...

The only people that cared about this guy were the bitcoin fanatics and the those who where hell bent on making fun of the bitcoin fanatics. No one else on the site talked about it because it didn't affect them.

On Reddit, in my opinion, spin and the degree of transparency matter long after the fact. This is everyone who cares to know right now. What happens when there's a front-page TIL post or relevant blog post in a few months? Reddit and PR can be a time bomb.

What would you have had them do? Make a full blog post for every single employee they hire or layoff? Have the entirety of the site (which is already hypercritical of the admins) mull through and critique every single personnel decision?

They didn't try to hide the fact that he was laid off, and he's now obviously free to come talk here and on twitter about the circumstances surrounding his departure from the company, I really don't see how this is a transparency issue.

That's a good question and point. The thing is, you're right: It's not a transparency issue in the real world and it wouldn't be for any other company. But Reddit's not the real world. Reddit's much angrier and much more conspiratorial, especially when it comes to things that ostensibly are about the "community" and "giving back" on behalf of the admins.

Yes, but that's hardly reason to purposefully feed the flames of reddit conspiracy theorists by making a more high profile announcement. And if there is a /r/TIL post down the road that starts a witch-hunt it's not like they have a ton of fuel, the guy who was fired talks about it in a very calm and non-accusatory manner.

Sorry, but again, what would you have rather had them do? I don't see anything wrong with the admin's choices on this

Yes, agreed. I don't think there is necessarily anything bad or wrong about what happened. Writing a blog post about "we're cancelling cryptocurrency and firing the enginer" would have made it into an even bigger deal than it is. The way it is happening, people who care about it hear about it, and people who don't care don't have to bother.

Another piece of drama that happened last year was that reddit let a former employee go, who made an AMA about it, and then Yishan publicly criticised the former employee. The new leadership is probably very, very hesitant to say anything about anybody who was let go - they don't want to repeat that mistake.

IMO CA employee defamation law should really be changed: http://www.reddit.com/r/bestof/comments/2igkke/reddit_ceo_ca...

Were you treated fairly in terms of a severance package?

1 month severence

Seems awfully low. They pulled you from BitPay four months ago, and now you're without a job and given one month's severance.

Not to mention you were effectively let go with the CEO, but not told. That sounds like a claim for constructive dismissal right there.

Yishan really quit over a disagreement about an office? That seems like a straw that broke the camel's back situation. Or he's unstable?

This was heavily discussed back when it happened, but he says it's true: http://www.quora.com/Why-did-Yishan-Wong-resign-as-Reddit-CE...

Yes, he quit over a disagreement about the precise location of the office. Definitely camel's back. Reddit has been through a lot of turmoil recently:

1) Moving entire remote company to SF

2) Raising $50 million

3) Many employees, sometimes key, quitting

4) Celebgate

The disagreement over Daly City/SF probably just put Yishan over the top. Since then, more turmoil:

6) Yishan quit

7) Entire company actually performs the relocation

8) A new office is found and moved to in SF

9) New executives take over. Probably some power struggles which I didn't see.

10) New product plan is laid out for 2015. Does not include cryptocurrency.

I just want to thank you for your transparency.

For sure! I'm a strong believer in transparency. Trying my best to be open and honest.

> Celebgate

AKA The Fappening, the massive celebrity photo leak/hack last year. Just in case anyone else didn't pay enough attention at the time to have heard of both terms. Apparently Reddit was in a bit of a pickle because subreddits were created to spread the photos and not all of them were strictly against the site's terms.

What went wrong?

It's pretty simple. I was hired by Yishan and reported directly to Yishan to lead the cryptocurrency engineering wing of reddit. This was his idea - and I was happy to lead it. Yishan then suddenly quit, and new leadership took over. The new leadership is not interested in pursuing cryptocurrency at the moment.

Could you elaborate on the culture change since Yishan left if any? I'm curious about the power relationship between the owners and the execs mostly.

Well I'm not really sure, because it felt extremely turbulent while I was there for my brief 4 month tenue. I think the culture will change. I think the culture was a little more loose, autonomous, and with little management before. I think it will be more hierarchical and managed moving forward. However, please realize that I have extremely limited experience at reddit and may simply be wrong about that.

Would you ever consider implementing on Voat?

50M is a lot of dough. Any idea how they were going to spend it? Was the idea to build out a giant development team?

Yeah $50m is a lot. We would have hired several more cryptocurrency engineers. Not any more. I'm not exactly sure how they are going to allocate resources moving forward, but you can see who they are hiring here:

https://www.reddit.com/r/redditjobs/

Article says you were laid off, but you say you were fired. Which is it?

I think "laid off" is probably the better term. The new executives are not interested in pursuing bitcoin or cryptocurrency at the current time. I was going to be the lead engineer of the cryptocurrency engineering wing of reddit, but they have let me go, and removed the other "cryptocurrency engineer" positions from the job page. The executives have their hands full with things like mobile and improving reddit.com infrastructure. Not to mention the legal difficulties of reddit notes.

> HN has rate limited my responses so I can't respond to questions.

Your account definitely isn't restricted. Can you shoot us an email (hn@ycombinator.com) and tell us what you're seeing? We'd be happy to try to fix it.

Sorry, it seems I can see the reply button now. That may have been my error.

You can always click the "link" button fer the specific comment and then you'll see a reply button -- it's nothing account-specific, it's just one weird trick to slow down flamefests proportionally to comment depth.

Thanks, that's exactly what it was! That's why the "reply" button was not appearing, and I thought I was rate-limited. This very thing happened to your comment - I am replying by visiting the permalink.

I was about to edit my comment to mention that: HN delays showing the "reply" link on deeply nested comments. It's an ancient flame retardant. You can, however, get around it by clicking "link" on the comment you want to reply to.

So, this is literally the post where I find out that my account has been restricted in some way, and that is why I keep having conversations cut short because I can only reply to a half-dozen or so things in a day. (I had assumed that this was a new thing that applied to everyone, since to my knowledge there is no reason for you to be restricting my account in particular, this way.)

Why the secrecy? Why not just tell people all the various passive-aggressive BS you perform to degrade experience for certain users? If you don't want me posting here, why not just tell me or ban me or whatever? Bonus points if you give an actual reason, but that might be asking for too much.

How many different bans do you have in the toolbox now, is there a list somewhere? Is there a way to check which ones apply to my account, aside from finding out second-hand?

edit: https://news.ycombinator.com/item?id=8964992 <- several posts here I wanted to reply to, it was an interesting discussion. I was not able to apparently because I caught the wrong admin on the wrong day in the wrong mood? And of course I have no idea what post of mine caused this... Despite whatever 'efforts' you're putting into this site, moderation here is bad and steadily getting worse.

I'd just like to say that I don't like the idea of limiting people just because of low karma or whatever. A lot of people do get downvoted just for having ideas that don't "go with the group" even though they're well thought out.

Hacker News is the most poorly maintained forum I've ever seen. Too bad the original creator left and the new maintainers can't make any significant improvements. Just empty promises from the guys who took over, who have no real authority to make any major changes. Too bad.

Huh? I routinely read people here writing that HN has the highest quality discussions of any active online fora. I happen to agree.

Also, HN has dramatically increased in quality over the past 6-10 months. It's been very noticeable for someone who's been here for 4 years.

Can HN be an echo chamber? Yes, at times. But much less than other online fora that I've participated in (most Reddits are 1000x worse, for example)

Does the site design itself leave a bit to be desired? Maybe, but I've grown quite fond of it.

And what exactly "empty promises" are you talking about?

I didn't read the post as a criticism of the community but rather a criticism of the technical workings of the site. Which is correct, HN is lacking a lot of things that make even the most basic modern forums more user friendly. The site performs poorly on mobile, you can't collapse comment threads, the reply button disappears sometimes unless you click "link", etc.

I've had a registered account here for just shy of 7 years now, and you're not giving the current moderation team nearly enough credit. dang and company have resolved a lot of long-standing user complaints, they are proactive on policing the site, and they are generally exceedingly fair and even-handed.

dang specifically has the patience of a saint.

Turns out I wasn't rate limited - I wasn't seeing the "reply" button because of a completely different mechanism on HN that makes the reply button not appear for some comments that may be involved in a flaming or something.

Reply on news.ycombinator.com