This Car Runs on Code - <AUTHOR> http://spectrum.ieee.org/green-tech/advanced-cars/this-car-runs-on-code

<comment><USER2> Do people think this is a good development? I mean, software is hard, and from that article it seems more and more functions that don't really have to be computer controlled are. It's one thing for engine control units or airbags, where you have to monitor real-time data at kHz frequencies for optimal function. But when the dome light or the trunk lid is controlled by a little computer, it seems it's going to be a lot harder to validate and a lot harder to fix (especially for diy people) if something doesn't work.

<comment><USER3> I don't think its good. How will Ralph Nader investigate a code crash that leaves a balled-up bit of twisted metal in the median? What trace does a bug leave? Toyota can't even debug their throttle problem. Without a black box or hardware backup we should expect mounting unexplained accidents. Remember power steering requires a mechanical backup if hydraulics fails - who hasn't experienced that, or doesn't know someone who has?

</comment></comment><comment><USER4> I'm going to go back and read the article but does anyone here do any hacking on Honda ECUs? There's a pretty big community of engine tuners and programmers that focus on reversing Honda ECUs. It's a fun way to try and improve gas mileage and performance.

www.pgmfi.org for anyone that's interested.

<comment><USER2> Don't have a Honda, but I did use my laptop to tweak some engine fuel parameters on my Passat so it would run on 100% ethanol.

</comment></comment><comment><USER5> autom8d</comment>


Apple removed anti-censorship apps from China App Store - <AUTHOR> https://twitter.com/icodesign_me/status/891147914759749632 <comment><USER2> goto "other territories"</comment>


Is this web 3.0? - <AUTHOR> http://www.entrepreneur.com/technology/managingtechnology/web20columnistfrankbell/article184966.html

<comment><USER2> I can't wait for the web x.0 moniker to die.

<comment><USER3> Agreed. Web x.y will offer so many more subtle variations.</comment></comment>


Ask HN: How do I sell my expensive niche software w/ no sales background? - <AUTHOR> A little over 2 years ago, I quit my full-time job and began freelancing. The vast majority of my work has come from one particular group of customers at a University. I've been paid 10-20k dollars on 3 separate occasions to develop a web application for this niche, I have another customer who will be paying me a similar amount in the fall when I work with him, and there is another customer who wants something similar but doesn't have the funds yet.
This niche is academic in nature and as far as I know the money comes from grants. I have never signed any paperwork, I have simply built what they wanted and been paid. I have a great relationship with these customers and have already discussed the fact that I might try to sell a product like this to other institutions, which they are fine with. I am confident that I can extract some core components that are useful in this niche, rewrite the app (there are things I want to improve), and create a product that would be useful to other similar institutions. However, I don't actually have many connections in other cities yet, nor do I have any experience in selling a piece of already-developed software for tens of thousands of dollars to people I don't know. All of my business has come through referrals. What I _have_ done is spent a few years talking to the customers, answering emails of the users of the app, developed several different versions of it, and been able to successfully charge money by the hour for development. So I feel like if I only connect a few more dots, there is a great business here. So now I'm trying to decide where to go with this, and could use some help.
So I have a few questions:
1) If a piece of software would cost tens of thousands of dollars to develop from scratch (possibly more when considering the development has required the time of many highly paid individuals), would it be reasonable to charge someone five figures for a packaged solution, and also charge a high consulting rate for customizations and integration with the customer's data? Note that this software isn't being sold to mom and dad or your friends, it's being sold to large, state and federal funded organizations, and there aren't many solutions out there.
2) How does one go about learning to sell? Especially a software product that is expensive, but probably wouldn't sell that many copies, maybe a thousand copies. Any books you recommend? Do I just find the proper contact at the institution and call them up? Tell them about what I have and show them a demo? Do I need to get a sales guy? Do I need to fly all over the country and show the software in person? Would someone be willing to buy an expensive piece of software based on a screencast and examples of a couple of other customers that use it?
So there you have it. I'm trying to make the transition from consulting to selling a product, have a couple years living expenses in the bank, and have someone willing to pay me while I work on it for the next few months. But now I just need to figure out where to go next. Obviously I will sell the first copy to the client I am planning to do work for in the Fall. But what should the next step be? My first thought would be to just start cold calling potential customers, which I have never done. Any help you can offer would be appreciated. <comment><USER2> 1\. Pricing:

If your clients pay for the software from grant money - find out about these grants before deciding on your pricing. People won't have a lot of hesitation on price if its not their money - but grant money - that they'll be spending.

So find out what kind of grants your clients opt for. Whats the average value of that grant. Is it a specific purpose grant? And fix your pricing accordingly.

2\. Book recommendations:

i. How I Raised Myself from Failure to Success in Selling - by Frank Bettger (The best book on selling I've read)

ii. Bag the Elephant - by Steve Kaplan (Book for selling to big clients)

Jeffrey Gitomer books on selling are also good.

3\. Selling Ideas

Record short interviews with your current clients. Ask them the following questions:

i. What was your perception about my product / solution before you bought it?

ii. How has that perception changed?

(Answer to the above 2 questions gives you the before-and-after scenario. Powerful testimonial stuff.)

iii. What is the biggest benefit you gained from using my product?

iv. What are some other benefits you received?

v. Do you think the price is reasonable?

vi. Would you recommend the solution to others?

Obviously - ask for their name and title and stuff too.

Record such 10 minute interviews. Compile all the interviews in 1 DVD. And you have a very powerful sales tool.

Using such tools work wonders for folks who aren't good at personal face-to- face selling. Let others sell your solution to your target audience.

Mail these DVDs with a 1-2 page sales letter to folks in other cities (Let me know if you need help with the sales letter too - I've written a few that have done well). And follow up by phone after 3-5 days. And then follow up again.

As others have recommended, tradeshows and conferences are very good to get your foot in and raise awareness too.

<comment><USER3> One other thought on pricing. I'm in a similar situation (niche market, expensive software, big clients that take a long time to sign). This can drain you and so you want to do everything you can to get cash coming in quickly.

Rather than just charging $20K in one fell swoop, can you turn it into a web application, and charge $1-1.5K a month for it? It depends on which number you'll have a hard time getting approval for, but it may be easier, especially if you give them the option to cancel any time, or at least within 60 days, etc.

<comment><USER4> The ASP model is interesting and you might want to have that as an alternate pricing model.

One University I was working with did not want to subscribe to a hosted product that was just about perfect for them, but rather wanted their own built and it largely had to do with budget. They could get the tens of thousands required as a fixed budget, but couldn't make a monthly fee fit their budget.

Especially if they're often paying via grant money, you could ask them but It's probably single, annual, or at most quarterly disbursements. You could structure your payment plan around the schedule they receive their funding.

</comment></comment></comment><comment><USER5> > I have never signed any paperwork, I have simply built what they wanted and > been paid.

You really need to talk with a competent attorney. And no, asking other folks what they did doesn't count because you don't know what differences between their situation and yours matter and how. Heck - you're not likely to see the differences. Besides, there's no guarantee that they got it right.

There's a chance that you don't own what you've written. There's another chance that any of your customers could give it away. And so on.

HN is not the place to deal with legal issues. We don't know the right questions or what the answers mean. We don't know what's possible. And so on.

</comment><comment><USER6> My partner and I built a product, and we're currently selling to higher ed. He's been selling to higher ed for seven or eight years now, and I've been peripherally involved in selling to higher ed for four or five. I'd love a chance to chat about it, and my email is in my profile.

Without knowing more details, your price feels reasonable. You need to put together a solid, total package, and don't forget 18%/year in maintenance. If your clients are getting funding from an outside source on this, you need to grease the skids. There are people who do nothing but set up and administer grants. If you can hook up with one of them, you're golden.

The best way to learn to sell is to do it. Try to find yourself a mentor you can talk to about it, and just go for it. If you can learn how to effectively cold call, you can rule the world.

There are lots of crappy sales books, but there are many good ones. I like SPIN Selling by Rackham; it's researched, reasonable, and most other solution selling books that came out afterward just repackage Rackham's results. I like Jeffrey Gitomer's Little Red Book of Selling. It's mostly about maintaining a positive attitude while people are telling you no. This is necessary, because selling is a goddamn emotional roller coaster. Watch out for books aimed at the hard sell. You can't hard sell a university.

Good luck!

</comment><comment><USER7> This is a consultative sale. Also, in academia, you're going to have very long sales cycles.

If I were you, I'd try to find a half-time independent sales rep and I'd have one hell of a website. There's absolutely no way that cold-calling is going to work the way that you think it is; it will take up too much of your time to do it correctly. (Honestly, my first recommendation is to stay the hell away from healthcare and education sectors, but looks like that ship has sailed.)

<comment><USER8> Agree with all points on consultative sales..

I'd like to also suggest to do some research into what kinds of conferences your clients go to. If it is a niche industry, there are probably one or two of these a year. You (and your sales rep, if you can find a good one) should absolutely go to these. Visit the trade booths, go to the happy hours, talk to everyone. If you can afford it, you should have your own professional looking booth.

Conferences are where potential clients will go to make a decision to buy, and it can often have more to do with your personal skills than your technology. Find out who has the budget or grant money and focus on them - don't spend too much time talking to people who aren't decision makers or who aren't in a position to buy - but don't blow them off either, because word of mouth is very important in consultative sales, and they may one day be potential clients, or they may refer you to someone that they know who is looking to buy.

Good luck!

</comment></comment><comment><USER9> Reseller and/or affiliate networks come to mind - let them do the selling for you, for a commission.

This would be easier to accomplish with traditional desktop-type software than a packaged web-app - but I would argue that it's not impossible.

You might consider resellers that are willing to work with a pay-per-lead, which likely would work in your favor (protecting your web-app source) more so than a pay-per-sale model. That way, the resellers send interested parties (leads) your way, but you close the deal - and no one gets your product without your say-so.

The normal "protect-your-source" issues arise, but those are out of the confines of this discussion, I think.

</comment><comment><USER10> I'd suggest just making a list of 10 potential clients... then research the organizations a bit and contact them and ask for a few minutes to present what you've done.

The key is to realize what you are selling. In the first 30 seconds of a phone conversation you're selling them on the idea that you are professional and that they should actually not hang up the phone...

The next step is to mention your product and to get them talking about their needs. Ideally they tell you a bunch of needs that your product perfectly addresses.

From there, you have to worry about logistics, such as who is actually going to make the purchase decision, etc. You should be prepared to work with their organization and process and to do as many phone calls and online demos as needed to get everyone comfortable with the product. Also realize that their purchase timeframe might not be immediate.

The main skill that professional salespeople have is the ability to efficiently get people to commit to a purchase. One develops a sixth sense for when to ask for the signed contract, etc. But with any new product, even a seasoned salesperson is going to have to do some learning about the typical customer, the product, etc.

I think the best thing to do is just ask "so what's the best way for us to proceed?" to your most trusted contact in the organization, and let them tell you how to sell to them.

If it's a high priced product, be prepared to have an in-person meeting before someone will write you a big check. Once you have signed a few clients then it may be possible to sign people over the phone.

The hardest sales are the first few, but it sounds like you already have some happy clients, so you should probably contact them and ask if they might feel comfortable talking to your potential future clients about the product, etc.

Also, be prepared that some may say "hey, we paid you to develop this and now you're selling our product to others?". You might want to offer them something in return (such as free upgrades) and discuss this with them up front to avoid any confusion, etc.

</comment><comment><USER11> I believe in keeping things simple. This project sounds like your pride and joy; you've put a lot of yourself into something that solves someone else's problem quite well.

Talk to them, understand their problem, and then show them how your software solves _their_ problem. Remember, it's all about them, not you. That's it. There are a lot of other details, but they are just that: details.

Focus on solving your customer's problem with your offering. Be yourself, care, and let the journey take you to their solution.

<comment><AUTHOR> Thanks, you are correct. I really have put a good amount of time into this niche and truly enjoy it, to the point where I just decided to drop a client so that I could give this my full attention.

What you describe is how it worked for my first set of customers. I solved the needs of the first person, and then for each subsequent customer, I was introduced by the previous one, met with them, and had a 'be myself' approach. There has never been any paperwork beyond a simple text file describing the work that will be done, and no one has ever signed a piece of paper. I just showed what I did for the previous guy and I believe they liked the fact that I wasn't really pushing a product, I just knew how to develop something that solved a problem for them. I am very comfortable with this approach and perhaps I shouldn't change it.

However, pretty soon I will have exhausted the potential clients in my local area since it's not a huge niche. My thoughts were that some other organizations might have different attitudes towards forking over a lot of money to one guy in blue jeans, and that maybe I would benefit from actually "learning" sales. This thought came from watching this particular interview:

<http://mixergy.com/maponics-darrin-clement/>

He focuses on a mapping niche, and describes how he was able to expand and sell more expensive software by actually taking formal sales classes.

I really would prefer not to do this and would prefer to just say "check out what I did for these other folks", but then again I'm willing to do what it takes.

<comment><USER8> > He focuses on a mapping niche, and describes how he was able to expand and > sell more expensive software by actually taking formal sales classes. I > really would prefer not to do this and would prefer to just say "check out > what I did for these other folks", but then again I'm willing to do what it > takes.

There are people out there who _live_ for this sort of thing. It's ok if your interests lie more in the technical side of things, but you should seek out a dedicated sales person who has a passion for it.

</comment></comment></comment><comment><USER12> 1) You price the product based on what the market will bear. If you say "it costs $50k" and they say, "great where do we sign?" you're probably selling too cheap. You need a few 'no's to tell where the top of the pricing range is.

How to guess the initial price? Ask your existing clients how much they'd pay for an off the shelf product.

2) Read up on Enterprise Sales - you're basically doing a small version of that. Academics and Unis are notorious for long sales cycles (years).

Good luck!

</comment><comment><USER13> I am in a very similar situation as you are. We have a very niche product that we sell to higher-ed. We sell it as a subscription model, which we allow them to pay X years upfront with a contract so that it more closely resembles a fixed-cost product to better fit their budgets.

As far as cold-calling goes, it really isn't worth it in this industry. The low conversion combined with the insanely long sales cycles just isn't right for a cold-call approach. That said, we've modified the cold-call approach by setting up Google Alerts for phrases which indicate a university that is ripe with need for our product, and then send them direct product information tailored to their specific needs.

We've also developed some internal software that helps automate this process. It has worked very well for us so far.

I would be very interested in talking with you further, as it seems we share a common market with common obstacles. Please feel free to shoot me an email.

</comment><comment><USER14> You're standing on a good industry podium, least you could do is have an email address in your profile. You never know who might be able to sell your software for you on a commission.

Don't hesitate to shoot _me_ an email :-)

</comment><comment><USER4> It sounds like you've been benefiting from referrals already. Don't give that up. Academics talk to each other you know. They also go to conferences. You might consider attending.

I do a lot of work for clients in the apparel industry and it's all been referral. I also try to go to the bit seasonal shows in Las Vegas and get my current clients to introduce me to other people they know there. Start conversations.

</comment><comment><USER15> You don't. Accept your failure, go out and get a job.</comment>


'Significant number' of people may have some natural immunity to coronavirus - <AUTHOR> https://www.telegraph.co.uk/news/2020/07/01/significant-number-people-may-have-natural-immunity-coronavirus/ <comment><AUTHOR> [https://archive.vn/J1YFz](https://archive.vn/J1YFz)</comment>


Google's Matt Cutts Admits SEO Will Only Get Harder - <AUTHOR> http://site-reference.com/articles/googles-matt-cutts-admits-seo-will-only-get-harder/

<comment><USER2> Sounds like it will be good for the web. SEO is a race to the bottom which makes all of our lives worse.</comment>


Search Risk – How Google Almost Killed ProtonMail - <AUTHOR> https://protonmail.com/blog/search-risk-google/ <comment><USER2> If the accusations are indeed true, it's disappointing behavior from Google. For a "Do No Evil" company, they certainly seem to be abusing their market position. We should, in the very least, demand a formal explanation.

<comment><USER3> Every since they made "do no evil" their position, it seems that evil has been redefined from "profoundly immoral and malevolent" to "anything I don't really like, even if it only slightly harms someone else's position".

<comment><USER4> Google is supposedly hiding a direct competitor to one of its main product from its search engine, the main entry of the Internet for millions of people that aren't very proficient with computers.

Google's product, Gmail offer considerably lower security and privacy than this competitor and using it instead of ProtonMail may very realistically get someone (a journalist, whistleblower, LGBT activist...) in deep trouble or even killed in lots of places and contexts.

I think this is a pretty evil move. Not only for this but what it represents when, again, millions of people were educated for years to enter the Internet through this search engine and don't have any clue that it may not only tamper with the order of the results but also hide websites.

<comment><USER5> If you are using ProtonMail for anything critical you're doing it wrong. It might be more convenient than other encrypted mail solutions, but it's in- browser cryptography with all the security issues that entails.

<comment><USER4> Sure it is not the best tool -- but depending on what means "critical" in your context it provides great security. Not against the NSA targeted attacks, sure, but if you're not so concerned about your adversary using exploits and more sophisticated tools (versus just demanding data from the provider or something like that) ProtonMail goes a long way.

Anyway it is, for most cases I can think of, much better than Gmail.

</comment></comment></comment></comment></comment><comment><USER6> I certainly upvoted this submission and use Protonmail regularly. They may soon be supporting PGP keys too, which would make them all the better. If I remember correctly, the Swiss recently got some attention for voting in favor of stronger surveillance, which surprised me. I wonder if it will affect Protonmail in any way. Here's a link from another "secure" email service that wrote about it: [https://tutanota.com/blog/posts/surveillance- switzerland](https://tutanota.com/blog/posts/surveillance-switzerland)

<comment><USER7> US tech companies make a decent living out of servicing the US Govt's requests. IF you dont want to be spied on dont use US Tech, it could not be more simple than that.

</comment></comment><comment><USER8> How can I help break up the monoculture? I try to check in to DDG every few months but I'm just not satisfied with the results.

</comment><comment><USER9> It's common for ranking to change, even wildly, when significantly changing a website. Especially changing its address!

So what's the theory, Google waited and waited, watching and hoping that protonmail would change their address, to give them cover to change the ranking manually?

</comment><comment><USER10> Who did they rank instead of ProtonMail?

</comment><comment><USER3> People seem to think that search is meant to be unbiased, thus any bias added after the fact is not just bad but is malicious just by being there.

But... even if the worst is true, and Google treats its search results like its own personal pulpit, is that so bad? Should Google be required to advertise for _all_ its competitors in _every_ field, just because they happen to have a website?

Google's algorithm is secret; there's nothing to imply that its results are anything except editorials.

<comment><USER11> > But... even if the worst is true, and Google treats its search results like > its own personal pulpit, is that so bad?

Yes.

[http://fortune.com/2016/10/24/google-antitrust- eu/](http://fortune.com/2016/10/24/google-antitrust-eu/)

[http://www.cnbc.com/2016/07/19/google-could- face-3-separate-...](http://www.cnbc.com/2016/07/19/google-could- face-3-separate-antitrust-cases-eu-competition-chief.html)

<comment><USER3> Well, I guess that answers the question of if its bad for Google's bottom line once caught, but I was questioning if it was immoral in general.

Plenty of things are unpopular, or illegal, or annoying but not necessarily immoral.

<comment><USER2> Anti monopoly laws name it illegal for Google to hide it's competitors deliberately. No one on this thread believes it's not immoral for Google to be doing this</comment></comment></comment></comment>


Wikipedia's 'Longest-Running Hoax' About Fake Warsaw Death Camp Revealed - <AUTHOR> https://www.algemeiner.com/2019/10/06/wikipedias-longest-running-hoax-about-fake-warsaw-death-camp-revealed/ <comment><USER2> > they're trying to equate what happened to the Jews during the Holocaust to > what happened to Poles during the Holocaust.

Well, Poland lost 6 million citizens during the WW2 and Jews lost the same amount - the tricky part is half of Polish casualties were of Jewish origin. So I don't believe anyone could equate these two - not to mention the fact that being Jewish meant you're practically dead if you couldn't find any helpful Poles, whereas if you were a Pole you had some chances of survival.

</comment><comment><USER3> >Wikipedia had an entry for more than 15 years on its English-language website about a death camp in Warsaw during the years of the Holocaust that did not exist in real life, Haaretz reported on Friday.

why not link to the actual story

[https://www.haaretz.com/israel-news/.premium.MAGAZINE-the- fa...](https://www.haaretz.com/israel-news/.premium.MAGAZINE-the-fake-nazi- death-camp-wikipedia-s-longest-hoax-exposed-1.7942233)

</comment><comment><USER4> Inevitable when there is a lack of respecting authoritative, primary sources:

[https://futurama.fandom.com/wiki/Whalers_on_the_Moon](https://futurama.fandom.com/wiki/Whalers_on_the_Moon)

</comment><comment><USER5> Blogspam</comment>


Warning: Google Authenticator upgrade loses all accounts - <AUTHOR> I upgraded Google Authenticator to the latest version this evening on my iPhone.  It lost all my accounts.
DO NOT UPGRADE Google Authenticator or you'll have a really bad day.
People on Twitter are starting to complain: https://twitter.com/search?q=google%20authenticator&src=typd <comment><USER2> Too late for me, but a pleasingly fast and pro-active response from AWS (which rather shows Google up) just received by email:

"If you are an AWS customer who uses Google Authenticator for iOS as a multi- factor authentication device to secure your AWS account via AWS MFA ([http://aws.amazon.com/mfa/](http://aws.amazon.com/mfa/)), please read on. We are writing to inform you that Google has recently released an update to the Google Authenticator App in the iOS Store. We've received reports indicating this update is inadvertently deleting all MFA tokens from the smartphone; this could prevent you from authenticating to your AWS account.

At this point, it is our recommendation that you do not update your Google Authenticator App if you're using an iOS Device. If you have already updated your Google Authenticator app and are no longer able to login successfully you can request assistance from our AWS Customer Service team at:

[https://portal.aws.amazon.com/gp/aws/html-forms- controller/c...](https://portal.aws.amazon.com/gp/aws/html-forms- controller/contactus/aws-token-support)

We have posted this as an announcement to our AWS Developer Forums at [https://forums.aws.amazon.com/ann.jspa?annID=2091](https://forums.aws.amazon.com/ann.jspa?annID=2091) and will be posting updates if new information becomes available."

<comment><USER3> And no word yet from Google... Their lack of customer service is going to end up killing them in a number of markets. I would never use Google for any critical business function (email, payments, cloud computing).

<comment><USER4> They'll join this thread in a while and call us all novices for not understanding that this is deliberate, well tested, and our fault.

[https://news.ycombinator.com/item?id=6166886](https://news.ycombinator.com/item?id=6166886)

<comment><USER5> I don't think the people arguing with Justin in that thread are novices or naive users, but they do seem to be unaware that when you lend your computer to someone, you should set them up with their own user account if you don't want them surfing through your stuff.

It's funny how the tech community browbeat Microsoft for years about how Windows should have been designed as a multiuser system like Unix, and then when Microsoft finally took their advice and made the necessary user-level security improvements, their efforts were ignored.

<comment><USER4> Afraid you've missed the point in the same way as Justin did... Those people (me included) are perfectly aware of that. The argument is that your mother isn't, and while it's reasonable to expect her to be, you can't just assume such.

<comment><USER5> If so many people are missing the point, then maybe, just maybe, there isn't one to miss.

<comment><USER4> The majority are always right, for a subjective and wide definition of right.

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> Authy (YC W12, [1]) is a nice replacement for the GA app. Besides being more stable, it has also the "benefit" of allowing you to back up your keys, and recover in the case of a lost phone or deleted app.

Thankfully, backing up is entirely optional, and turned off by default. While they claim backups are encrypted with PBKDF2 [3], I still would never ever use something that sends my tokens to a remote server, as it'd defeat the purpose of 2FA in the first place.

Still, I can see the use for casual users that care enough to have 2FA, but not _that_ much to worry about tokens being stolen and decrypted from Authy..

Past discussions on HN here [2], [3], [4].

[1] [https://www.authy.com/thefuture](https://www.authy.com/thefuture) [2] [https://news.ycombinator.com/item?id=6133648](https://news.ycombinator.com/item?id=6133648) [3] [https://news.ycombinator.com/item?id=4916983](https://news.ycombinator.com/item?id=4916983) [4] [https://news.ycombinator.com/item?id=4330050](https://news.ycombinator.com/item?id=4330050)

<comment><USER7> Authy wants to 'make data available to nearby bluetooth devices' and – even if you don't allow for it – asks for Bluetooth to be turned on. What's the reason for this requests?

I'd appreciate an application directly in the app. In doubt, I simply deny such requests.

Screenshots:

[http://i.imgur.com/jTC5msY.png](http://i.imgur.com/jTC5msY.png) [http://i.imgur.com/seytfhy.png](http://i.imgur.com/seytfhy.png)

<comment><USER8> Authy has a desktop client that can request tokens from your phone via Bluetooth, so you don't need to generate a token and type it in manually.

[https://www.authy.com/thefuture](https://www.authy.com/thefuture)

<comment><USER9> Good, so when the user requests a bluetooth connection you ask for permission or tell the user to turn bluetooth on

Don't ask the user to approve something he: doesn't know what you want to do with it and the thing screams "don't do it" at the particular situation

</comment></comment></comment></comment><comment><USER10> Aside from the screwup here, this is a good chance to check backup mechanisms for your various 2FA accounts. If your phone is broken or stolen, do you have a recovery plan?

I keep backup codes for each of my 2FA services in a Truecrypt container, which is mirrored on Dropbox. Additionally, I keep a copy printed out and kept in a fire safe. Phone backups for personal accounts have my wife's phone on record, and I try to keep printed copies of the QR codes I used to set up the account.

About a year ago, my phone was shattered while on the road, and while I was able to regain access to those accounts due to existing login sessions on my home computer, I'd have been sunk without them. Make sure you have a plan for what you do if your phone authenticator becomes unavailable.

</comment><comment><USER11> A while ago the Android version was replaced by a new app (instead of just an upgrade), allegedly because the team _LOST THE SIGNING KEY FOR THE ORIGINAL APP_ [1].

If there is one team you'd expect not to lose a signing key I would have thought it would be that one!

Everyone makes mistakes, but it's pretty scary to hear this happening too.

[1] [http://www.androidpolice.com/2012/03/22/psa-googles- authenti...](http://www.androidpolice.com/2012/03/22/psa-googles- authenticator-updated-to-v2-except-its-a-brand-new-app-and-you-need-to- install-it-to-get-future-updates-old-one-is-dead/)

<comment><USER12> The other option is if you are a developer and want ultimate control the app is open source. For maximum convenience aught.

</comment></comment><comment><USER13> If they had released this two weeks later, iOS 7's auto-update feature would have bricked everyone's accounts.

Google Auth 2.0 redefines two-factor auth: something you know + something you DON'T have. Their entire purpose in life is this second part and they completely and absolutely botched it. I can't believe this passed testing at both Google and Apple. There wasn't even a warning in the release notes.

<comment><USER14> I think Google's thinking on this is that 2FA tokens are definitely "one of those things you don't want stored in an subpoenable manner by your Cloud provider." If your 2FA token is synced to iCloud, for example, then it's no longer something you _have_ \--it's something else you _know_ (your iCloud username+password.)

"Something you Have"-type tokens provide security basically because they're immune to rubber-hose cryptanalysis: if you really just don't have the key to a safe, nothing an attacker does can make you give it to them. As such, tokens are _also_ the factor that protect you from contempt-of-court charges if you're compelled to provide it. (Though they _can_ then ask you "who _does_ have a key?"; if this is an accomplice, it's best if they live in a separate country, and hopefully one which doesn't like the US very much.)

<comment><USER15> I don't think this argument makes any sense with regard to TOTP, as Google (or Dropbox, Twitter, etc.) most certainly knows the seed/secret for your account at their service and could be forced to divulge it via court order. Or they could simply cough up the plaintext data sans faffing about with 2FA at all. 2FA of this sort only makes it harder for an attacker to get in.

Defense against rubber hose cryptanalysis comes into play where the key only exists in one place, such as the asymmetric private key on hardware security module, or perhaps a symmetric key stored on a physically-unavailable USB key. But 2FA like TOTP does not imply encryption, even though it relies on some cryptographic primitives.

<comment><USER14> Keep in mind that Google Authenticator stores _arbitrary third-party_ credentials, though. Subpoena Google and you could get Google's TOTP token for you, along with the rest of your account, sure. Sync Google Authenticator to Google, and suddenly they don't have to subpoena anyone else--just use their Gmail account to reset all their passwords for every other service, and use their TOTP tokens to sign into them. This basically removes the "Principle of Least Privilege" way that subpoenas work.

</comment></comment></comment></comment><comment><USER16> For those looking for Google Authenticator alternatives, I recommend either Duo Mobile from Duo Security or Authy. I ditched Google Authenticator a while ago and haven't missed it one bit -- having a single app manage my two-factor tokens / keys is much more convenient.

<comment><USER17> Edited: Authy requires a mobile number and a remote server to store your tokens though.

<comment><USER18> > Both require your mobile number and for a remote service to store all of > your tokens though..

Duo does not, for the record. Download and go.

<comment><USER17> I seem to have recalled that one wrong then, or they've changed their service since I last saw it.

</comment></comment></comment></comment><comment><USER19> This is why you keep backups of your TOTP authenticator keys. I was really put off by 2 factor until I figured a way to do a backup. Authenticator URLS look like this:

otpauth://totp/KeyNameHere?secret=SECRECTKEYSTRINGHERE

You can save it in some passworded zip archive somewhere or print it out. If you print them I suggest printing them with QR codes to aid in recovery speed. You can easily generate QR codes by putting the text URLs into a QR code generator. If you just have a QR code, use a general QR code scanning app to extract the string.

Also the new google authenticator version has a %100 repo crash bug when you scan two QR codes in a row on iOS 7 phones.

</comment><comment><USER20> Quick solution for Google 2-step auth (do it QUICK so you don't lose access to your Gmail)

1) Go to this page [https://accounts.google.com/b/0/SmsAuthSettings](https://accounts.google.com/b/0/SmsAuthSettings)

2) Click "Move to a different phone"

3) Re-setup your Google Authenticator

Note: the 10 printed one-time access codes and all the application-specific passwords will still work after this "reset". But you still need to reset your other accounts that use the Google Authenticator

</comment><comment><USER21> I use Google Authenticator on the 2 AWS accounts I manage. Fortunately, at least on the first, the master account didn't have 2FA on it, so took about 60 seconds to reset it. (remove device, then readd) However, most wouldn't have the master account (the entire purpose of IAM).

I suspect that Google may have an update that restores accounts. I know when I've restored my phone, losing all apps, when I reinstalled an app months later, the settings were still there. Obviously the settings are stored in a file somewhere, so my hope is that this is how Authenticator works, and this buggy release just failed to properly open that file. Of course, not everyone can wait and have to reset like I did.

</comment><comment><USER22> When I add sites to Authenticator, I take a screenshot of the QR code and tuck it away in an encrypted document (OneNote for the record, which uses uses AES to encrypt).

<comment><USER23> Have you tested this? Are the barcodes not time pertinent?

<comment><USER24> (I've studied two-factor authentication using HOTP and TOTP, and built a node.js implementation of it.)

The QR codes simply divulge a URI with the secret key for generating tokens. They look like:

      otpauth://totp/[keyname]?secret=[secretkey]

The secret key is used in the app in conjunction with a moving factor (usually 30-second intervals of time) to generate a numerical hash of sorts for that interval of time, which is then truncated to 6 characters.

The QR code itself doesn't have any sort of time limit on them; they only serve to transmit the secret key.

<comment><USER23> Would this mean that these two values are stored locally? Could they be extracted from the GA app?

<comment><USER24> Technically, yes. The name of the key is set by default as the account name in the app. I haven't looked into how the secret is stored in the Google Authenticator app—hopefully it's stored securely or with some level of obfuscation, but the app definitely needs to be able to retrieve the secret key somehow to do the token calculation.

One thing to note is that neither Google Authenticator nor Duo Security let you display the secret itself in the app. Another thing to note is that Google Authenticator keys seem to be backed up if you back up your iPhone to a computer using iTunes (mine were still there after a restore).

<comment><USER25> If you've disabled the built in protections on Android for the /data/data/ folder (such as "root"ing it), getting the keys out is as simple as:

$ su

# sqlite3 /data/data/com.google.android.apps.authenticator2/databases/databases 'select email, secret from accounts'

</comment></comment></comment></comment></comment></comment><comment><USER26> Every time I upgraded to a new iOS 7 beta, it wiped my Google Authenticator account tokens. It wasn't a big deal with Google or Dropbox because both allow me to move. But I can't log in to my CampBX account anymore. I tried Authy today after another comment here on HN and it's been working so far.

</comment><comment><USER27> What does it mean that it 'loses all accounts'?

I use two factor auth but not this app, so I am not sure why people are going to have such a bad day...

<comment><USER2> You get greeted by a "let's begin" screen, and all your accounts/credentials have magically gone away. This happened to me 5 minutes ago.

Edit: tweet with picture: [https://twitter.com/jawj/status/375144792126410752](https://twitter.com/jawj/status/375144792126410752)

<comment><USER28> So your account has not gone away, nor has it been deleted, nor has any magic happened; your account is still there safe and sound on Google's servers, it's just that the settings in this one mobile app have been wiped, correct?

<comment><USER29> Without the settings in your authenticator you're locked out of accounts that require a 2-factor token from it, unless you've got backup tokens printed out.

</comment></comment></comment></comment><comment><USER12> This was a perfectly functional app except that it didn't look like google+. I would recommend switching to authy (YC) bc their Bluetooth 4.0 LE implementation is awesome: [https://www.authy.com/thefuture#pairing](https://www.authy.com/thefuture#pairing)

</comment><comment><USER30> This is the sort of "nightmare scenario" I'm afraid of, and why I'm still not using 2FA. I'd rather risk having only a weaker password, than risking losing my accounts for good. You can't get back into your accounts if something like this happens, right?

<comment><USER31> To get back into your account you're provided backup codes that you're supposed to store somewhere safe. Otherwise, if your phone were stolen you'd be out of luck, yes.

<comment><USER32> I was about to respond "Haha, no big deal, I use my Google Voice number". The flaw in this was readily apparent.

</comment></comment></comment><comment><USER33> To disable auto-update on recent Android:

Play Store -> Search "Authenticator" -> Select "Google Authenticator" -> Press "Menu" -> Deselect "Auto-update"

<comment><USER34> I don't think this is happening on Android, seems to be an issue with an iOS update.

<comment><USER35> I think this is a good reminder to use the auto-update feature wisely, on all platforms.

</comment></comment></comment><comment><USER36> I saw Google Authenticator had an update this morning and thought "haha, wouldn't it be awful if it deleted the accounts when I updated!" Well, I guess I'm the goat [1].

I was still signed into Google so that was easy enough to generate a new key, but I believe I'm going to have to use my backup number to get into Dropbox.

[1] [http://en.wikipedia.org/wiki/Duck!_Rabbit,_Duck%21](http://en.wikipedia.org/wiki/Duck!_Rabbit,_Duck%21)

</comment><comment><USER37> The broken update has now been pulled.

</comment><comment><USER38> Use HDE OTP, its a better looking app anyway.

</comment><comment><USER39> Do Google even test the stuff they put out? This is a pretty severe mistake to make for a company as big as Google. Do they not have teams dedicated to testing this stuff? The small design studio I work at does a better job QA'ing their websites than Google does QA'ing major product upgrades... Disgraceful.

<comment><USER40> Don't be ridiculous. Of course they QA their projects. Shit happens. This issue is of a serious enough nature affecting enough people that there will almost certainly be a proper route back.

</comment></comment><comment><USER41> Man, someone is going to have a really really bad day tomorrow.

<comment><USER24> Someone should be having a really bad day right now. The app needs to be pulled from the App Store immediately.

</comment></comment><comment><AUTHOR> If you offer two-factor authentication for your website, be prepared for a surge in support requests today. When I talked to one of my providers on the phone, they stated they are already getting a surge in calls because of this app update.

</comment><comment><USER42> I used my Pebble watch for TFA. You have to compile the app yourself but it's pretty easy. [https://github.com/aaronpk/pebble- authenticator](https://github.com/aaronpk/pebble-authenticator)

</comment><comment><USER43> Don't upgrade! I just had this unpleasant experience and warned everyone about 15 minutes ago: [https://news.ycombinator.com/item?id=6325745](https://news.ycombinator.com/item?id=6325745)

</comment><comment><USER44> I'm not seeing the update in the App Store, nor the app itself. Must be pulled.

</comment><comment><USER45> What an absolutely awesome time for iTunes Connect to be down for maintenance.

<comment><USER5> Almost as if Apple is twisting the knife.

</comment></comment><comment><USER46> The Authy app is great and supports Google, Dropbox, CloudFlare, Amazon…

</comment><comment><USER47> Shit. I am running the iOS 7 beta with automatic app updates, and I already have the new app.

I am considering wiping my phone and restoring it from a previous backup with the old copy of the app.

Edit: I was still logged in from my browser, and was able to activate the new version without entering a code from the deceased version of the app.

From this, it seems theft of your cookies could let an attacker completely take over your account and two-factor device if they know your account password and you have chosen to trust the victim computer.

<comment><USER48> If you have a password on your backups, the codes are in your backed-up keychain. (Google Authenticator doesn't mark its keychain entries as "keep on device".) You'll need to patch iphone-dataprotection to handle a the iOS7 keychain format (I added a patch to the bug tracking database.)

</comment></comment><comment><USER49> I'm just gonna point out that the previous update was somewhere around 2 years ago, and it's just _now_ getting retina, so we should be glad there's even this much.

<comment><USER50> Yeah, now I can view my missing one time codes in retina, edge to edge quality. Yay!

</comment></comment><comment><USER51> Unrelated to this particular snafu but still potentially problematic: if you have your Authenticator account named by its default name (firstname.lastname@example.com) and you add another account with the same key, it will be blindly overwritten. I found this out the hard way after scanning my Meraki 2FA QR code that was tied to the same email that already had Google 2FA.

ProTip: rename your auth entry to something like "Gmail foo@example" to avoid this problem, whether malicious or accidental.

</comment><comment><USER52> Luckily got a AWS reminder. And a shameless plug... my own 2FA app on [http://gauth.apps.gbraad.nl](http://gauth.apps.gbraad.nl) can be used everywhere you have a webbrowser, offline when your browser supports it and updates without problems when a new version is available. Besides, no updates were needed in months due to good QA. ;-)

</comment><comment><USER50> Fuck you, Google. Fuck you.

<comment><USER53> Shit, I am fucked by Google as well ... :(

</comment></comment><comment><USER54> What I worry about is a hacker feigning to be another user and claiming that they can't access their google account anymore because of a botched update.

I guess Google support might get too many reset requests to show due diligence in verifying authenticity of the requests.

</comment><comment><USER55> Not an iPhone user, but I wonder if you could access the key data manually and restore it afterwards?

On Android that's possible (if you have root....) by accessing the key database (sqlite in that case). I did that to duplicate the keys from my handset to my tablet.

<comment><USER56> Yes, if you have synced with iTunes before the update. If that's the case you have to delete the updated app from the phone, connect phone to iTunes (do not sync or transfer purchases) and copy over the old app from iTunes to phone and it will restore the old version + app data.

<comment><USER57> didn't work for me - app was restored but not data

</comment></comment></comment><comment><USER58> Just in time for Github to add 2FA.

</comment><comment><USER59> Chris Messina has a solution: [https://twitter.com/chrismessina/status/375118991280205824](https://twitter.com/chrismessina/status/375118991280205824)

<comment><USER60> That's only good for Google accounts. Dropbox and others aren't reset as easily.

<comment><USER61> Dropbox has the option to add a backup SMS phone number in addition to offline TOTP code. Here are some other steps you can follow if your Google Auth app got wiped:

\- [https://www.dropbox.com/help/364/](https://www.dropbox.com/help/364/)

</comment></comment></comment><comment><USER62> Don't forget that Duo Security's mobile application supports Google Authenticator (and any other TOTP-enabled service). It also has already been working on iOS 7 for weeks.

</comment><comment><USER49> I actually just switched to Duo Mobile earlier today because of iOS 7 issues with Authenticator; this just cements my decision to switch.

Edit: oddly iOS 7 hasn't autoinstalled this yet.

<comment><USER18> > I actually just switched to Duo Mobile earlier today because of iOS 7 issues > with Authenticator; this just cements my decision to switch.

I moved all my non-critical stuff over (to test it out), saw the Google Authenticator update, and then had to go and reconfigure those accounts anyway.

I highly recommend making sure your backup phone number is updated _and_ verified and/or you have backup codes prepped.

<comment><USER49> Luckily I was still logged into all my accounts (my Dropbox account suddenly dropped from Google's app like a week ago)

Duo seems to be quite nice, I doubt I'll end up using the backup codes.

Incidentally, GitHub has it right - "download a text file of your backup codes" is much easier than "print this page nad hope you don't lose it"; I find find(1) outpaces my frantic drawer-emptying.

<comment><USER63> I've just noticed that Google has the download-as-text functionality now too.

<comment><USER64> I wonder how many machines have those backup auth token text files sitting on the Desktop or in the Downloads folder?

</comment></comment></comment></comment></comment><comment><USER65> Related: will iOS 7 let you turn off the auto-update feature?

<comment><USER66> Thankfully yes it does.

</comment></comment><comment><USER67> Does this affect android? my phone is off and I am not turning it on until I can somehow disable auto update from the play store from web.

</comment><comment><USER68> Happened to me as well, fortunately I disabled 2FA on my Dropbox account before the upgrade, thanks to this warning!

</comment><comment><USER69> Thanks for the heads-up all! Looking forward to actually being able to distinguish Authenticator accounts on iOS 7.

</comment><comment><USER70> iOS7 beta automatically updated my Google Authenticator. The 'updated app' indicator is taunting me.

</comment><comment><USER71> This is the most pressing and actionable information I have ever gleaned from a news site. Thank you!

</comment><comment><USER72> this is especially bad for mtgox as it does not have backup codes or cellphone backup.

</comment><comment><USER73> lesson learned : do not upgrade anything unless you read some feedback about it.

</comment><comment><USER74> Is anyone else just happy that the assets will finally be high-res? :P

</comment><comment><USER75> I recommend using the Authy app instead, it's much better

</comment><comment><USER76> I'm just glad it works full screen on the iPhone 5.

</comment><comment><USER77> Some guys really needed retina support. Now you got it.

</comment><comment><USER53> Damn it... This is stupid, I just upgraded too.

</comment><comment><USER78> Thanks for letting us know.

</comment><comment><USER79> I cannot fathom why people still rely on Google for their core business needs.

At my last place of work I built an SMS system to be used as the second factor in the intranet login. I _could_ have used a 3rd party 2FA, but the most _logical_ reason to have our own system was ... well.. we didn't want to rely on anyone except ourselves.

Didn't take me long and the most difficult part was finding enough USB- connected phones to be used as SMS senders.

Guess what? The system still works today, why Google is broken.

<comment><USER80> > didn't want to rely on anyone except ourselves.

And the remarkably secure telecom system, of course.

Google's style of 2FA is IMO technologically superior in that there is no communication after the initial seed. It also appears to be somewhat standardized -- see others posting about Authy. You could have your own handwritten program running the algorithm if you wanted to be independent.

The real screw up on Google's part is not instructing users to have an encrypted backup of their 2FA data.

<comment><USER34> Well, they do instruct people to print backup codes.

</comment></comment></comment><comment><USER81> Somewhat related, but when I setup two factor authentication I securely saved the initial TOTP tokens (using barcode scanner to extract it) for exactly this sort of situation (well in my case it was that I switched smartphones enough that having it tied to one was nonsensical).</comment>


Founders Fund Raises $1.3B - <AUTHOR> http://blogs.wsj.com/venturecapital/2016/03/25/peter-thiels-founders-fund-bags-1-3b/ <comment><USER2> I'm curious what people's experiences have been with Founders Fund investing in your companies. feel free to answer anonymously.

<comment><USER3> Responding anonymously to show there's no incentive to give praise. They led our (largish) seed round.

Had a slightly negative experience with one partner, but the median person we worked with beat most firms we talked to in first principles thinking by quite a margin. They were all very bright and had a wide range of knowledge.

They were far less interested in "who else is in" and more interested in your analysis of your business from basic building blocks.

When we were doing due diligence on them, the main "complaint" we heard from people who had raised from them is that it's hard to read their judgement. They may seem bearish on you then invest last minute or the opposite. Most people had great things to say though.

Hope this is helpful for anyone considering talking to them.

<comment><USER4> Hi ffceo,

Thanks a lot for your comment on FF. Feedbacks on investors are important for entrepreneurs, but unfortunately hard to find. I know too many entrepreneurs who spent too long time chasing investors who are unresponsive, unhelpful, or worst ("zombie investors").

The comments from you and nickpinkston above actually inspired me today to put together a little project called "Rate Our Investor" [https://news.ycombinator.com/item?id=11378769](https://news.ycombinator.com/item?id=11378769). It is a crowdsourced spreadsheet that collects entrepreneurs' feedback on investors. Hopefully you don't mind the plug =)

Thanks again for the inspiration!

</comment></comment></comment><comment><USER5> I wonder how the 1.3B will be distributed ?

How much capital allocated to invest in each startup ? What is the algorithm used to generate the investment decisions ? How do they judge which founders to fund ?

<comment><USER6> We're thinking of opening a fund for Baqqer to invest in startups/founders there, so I think about this. I would typically value the worthiness of a founder by several loose criteria:

1\. Founders/Product fit 2\. Product/Market fit 3\. Social Proof 4\. Team 5\. Progress and frequency of activity 6\. Dedication 7\. Grit/Character 8\. Past successes/failures (overall experience)

<comment><USER7> take facebook:

1: Mark Zuckerberg wasn't a particularly social guy, so his founders/product fit was 0.

2\. product/market fit: Facebook was a social network just for schools, this doesn't really show any product/market fit. it's a super niche product with no obvious revenue model.

3\. founder had zero social proof. couldn't even bag any advertising clients.

4\. founder didn't get along great with team, in fact all team members sued him.

5\. the very first verison of the site looked and features it had in 2004 - [https://www.quora.com/What-did-the-first-version-of- Facebook...](https://www.quora.com/What-did-the-first-version-of-Facebook- look-like) does not show that much progress or activity.

6\. Mark was just a Harvard student, so were the other team members, no dedicated staff at all.

7\. No basis to judge.

8\. No prior past experience to judge from.

Based on the above there is a 0.00% chance that you would fund Facebook at the seed stage, at any valuation. Out of 8 standards, you would have to give them a 0/8 on nearly all of them.

but hey, the fact that your investment thesis fails with _perfect_ hindsight, doesn't mean it can't succeed when things are a lot more murky. go get 'em.

<comment><USER6> Zuck was on IRC coding at the time, IIRC. He had also built and launched some other software before Facebook.

Coming out of that era with that cred would put him higher than most at his age.

<comment><USER7> You misunderstand. My point is lowglow would not have given those things weight. So even with perfect 20/20 hindsight, we know that based on his 8 criteria he would have Facebook a No thanks.

(More specifically, he wouldn't have given them the time of day or even so much as returned an email, a 0/10 across 8 categories means that it's not worth so much as a reply.)

EDIT: I didn't realize you're lowglow. My point stands. You need better investment criteria :)

<comment><USER6> Which is why I said "loose" criteria, not a rigid ruleset. ::)</comment></comment></comment></comment></comment></comment>


The full costs and income of a £1M indie film - <AUTHOR> http://stephenfollows.com/the-full-costs-and-income-of-a-1million-indie-film/

<comment><USER2> Great find, thanks for posting.

As the author points out, it's very unusual for anyone to be in the position of financing a decent-size production budget out of their own pocket. Generally that means investors who get first position on repayments from gross revenues, 25% interest, and 50% ownership of subsequent profits. Payment of deferred salaries, profit participation for actors and so on usually comes out of the producer's half.

</comment><comment><USER3> I know most of you guys here aren't in film/tv production, but this is more or less similar to the music industry. More or less. This is a great area for 'disruptive' platform to explore. Please do.</comment>


Strange Emails from Square - <AUTHOR> Just got some strange emails from what is supposed to look like Square, the sign-in link leads to a fake Square sign-in box.
Here's a copy of the email I received from a person named King, Kelly:
Payment - Square Payment

       [https://square-production.s3.amazonaws.com/images/email/05-29-transactional-assets/jewel_header.gif]

 Hello,
We are sorry, all payments on your account has been placed on pending. This was as a result of some unusual activities detected on your account. Kindly use the dashboard portal bellow to authorize all payments place on pending on your square account. Visit your Dashboard bellow to authorize all  deposit on your square account.
Dashboard<http://hthrifo.com/HOP/Square/>
Ensure to always Login properly, when using the login portal. Thank you. © 2016 SQUARE, INC. ALL RIGHTS RESERVED ?
________________________________ This electronic message, including any attachments, is intended only for the use of the individual or entity to which it is addressed, and may contain information that is privileged, confidential and exempt from disclosure under applicable law. If you are not the intended recipient, you are hereby notified that any dissemination, distribution, or copying of this communication is strictly prohibited. If you received this electronic communication in error, please contact the sender immediately and destroy this electronic communication in its entirety. Email sent to or from Upper Iowa University may be retained as required by law or regulation. Thank you for your cooperation. <comment><USER2> Square employee here. Looks like a phishing scam to me, thanks for sharing it.

I don't work on that stuff myself, but you can forward the email to email@example.com and we'll do whatever we can to take care of it.

</comment><comment><USER3> In that case email [https://squareup.com/security](https://squareup.com/security) (email address at the bottom of the page)</comment>


Google translates German "halb zwei" to French "deux heures et demie": 1h off - <AUTHOR> https://translate.google.com/#de/fr/halb%20zwei <comment><USER2> To help my fellow English-speakers:

"halb zwei" ("half two") is the German idiom for "halfway [between one and] two o'clock"

"deux heures et demie" ("two hours and one half") is a much better cognate for the English "half past two o'clock"

We're all used to off-by-one and fencepost errors. To be honest, this is probably a less interesting one of Google translate's mistranslations. But it's one that's very mechanical and we would expect a machine to get something like this right.

<comment><USER3> To make things even more confusing, "half two" means 2:30 in the UK and Ireland.

<comment><USER4> Unlike the German and French versions, that doesn't make any sense at all.

<comment><USER5> It's a colloquial contraction of "half past 2". To me, the German makes no sense - half of 2 is 1.

Agreed though that the French is the most easily understood internationally.

<comment><USER6> If you think of the minute hand needing to complete the full circle to reach 2, "Half two" means the minute hand has only completed half that circle, so it's 1:30.

I've even heard of "three quarters (of) two" in German, which means 1:45.

<comment><USER7> You probably mean the German expression "dreiviertel zwei". This expression is however not used everywhere in Germany because in other regions it may be said as \- "viertel vor zwei" (approx. "quarter to two") or \- "Dreizehn (Uhr) fünfundvierzig"/"Ein Uhr fünfundvierzig" (The exact time as you would read it off of a (digital) clock/watch)

When I imagine it from the English-speakers perspective, I think "viertel" (quarter), "halb" (half) and "dreiviertel" (three quarters) are probably to be understood like this:

"halb zwei" = "half two" = "1/2 2" = (2 - 1 hour) + ((1/2) * 1 hour) = 1.5 = 01:30

</comment></comment></comment></comment></comment></comment><comment><USER8> Um halb drei -> À trois heures et demie

Um halb drei gehen -> Aller à deux heures et demie

Um halb drei gehen wir -> A quatre heures et demie nous partons

Um halb drei gehen wir ins Kino. -> A trois heures et demie nous allons au cinéma.

<comment><USER8> For DeepL:

-> À trois heures et demie

-> 14 h 30 du soir,

-> À 14 h 30,

-> On va au cinéma à 14h30.

Correct for everything but the first, not sure why it added "du soir". For the a complete sentence "Um halb drei gehen wir." it's also correct ("On part à 14h30.").

<comment><USER9> As far as I can tell it's _in_correct in every instance except the first:

      À trois heures et demie = À trois heures et demie

      Aller à deux heures et demie =\= 14 h 30 du soir [1]

      A quatre heures et demie nous partons =\= À 14 h 30 [2]

      A trois heures et demie nous allons au cinéma. =\= On va au cinéma à 14h30 [3]

[1] misses the "to go" part and also gets the time of day wrong- which is important because it uses 24-hour clock notation (and so it's obvious that it has no idea what 14h30 means).

[2] completely misses the action ("nous partons") and gets the time wrong ("quatre heures" is " _four_ o'clock", not 14).

[3] Still gets the hour wrong (14h30 to "trois heures", i.e. three).

You'd certainly wouldn't want those translations to "help" you with your appointments in France, or Germany.

<comment><USER8> I was only referring to the time. "halb drei" is two thirty, which usually means 14:30 unless you specifically say "in the morning". The action in [2] would probably be added if you add a full stop.

<comment><USER9> The time is also wrong, in three out of the four cases above.

</comment></comment></comment></comment></comment><comment><USER10> Same when translate it to Spanish: Dos y media.

On the other hand, it is correctly translated to Dutch (half twee), and English (half past one).

If you translate English to Spanish and French, then the correct time appears.

On the other hand, from Dutch to Spanish/French, it does not know it's time, and does a literal translation -> half of two.

</comment><comment><USER11> i hate this kind of time communicating

in austria there is

"viertel zwei" \- quarter two

which in one part of austria (vienna) means 1:15pm (or 1:15am), in the other half (90% of austria) it is understood as 1:45pm (or 1:45am), sometimes as 2:15pm (or 2:15am) - but never as 1:15pm/am

"viertel [vor/nach] zwei" \- quarter [to/after] two. the [] are optional.

<comment><USER12> Wait, why does "viertel zwei" mean 1:15? What's "viertel eins"?

<comment><USER13> Viertel zwei = a quarter of the second hour has passed, i.e., it's 1:15. It's a logical extension of the standard-language "halb zwei". But note that this is only used and understood in some German-speaking regions, not all!

<comment><USER14> It works the same in Catalan: un quart de dues is 1:15, as in "one quarter of the hour 2". If we go full into it, we have as valid and used constructs "un quart i mig de dues" for anything around 1:21-1:23 (one quarter and a half of 2, which would be 1:22.5)

</comment></comment></comment></comment><comment><USER15> Germans like to reference time relative to the half hour, e.g. "fuenf vor halb drei" for 2:25 or even "zehn vor halb drei" for 2:20, etc.

Do other cultures do that?

Also, google gets "fuenf vor halb drei" wrong but "fuenf vor halb zwei" correct, it seems pretty random. "Fuenf nach halb eins" is 1:35 instead of 12:35 and "fuenf nach halb drei" is 5:30 instead of 2:35!

<comment><USER16> Swedish does it but only the five before/after half case, not 10. And generally no other number than five actually. Examples: "Fem över halv två (13:35)" or "fem i halv fyra (15:25)".

<comment><USER17> Norwegian too. Though other numbers than 5 but rarely _more_ than 5 tends to be acceptable. E.g. "tre på halv fire" (15:27) works, but it's rare to use it to be more precise than with five. If you want to be that precise people are more likely to resort to saying the specific minute of the hour ("tre tjuesju" or "tre syv og tyve"; the latter is "old fashioned" and from Danish but still frequently used), alternatively with 15 instead of 3 if even remotely ambiguous.

</comment></comment></comment><comment><USER18> English to Russian is also wrong

[https://translate.google.com/#en/ru/Half%20past%20one](https://translate.google.com/#en/ru/Half%20past%20one)

"Half past one" = 1:30

"Половина первого" ("half of the first") = 0:30

</comment><comment><USER19> DeepL[0] outputs the same.

[0] [https://www.deepl.com/translator](https://www.deepl.com/translator)

</comment><comment><USER20> Interestingly it does do the Dutch "half twee" correctly, to French and back. Moreover, halb zwei is translated to half twee and back normally. So there is no inter-dependency or translation "via English" or something.

</comment><comment><USER21> Here is what [https://translate.yandex.com](https://translate.yandex.com) says:

      halb zwei -> une heure et demie (FR)
      halb zwei -> half two (EN)

</comment><comment><USER22> Not familiar with either language. What are the English translations of these two phrases?

<comment><USER23> "Halb zwei" is "half two". It means "1:30".

<comment><USER22> Ahh and it's being translated to 2:30. Stark evidence that Google translate doesn't really "understand" anything yet.

<comment><USER24> I don't think anyone would claim that it does, except maybe Google Marketing and a few blue-eyed computational linguists - who would probably do themselves a favour by focusing a little more on the linguistics of the endeavour.

It is a text-to-text machine translation system. There is, as far as I know, no attempt at an internal representation of anything like semantics or knowledge about the world. They may have added some grammatical facts, but there is no model of the world and no notion of time like a person would use to make or understand statements in natural language.

Case in point: The artifacts of the training processes behind machine translation systems like Google Translate cannot be used to generate sentences from pictures or notions or anything like that. What is happening is nothing like a human learning a language, or even a pair of languages.

That's not to say it's not impressive, useful and important tech, mind, but it really does not do all of what it appears to do at first glance.

</comment></comment></comment></comment><comment><USER25> I wonder if this is just due to a lot of translated documents getting it wrong. And thus having mis-trained the ai.

<comment><USER26> I have wondered if it's not an increasingly difficult problem for Google Translate that, as it becomes more popular, it is likely to see more and more training data which it itself helped generate.

</comment></comment><comment><USER27> Translations: 1:30 and 2:30, respectively. Or, literally, "half two" and "two hours and half".

</comment><comment><USER28> Afrikaans>English is also wrong: [https://translate.google.com/#af/en/half%20twee](https://translate.google.com/#af/en/half%20twee)

original af: half twee (01:30) incorrect en: half past two (02:30) correct en: half past one (01:30)

</comment><comment><USER29> Other common mistakes are with measurement units and currency.

I often see things like "20 litres of fuel cost 300kr" translated to "20 gallons of fuel cost $300".

I can't reproduce this in a short sentence, it tends to happen when I translate a large block of text.

</comment><comment><USER30> Machine translation is so frequently and so badly wrong that it can't be trusted at all. I guess it keeps translators in a job when it can't even get basic things right, let alone complex translation.

</comment><comment><USER31> Suggest an edit.

</comment><comment><USER32> For "viertel" (quarter), German itself isn't without its regional ambiguities, though.

<comment><USER33> There are two different conventions, but I never saw any ambiguity:

One convention is "viertel vor zwei" (13.45) / "viertel nach zwei" (14.15), the other convention popular in the east and southwest is "dreiviertel zwei" (13.45) and "viertel drei" (14.15).

<comment> mh-cx The ambiguity comes from the problem, when talking to someone from "the other system". I remember that my "viertel drei" was misinterpreted as 15.15 by someone, who autocompleted this to "viertel nach drei" following his system.

<comment><USER33> Interesting. I never had that problem. Some people can't tell the time in the 'other' system, but they always recognised that it's a system they don't know.

</comment></comment></comment></comment><comment><USER34> you had to be better at school!

(in France, the good students are sent to learn German as a third language, and the bad ones are sent to learn Spanish as a third language, knowing German is a marker of class)

<comment><USER35> I can confirm that in my generation, at least, learning German was seen as a more elitist choice than Spanish. Latin/Greek were optional and very few chose to study them. Ironically at the time I felt that Latin classes were easier, and even more interesting than modern languages, e.g.: we were reading already Cicero in our first year.

</comment></comment><comment><USER36> Maybe it's a timezone thing...

<comment><USER13> [https://www.xkcd.com/1883/](https://www.xkcd.com/1883/)

</comment></comment><comment><USER37> the same problem for Portuguese...

</comment><comment><USER27> I like to imagine this is just the algorithm picking up on cultural stereotypes.

</comment><comment><USER38> Depending on where in germany you are, this is actually correct. The term "halb zwei" can mean 13h30 or 14h30 depending on which region in germany the speaker originates from.

<comment><USER39> Could you mention in what regions it could mean _2:30_? Never heard of it and a quick search on google ergab nichts.

(edited)

<comment><USER40> [no longer relevant, parent was corrected]

<comment><USER39> Yep, thanks, just corrected it.</comment></comment></comment></comment>


Britain's wartime generation are almost as pro-EU as millennials - <AUTHOR> https://blogs.lse.ac.uk/brexit/2019/04/05/britains-wartime-generation-are-almost-as-pro-eu-as-millennials/ <comment><USER2> 60s generation insecure?

I was born in 1955 and all through my childhood and education I felt that the world was open to me. I still feel that way. So do most of my childhood friends as far as I know. What worries us is not the EU but the UK.</comment>


Noisebridge Hackerspace in SF Battles Rising Rent, Threat of Lease Expiring - <AUTHOR> https://www.nbcbayarea.com/news/local/Noisebridge-Hackerspace-in-San-Francisco-Battle-Rising-Rent-Face-Threat-of-Lease-Expiring-466883363.html <comment><USER2> Noisebridge is a significant Bay Area resource. It is disturbing to learn that Noisebridge and the Techshops are at risk. Hackerspaces are an important component in the creative ecosystem.

</comment><comment><USER3> Related, sadly: [https://news.ycombinator.com/item?id=15718470](https://news.ycombinator.com/item?id=15718470)</comment>


A source-transforming module loader for Python - <AUTHOR> http://gregoryszorc.com/blog/2017/03/13/from-__past__-import-bytes_literals/ <comment><USER2> I don't understand why it was less tedious to write a source-transforming module than to just make the static code changes _once_ and be explicit about it.`b''` is supported in Python 2.7, so it's just redundant. I think people will be confused if they look at a nominally Python 3 codebase and find that string literals are being encoded as bytes.

It's certainly a clever hack, I just think you're more likely to introduce "subtle bugs" when you are doing something decidedly non-standard _implicitly_.

<comment><USER3> When you change the source code, you have to take care to test on both Python 2 and 3. With this solution, the transformation (I think) only happens on Python 3, so there is no way to introduce bugs in Python 2 at all. Which is an important thing if your code base is big enough.

While explicit is better than implicit the practicality still beats purity.

EDIT: yup, only happens on Py3: [https://www.mercurial- scm.org/repo/hg/rev/1c22400db72d#l2.10](https://www.mercurial- scm.org/repo/hg/rev/1c22400db72d#l2.10)

<comment><USER2> But that makes things worse, because you have two different versions, one of which you can't see directly. b'' is the same as '' in Python 2 in the same way u'' is the same as '' in Python 3.

Since this transformation _only_ has any effect on Python 3, it doesn't matter if you apply it in both 2 and 3.

<comment><USER3> By "this transformation" you mean manually going through the whole hg code base and inserting "b" characters before most string literals.

Even if you are 100% sure that semantically `b""` and `""` in 2.7 (let's forget about <2.7 for a moment) don't differ, you cannot be sure that the transformation itself - i.e., editing the source files - won't break something. You have two ways of doing this: either manually, where you risk human error, or by writing a tool, where you risk missing certain cases. In both cases, your perfectly good Py2 code base breaks for no good reason. Moreover, even if you create a tool for applying the transformation (actually, it looks like even this loader could be used for this) to the source, once you run it and commit (imagine the commit diff and its review process!), you can't run it again if you discover your tool missed something (so iterating and improving the tool becomes harder).

With the solution described in the article, you have 100% guarantee that nothing breaks on Py2 and simultaneously you can work on improving the tool. Once they're satisfied with the tool performance and the Py3 porting is more advanced, they can use it to convert the source files. IMHO that's a really sane strategy here.

</comment></comment></comment></comment><comment><USER4> This is pretty cool, but couldn't this have been leveraged to be just an intermediate step of the actual source-level substitution?

i.e. you run this tool on the codebase, cache somewhere the post-tokenized- and-rewritten output, then run a separate tool that does the '' -> b'' change in the source code, rerun the tokenizer without the translation and verify the two outputs are identical?

This way one would not need to do this at runtime every time, and you would have a guarantee that your source code text changes are correct (because you compare the tokenized output between the '' and the b'' versions of the code).

</comment><comment><USER5> Seems like a perfectly reasonable approach to hoisting Hg into the future. A big ship turns slowly.

</comment><comment><USER6> Wow, I though I'd seen the last of source filters in 2000 & perl.</comment>


How Arel Converts Ruby Queries into SQL Statements - <AUTHOR> http://blog.codeship.com/how-arel-converts-ruby-queries-into-sql-statements/

<comment><USER2> >This algorithm is an example of the "visitor pattern." The term visitor pattern simply means that some object, function or other piece of code is executed once for each node in some data structure, such as an array, linked list or tree.

Hm. Isn't that a (map)?

<comment><USER3> Sort-of, kind-a. The visitor pattern is about providing a mechanism where you can encapsulate behaviour separate from the model. So it's similar to a closure or other object passed to an algorithm that iterates over the data structure, where the closure or other object is called for each node and discriminates between the nodes without coupling the object model to the visitor.

In a statically typed language, this was "clever" because if you put an accept() method on each class that calls visitor.visit(this|self|whatever) it makes the compiler enforce that your visitor classes implements a visit() method for each possible node type.

For dynamic languages like Ruby that benefit kind of evaporates, but at the same time runtime type checks are normal, and so yes, you can just use any standard algorithm that iterates over the nodes in your preferred order and pass it a closure or suitable object that .e.g. does "case object.class; when ..." or similar to group the code together instead. If one absolutely wanted to mimic the GoF visitor, one could do 'send("visit_#{object.class.name}".to_sym,object)' or something along those lines to make visitors be classes with methods for each node type instead.

A lot of the GoF patterns are mainly useful in statically typed languages and/or languages lacking first-order functions or closures.

</comment></comment><comment><USER4> I never really understood how Arel is any different to the query builders which exist in most frameworks, does anyone know the details?</comment>


A review of the Planck keyboard – 48 keys are plenty - callum-oakley https://callum-oakley.github.io/posts/48-keys-are-plenty.html <comment><AUTHOR> Just so it happens I am doing a compilation of lesser known input methods and would love to discuss this further with you. I believe that there are loads of opportunity to revisit keyboard input dogma! Chorded typists for example can write well over 200 wpm, as a matter of fact it is for some a requirement.

Really good article! Would love to discuss this further

<comment><USER2> I put together a list of odd keyboard layouts if you want to ask any of the folks who volunteered for my post: [http://evantravers.com/articles/2019/04/20/community- post-40...](http://evantravers.com/articles/2019/04/20/community- post-40-keyboard-layouts/)

<comment><AUTHOR> that would be lovely! How can I reach you?</comment></comment></comment>


Ask HN: What's the next big computer interface design? - <AUTHOR>

First, computing machines had light indicators that showed what bits were stored in memory addresses. Then, text terminals were introduced that made computing feasible for everyday people. Lastly, the graphical user interface was invented that allows anyone with eyes to perform computing tasks.<p>So, what's most likely to come after the GUI...brain implants? <comment><USER2> I don't think the GUI goes away anytime soon, and I don't think that is what you meant either.

People are visual beings, so I think the interaction gets smaller, or more integrated into our lives. I would love something akin to a contact lens that lets us see the GUI, and a computer that responds via voice.

So to me, GUI doesn't go away, how we interact and how we view that GUI does. A contact lens, brain implant all seem reasonable, but I would assume the natural progression will be hardware wearables, then biological wearables (contacts etc), then implantations.

</comment><comment><USER3> "Goggles".

Youtube H+ for something far-future (or watch continuum) they both seem to have reasonable (if dystopian) future tech storylines

</comment><comment><USER4> Voice.</comment>


Videogame Strategy Inspires Teen's Amazing Diet - <AUTHOR> http://www.wired.com/gamelife/2010/01/taylor-lebaron/ <comment><USER2> This would be even more interesting if applied to the area of making money. But wait, he wrote a book, so he is probably using his strategy in that very problem right now :-)</comment>


We can do better for RSA and bigger number. Feel free to comment - <AUTHOR> http://www.slideshare.net/SubhendraBasu2/thesis-cover-51186885

<comment><USER2>
        We take the number to be factorized,
        N, and its base 4 representation, N4,
        expand them in powers of (2 pi) weighted
        by the sum of adjacent and errant digits.

Well, that really doesn't seem to mean anything at all. You don't actually describe the process, and I'm not going to spend the time trying to reverse- engineer what you've done.

        Then we take the ratio of N4/N10 or N4/N

But they are the same number, so the ratio is 1. I assume you mean something else, but I don't know what.

Then trying to follow through the next part of the example you seem to have apparently arbitrary correction factors, so I have no idea what you mean by "errant digits", nor how you get these weird expansions in powers of (2.pi). I'm sure you must have some process for doing this, but it's not clear from what you have here.

And despite what I said earlier[0] you _still_ haven't just taken an existing, difficult example and given us the factorisation. You say you can do one of the RSA numbers, and yet you haven't.

In an earlier comment[1] you said:

        Now factorising Ras 1536.  Will
        post the results when done.

Do that and I'll listen.

Let me say that people in the past have made amazing advances that have then been ignored by everyone, only later to be found to be exactly right. You may be right, and you may have made an amazing discovery. But you might not, and it's up to you to communicate clearly what you've done. That is, to communicate _exactly_ what you've done.

Demonstrate _all_ of the process, in detail, written clearly, for two small examples. Factor 10^4+1 for me using your method, then factor (10^7-1)/9\. Then show your working in parallel for a _large_ example, perhaps 40 digits. Finally, factor a large number such as RSA 1536 and present your answer.

I have to say that I'll also listen more if you spell my name correctly.

[0] [https://news.ycombinator.com/item?id=9549682](https://news.ycombinator.com/item?id=9549682)

[1] [https://news.ycombinator.com/item?id=9499462](https://news.ycombinator.com/item?id=9499462)

<comment><USER2> OK, I've followed your process, and now I'll attempt to use it to factor some of my usual examples.

EDIT:

I've now done that. I've implemented your process, restricted to cases where there are no zeros in either the base 10 or the base 4 representations, to simplify the process.

I ran it with N=125 - I got this result:

        N10 = 125
        N4 = 1331
        K4 = 81.8746688941
        K10 = 15.4445545759
        K4/K10 = 5.30119975244

This matches your example exactly.

Then I ran it on 11111:

        N10 = 11111
        N4 = 2231213
        K4 = 34404.4992922
        K10 = 877.71000039
        K4/K10 = 39.1980258592

39 is not a factor of 11111.

Let's try 11129:

        N10 = 11129
        N4 = 2231321
        K4 = 34399.2238656
        K10 = 873.691116523
        K4/K10 = 39.3722944128

Nope, 39 isn't a factor of 11129.

Let's try some more:

        N     : factors   : N4        : K4            : K10         : Eta
        112311: 3 3 12479 : 123122313 : 971666.060082 : 5390.130571 : 180.26762...
        112313: 31 3623   : 123122321 : 971664.020326 : 5390.021531 : 180.27089...
        112315: 5 7 3209  : 123122323 : 971663.763393 : 5389.905399 : 180.27473...
        112317: 3 29 1291 : 123122331 : 971662.420476 : 5389.820132 : 180.27733...
        112319: 17 6607   : 123122333 : 971662.072077 : 5389.757255 : 180.27937...
        112341: 3 37447   : 123123111 : 971604.413941 : 5385.135790 : 180.42338...

As you can see, the factors vary wildly, as expected, the values of K4 and K10 vary slowly, as expected, and Eta varies very little, as expected. Given that the factors vary so wildly, and Eta varies very little, why should we expect this to work?

Well, in these cases it simply doesn't work.</comment></comment>