Ask HN: What startups are highly profitible but VCs won't touch? - <AUTHOR>

In particular, what are some taboo areas that VCs in the valley tend not touch with a ten foot pole even though there may be a highly profitable business model and/or mass audience appeal? <comment><USER3> There's a subtle reason why VCs will avoid certain kinds of businesses that is not clear until you are inside the sausage factory, which is that your LPs (investors) are sensitive to bad perception and publicity. Specifically your sponsor within an LP such as an endowment or foundation reports to an Investment Committee which is typically extremely conservative. In the worst case, you could put your sponsor's career at risk in their own profession.

</comment><comment><USER4> VCs are often forbidden by their agreements with their LPs to invest in certain types of business. I forget what they are exactly, but it's not simply a matter of taboos.

<comment><AUTHOR> Thanks for the quick response pg, would you say in addition to being bound legally, there is a cultural bias against certain types of businesses (assume fully legal)?

<comment><USER4> Maybe. I can't be sure because I can't remember exactly what the LPs forbid.

There have been startups we didn't fund because they seemed like they'd be bad for the world.

<comment><USER5> What kind of startup would you consider "bad for the world"?

<comment><USER6> May be pornography?

<comment><USER7> That would be only a bad business in a very competitive pool.

Also, there's nothing wrong in pornography by itself, unless you happen to be an extreme religious person.

A bad business for the world would be something like Zynga.

</comment></comment></comment></comment></comment></comment><comment><USER8> pg and pmarca (so cool that you comment on HN, looking forward to your first submission) hit it on the head.

Regulatory uncertainty can cause difficulties investing in certain sectors that might prove quite profitable.

Lastly, I would note that profitability as an isolated metric is not a perfect indicator of future success. I can find a link if people are interested, but in his latest book Robert Shiller discusses firms that created some special financial products in the late 90s. The products were effectively betting on black swan events happening at a certain time. They ensured a high annual IRR but then if the event didn't occur their investors were left holding the bag. What made the idea profitable for the firms was that LPs that invested in years 4-6 did so based on IRR, without examining things in detail and effectively overpaid for a piece.

</comment><comment><USER9> Beyond what was already said, it's a simple numbers game. I can have a 5 person company and yield an 80% margin. Sounds like a win, right?

What if my total revenue was $1mm, with a total market size representing about $10mm? Technically profitable, but a terrible investment for a VC.

Ultimately VCs want to see a clear path to $50-100mm, or they'll be reluctant to invest.

</comment><comment><USER10> Sheer speculation: porn and gambling.

<comment><AUTHOR> Gambling seems like a no go because of legalities in the US, but there's a huge gambling technology sector in the EU and UK where it's legal.

<comment><USER11> What about APIs/SDKs like Betable? I know it's a UK based company, but does this allow others outside of UK to legally use it (ex. in the US?)

<comment><USER12> Yes. <https://developers.betable.com/#why-its-legal>

<comment><USER13> That does not answer the question of whether it is legal for US citizens to use this service, just that they are registered with the relevant authorities in the UK. As I understand it, online gambling is illegal in the US, no matter where the operation is hosted.

</comment></comment></comment></comment></comment><comment><USER11> There is a grey area that also exists for "dating" applications (ex. Grindr) etc that could be used for other purposes.

</comment><comment><USER14> I always sensed top-line revenue was a lot more impressive to money people than profits. You could be making $3M/yr net profit on $6M/yr revenue and not be given a serious look (you're just a small business...), while the $100M/yr business that's never turned a profit and loses $10M/yr because they have only a 5% gross profit margin somehow gets a look. Zero seems to be an exception: what has always impressed me the most are the guys who can talk their way into an 8-figure buyout without ever having a customer.

</comment><comment><USER15> I'd say currencies. It's highly profitable to control your own currency, just ask the Rothschilds.

But, PG and YC seem to have already touched that...at least tangentially with Coinbase.

</comment><comment><USER16> Gambling, Drugs, Prostitution, Porn. In general, any business already controlled by the mob or blue collar criminals.

<comment><USER17> Porn is controlled by criminals?

<comment><AUTHOR> Seems to be a sweeping generalization but it does seem like the porn industry attracts a certain "seedier" element of folks. These same folk also happen to be amazing marketers and I can point to many techniques on landing pages, SEO, etc. that were first leveraged by the adult industry.

<comment><USER18> Generally couldn't it be moreso that being involved in porn is part of the definition of "seedy?" It's not the people themselves, but guilt by association.

</comment></comment></comment></comment><comment><USER19> They tend to avoid business models without perceived $100M potential - <USER2> regardless of your margin.

</comment><comment><USER20> Powerplants - not sure they're a startup, though.</comment>


Mass produced software components (1968) - <AUTHOR> http://www.cs.dartmouth.edu/~doug/components.txt

<comment><USER2> Actually a nice example of a larger problem: people, even today, think of software production the way they do of any physical product.

Writing the same system more than once (e.g. a consulting firm for companies' internal applications) will get economy of scale, yes, but that's missing the real point. If you're writing the same app twice, you've already screwed up.

I want to say that it has to do with language selection, that the mainstream languages are set up for local syntactic sugar instead of large-scale abstraction. But then people ask what language I think they should use (I won't name names, but let's just say "something functional"), and they just say "Fuck You Lally."

</comment><comment><USER3> Great artifact. I think this is from the famous conference where the term "software crisis" gained currency. (The term, in the 1970s, came to stand for the unanswered question of Why Is Software So Hard? And specifically, why so much harder than hardware.)

One thing I was surprised to see (in the discussion at the end of this piece) is that Peter Naur was among those falling for the idea of mass-produced components and the industrialization of software. He seems to have changed his mind quite dramatically later.</comment>


Eric Schmidt: Blackberry User - <AUTHOR> http://crackberry.com/caught-black-handed-google-chairman-eric-schmidt-photographed-while-taking-photo-his-blackberry-agai

<comment><USER2> I think it is a good thing to use competitors products, it lets you know what they are doing well, and where you can improve/compete.

I highly doubt a blackberry is his only phone, I suspect he's got an iPhone, a WP7, maybe even a WebOS phone hanging around.

</comment><comment><USER3> Isn't it an amazing interesting coincidence that everybody's personal preference for phone almost always happens to be the same one they get paid to work on?

Seriously, just because you work on something, doesn't mean you have to pretend you're the target market.

<comment><USER4> There is some value in dogfooding. Perhaps he might be better able to envision and guide the Android teams if he were using one every day. What Android is doing right/wrong may be easier to tell when he has one rather than sifting through customer feedback.

Besides all this are the PR/consumer confidence aspects of this, which I think a company is responsible for managing. To some degree, your success in business depends on what the public perceives of you.

</comment></comment><comment><USER5> It's not much of a surprise. Schmidt has been on record before saying he enjoys his Blackberry and has a preference for a physical keyboard.

</comment><comment><USER6> Maybe because he does not need to play angry birds while waiting in line somewhere, whatever.

If anyone is to make any conclusion from this about android, well, i have nothing good to say.

</comment><comment><USER7> This could have been pre-android days

<comment><USER8> it was taken this week.</comment></comment>


Why are there no good online voting/election tools that are also free? - <AUTHOR>

(Alternative question: If there are, can you point them out?)
I'm looking for a voting/election tool to conduct a large variety of surveys. The type of survey may be anything from less serious ("pancakes or cookies at the party?") to more serious/official/anonymous (elections). Surveys are typically small: there are few questions with possible answers being mostly yes/no or a list of candidate names (elections). The number of participants in the surveys might become large (<10 to >1000). Fancy features (e.g. statistics, user behaviour, ...) are not required. For the more serious surveys/elections, reliability is a key requirement.
There are a large variety of survey tools online available, which I would categorize like this:
1. Professional: They offer a range of plans (usually a basic plan/trial is free) and are rich in features; they typically work well. PROBLEM: Usually expensive; their low-end (free/cheap) plans are often limited in users (e.g. free for <30 participants).
2. Hobby: These are limited in features but free; they don't always work well. PROBLEM: Unreliable. It's hard to get people to vote as it is. People receiving multiple invitations to vote is problematic. People receiving no invitation to vote is unacceptable in some cases (e.g. elections).
I'm a firm enemy of NIH, so it would be preferable if some alternative could be found. <comment><USER2> Because investing the time to create a secure, usable voting system takes time, energy, and financial resources.

Few people are willing to do that much work for no financial reward.

<comment><USER3> That is why we have governments.

I have not even downloaded it, and do not know whether it is fit for your purpose (especially for the less serious parts), but [http://linux.softpedia.com/progDownload/KOA- Download-31142.h...](http://linux.softpedia.com/progDownload/KOA- Download-31142.html) should be able to handle 'real' elections.

</comment></comment><comment><USER4> Why would there be such a thing? Would you create a service with that kind of value (and actual running costs) and give it away for free?

<comment><USER5> Too many people these days think they are entitled to everything for free, especially on the internet. I dabble in angel investing and you wouldn't believe how many people think they are entitled an investment because they think they have "the next big thing" -- if they are so sure, bootstrap it and prove it!

<comment><AUTHOR> I apologize, I probably should have been more clear about this point. I do not at all believe that I am in any way entitled to things for free. I myself am in computer science and contributed to OSS and get annoyed by people frequently thinking that software/services have no value just because they are getting used to having things for free.

That being said, I did consider that there are many (more or less successful) business models centered around services that are (partially) free for end- users (e.g. social networks, email, ...). I have not yet founded any startup myself, so I don't want to lean myself out of the window and claim that something like that would be successful for business this.

We (the group of people wanting to conduct the polls) are students. It's not like there wouldn't be a budget for something like this; but a lot of the good services have high per-poll or monthly rates.

So my question was not why someone isn't doing a lot of work to provide me with a quality service, but more: Why isn't there anything between [free + basically broken] and [amazing + highly priced]. Why is there nothing in between? Is there no market for a middle segment? This I believe to be a valid question.

<comment><USER5> That is a much better question. Although I can't tell you why in this specific scenario, I can tell you that middle markets can be tough because they're not the cheapest or the most expensive, which are two common selling points.

</comment></comment></comment></comment><comment><USER6> This is an app idea I've turned over a hundred times but never dove into.

</comment><comment><USER7> If you're looking for a few quick poll questions, take a look at <http://gopollgo.com></comment>


DIY DNA hacking guide to self-cure Lactose Intolerance - <AUTHOR> https://youtu.be/J3FcbFqSoQY <comment><USER2> I feel like this is probably really dangerous and possibly irresponsible, but I have no knowledge of biochemistry to back that feeling up.

What it is for sure is really cool.</comment>


Ask HN: Is it legal/easy for a foreigner to open a bank account in the US? - <AUTHOR>

I have a website hosted in the US, sustained by adsense ads.
Adsense transfers my earnings to a local bank account, and every month I pay the hosting provider with my local credit card.
However I lose a lot of money transferring money internationally due to taxes and rate conversions, and I'm wondering if I could keep the money in the US without being a US citizen, without having to physically go to a US bank.
Does anyone have more information on this? <comment><USER2> In many countries you can get accounts that are denominated in other currencies. For example, Citibank does an account in the UK that's denominated in US Dollars - [http://www.citibank.co.uk/personal/banking/international/eur...](http://www.citibank.co.uk/personal/banking/international/eurocurrent.htm) \- this would resolve the rate conversion issue.

 _However I lose a lot of money transferring money internationally due to taxes and rate conversions, and I'm wondering if I could keep the money in the US without being a US citizen, without having to physically go to a US bank._

I don't know where you are, but in many jurisdictions, doing what you're suggesting to evade local taxation could be illegal (that is, locally in terms of tax evasion. Opening a bank account overseas is not an illegal act in and of itself).

For example, let's say you're a British citizen (just because I'm familiar with the British rules, but they're likely to be "similar" across much of Europe).. if you are domiciled in the UK and earn money in the US from a Web site you maintain from the UK, you owe the UK tax authorities tax on the full income from that site BEFORE any deductions.

So let's say you make $2000 a month and spend $500 on hosting. If you set up an account in the US and then eventually only remit $1500 to the UK, you would be breaking the law if you did not declare the full $2000 to the tax man. In which case, having the remote account has no benefit except for the rates.. and you can get that locally anyway, as I demonstrated above.

</comment><comment><USER3> You certainly don't need to be a US citizen to have a US bank account, but they would want you to show ID and give a US address if you want to open an account in the normal way. Not sure what other options there are.

</comment><comment><USER4> Legal and easy.

<http://www.kalzumeus.com/2007/08/15/banking-for-the-uisv/>

</comment><comment><USER5> From what I've read, you need to present a SSN, or present yourself face-to- face to open an account. As I presume you can do neither of these...

Perhaps, if you have a very trusted operative living in the US they could take responsibility for the transfers? Although, sadly your email might read much like a Nigerian scam! :) Minus the poor grammar and spelling errors. And the claims of royal blood.

<comment><USER3> >you need to present a SSN

Just FTR, an SSN is absolutely _not_ necessary to open a US bank account.</comment></comment>


Houdini and the Extensible Web - <AUTHOR> https://dev.opera.com/articles/houdini/

<comment><USER2> You can also watch and participate in related discussions on [https://lists.w3.org/Archives/Public/public- houdini/-](https://lists.w3.org/Archives/Public/public-houdini/-) I think the article didn't mention IIRC.</comment>


Ask HN: As technical person how do you handle politics in office? - <AUTHOR> I just curious, how someone at lower level as technical person handled a politics in office? Just quit your job and finds another employer? <comment><USER2> Follow Jesus, Turn the other cheek, and if it keeps happening then get the hell out</comment>


Show HN: Goalie – A habit tracker - <AUTHOR> https://play.google.com/store/apps/details?id=willoughby.com.goalie

<comment><USER2> Like it. I'd love to see a way to set a weekly allowance. E.g. I set "eat junk food" at 0, but really, I want to say I can do it once per week as a treat ;)

<comment><AUTHOR> Thanks for the feedback! I'm hoping to add occurrence to goals soon :)

</comment></comment><comment><USER3> Sweet! I had the same idea recently based only on incremental values. I'm trying to quit smoking but I still cheat from time to time (I know, this is bad.) and I wanted to be able to track my progress.

I'll give it a try for sure.

</comment><comment><USER4> I really like this idea. I've been looking for something similar on iOS. I'm currently going back and forth between two solutions for daily + weekly goal tracking: (1) Coach.me (formerly Lift), which works well but has a bit different focus, and doesn't provide a ton of visualization; and (2) simple tasks on Google Calendars, which is okay on desktop, and not great on mobile, and not really suitable for goal tracking overall (understandably).

Something fully contained like Goalie but for iOS would be awesome.

</comment><comment><USER5> Looks great, will be checking this out. One piece of constructive criticism from the preview images is that the title font sizes are a bit large and that the different font faces are a little distracting.

Congrats for releasing your app, and kudos for sharing with us here!

<comment><AUTHOR> Thanks for mentioning the fonts. I try my best, but I'm not that great at designing. I'll revisit the fonts for my next update

<comment><USER6> The app looks really useful and props on getting it out there. Another design related suggestion (especially for an app that features color so prominently) is to find a good color palette at a site like [http://www.colourlovers.com/](http://www.colourlovers.com/) and stick with that. No one should be picking their own colors in 2015 :)

<comment><AUTHOR> I was aiming for colors to be a way to organize yours goals into categories and hopefully it isn't too invasive

<comment><USER7> At least keep the colors choice as an option if you do change it in any way! I am using it exactly as you said, to group like goals.

Edit: Plus it adds a little fun to it and makes it feel more personalized imo.

</comment></comment></comment></comment></comment><comment><USER8> Any chance of a widget? Currently using "Day Counter" to track days since last X, but it doesn't have any concept of streaks or goals.

<comment><AUTHOR> I wasn't planning on it for the 1.0 push, but maybe I'll stick it in as a paid feature.

</comment></comment><comment><USER9> Installed it, will give it a try. And I appreciate the '3 goals try for free' mode for now.

Exporting the data seems to generate somewhat readable json. Nice and simple.

1) Can I import that again, somehow?

2) Will you try to make sure that this json import/export format will be understood in versions 4 month from now?

<comment><AUTHOR> 1) Yes, eventually. 2) Yes, any json exported using the app will be understood in future versions.

<comment><USER9> If you happen to follow threads here:

Notifications/reminders are great. They'd be even more great if they'd disappear after me adding to a goal.

Think: 'Remind me at 9 to have breakfast'. Eat. Open Goalie. Swipe right. Browse HN. :)

10:00 - still seeing a reminder for breakfast that won't go away without dismissing it manually.

<comment><AUTHOR> You're in luck. I'm adding the notification dismiss tonight. Great feedback, thanks!

</comment></comment></comment></comment><comment><USER10> Nice, reminds me of Tap Log. I'll give it a try.

Your address seems fake.

It says I can pay to make it adfree, but I was not prompted about a network permission? Local ads sound like a great idea that keeps your users' privacy. I don't see any though.

<comment><AUTHOR> I made it ad-free until after 3 goals. Then it'll show ads (just trying something different).

</comment></comment><comment><USER11> I love it, especially showing the graphs on the dashboard.

</comment><comment><USER12> Constructive criticism - I wasn't sure what the swiping introduction was for. I think you could explain it a little better.

</comment><comment><USER13> Coach.me is similar for iOS.

<comment><USER11> And web and Android. Goalie looks nice though. (but also, thanks for the Coach.me mention)

</comment></comment><comment><USER14> Anything comparable out there for iOS?

</comment><comment><USER15> I found the UI quite nice, but that after adding a fourth goal ads started showing up in the bottom ... which ruins the whole experience for me.

<comment><AUTHOR> Since its my first app on android, I'm still figuring out exactly how I want to limit things. I'm open to feedback.

<comment><USER16> I'm not really familiar with Goole Play but I assume it's not too hard to offer a paid version that's ad-free?

<comment><AUTHOR> I do offer an in-app purchase to remove the ads. So that is definitely an option.

</comment></comment></comment></comment><comment><USER17> I would have been willing to pay an upfront fee, but in app purchases is a massive turn off

<comment><USER12> Why? It's actually much easier to try it for free and pay the in-app purchase if you like it. Otherwise you have to go back to the play store and find the paid version.

</comment></comment><comment><USER18> This app changed my life. I have found a new sense of focus, and it has even improved my marriage!

<comment><USER19> And it also put your kids through college?</comment></comment>


The Internet Gets a Stock Index - <AUTHOR> http://www.readwriteweb.com/archives/nasdaq_internet_index.php

<comment><USER2> Sweet, I'll take a short on that.

On second thought, looking at the list of companies, I'm not seeing a lot of web 2.0 hype. In fact, that list looks pretty stable. (Sonicwall?)

</comment><comment><USER3> You think you're nerd? So, why your savings aren't on ^QNET?

</comment><comment><USER4> I can't find an equivalent QNET entry on Google Finance.</comment>


AdSense leader leaves Google for startup life - <AUTHOR> http://venturebeat.com/2007/11/16/adsense-leader-leaves-google-for-startup-life/ <comment><USER2> The seeds of Google's demise have been planted and it won't be killed my Microsoft or Yahoo, it will be by the hundreds of intelligent, entrepreneurial, fully vested ex-googlers that will leave the company to start projects of their own.

I don't remember where I came across this quote but I think we'll see a lot more of this in the near future.</comment>


Ask HN: Why do people believe "PHP developer" means security ignorance? - <AUTHOR>

I recently had a private conversation where the other person pretty much said that they will never take me seriously in the realm of [computer/cyber/information/network/application] (select appropriate) security as long as I write PHP code.
This Twitter exchange from earlier this year illustrates the sentiment perfectly: https://twitter.com/voodooKobra/status/494466665883910144
This idea (that I have encountered over the years) has always struck me as silly. And yet, I've never succeeded in extracting a straight answer from anyone about why they believe that someone cannot simultaneously have some working knowledge of security and enjoy building PHP applications.
Is there anyone on HN who knows the answer? Is there anyone reading HN who shares this belief? <comment><USER2> It's not that people don't think you _can_ know security AND write PHP, it's that it's seen as very uncommon, largely because of historical context and PHP's ecosystem.

PHP, as you probably know, started as a really basic (if obtuse) preprocessor for HTML pages. It plugged nicely into Apache via mod_php, and was relatively simple and low-footprint to set up, so a lot of cheap shared-hosting sites set it up. For beginning/inexperienced web developers on small projects, this was great; you no longer had to go host your own Java/ASP/whatever web server to have server-side logic, now you could just use a text editor and FTP.

Unfortunately, this also meant that PHP attracted a _lot_ of inexperienced developers -- the kind who haven't yet learned things like why you should hash (and salt) your passwords, why you should use stored procedures, and so on. (Editorial: it didn't help that the language itself didn't, at the time at least, make it obvious how to do such things.)

Granted, there were some developers who knew better who picked up PHP. But generally developers who have some working knowledge of web security best practices get that knowledge by working in the field -- which at the time, typically meant "heavier-weight" stuff like Java or ASP.

So with large numbers of inexperienced, security-unaware devs enabled to write webapps in PHP, large amounts of poor, insecure PHP code was written. So PHP got a bad rep, which only exacerbated the problem by creating a self- fulfilling prophecy that turned companies who could hire more-experienced devs off from PHP.

I haven't personally touched PHP in a long while -- I personally just don't like some aspects of the language -- but I've heard some steps have been made in the PHP community to make best-practices more easy/commonplace. Which is great! But the old reputation is still there, and bad reputations are hard to dispel -- especially in the corporate world.

<comment><USER3> >> it didn't help that the language itself didn't, at the time at least, make it obvious how to do such things.

Why should a language "make it obvious" what are clearly implementation details?

Hashing passwords is not the job, or the concern, of any language I've used.

</comment></comment><comment><USER4> > And yet, I've never succeeded in extracting a straight answer from anyone > about why they believe that someone cannot simultaneously have some working > knowledge of security and enjoy building PHP applications.

These people are probably thinking: "If you truly knew infosec, you would have moved onto a more advanced language by now."

PHP has a reputation as a "training wheels" language. It's seen as a great starter language to learn the fundamentals of web development, but the expectation is that a "good developer" will eventually migrate to Python/Ruby/Node/whatever once they outgrow PHP.

By staying with PHP, you're signaling that you haven't cleared the bar of being a "good developer" yet.

Is this fair? Hell no. But that's life. My advice? Get familiar with another scripting language. The difference between "I'm a PHP developer" and "I'm a developer that knows Python, PHP, and Javascript" to a lot of people is huge.

<comment><AUTHOR> I can superficially claim some familiarity with each of PHP, C, C++, Java, VB.NET, Delphi, Perl, Python, HTML(5), CSS(3), Node.js, Javascript, jQuery, Fabric.js, MySQL, PostgreSQL, MS-SQL, sqlite, XML, and webserver administration (Apache HTTP Server and nginx).

In terms of real experience (i.e. I've _finished_ a project in this language), the list narrows down to HTML/CSS, Javascript (plain and with jQuery), PHP, Java, C, and the SQLs listed above.

But if any degree of "expertise" is required, I'm only comfortable claiming that I have the requisite experience and environment familiarity with PHP projects (at least, in terms of server-side programming languages).

I could easily call myself much more than a PHP developer (and if my experience with some other devs has been any indication, get away with it!), but I'm hesitant to do so until they feel natural to build projects in.

</comment></comment><comment><USER5> I'm sure it's possible to write secure PHP code but PHP actively works against you. The language has improved a bit over the years (magic quotes is no longer a thing) but I don't have any confidence that the PHP developers will make reasonable choices in the future.

Take something like == to compare two strings. A reasonable person would compare them as strings. A PHP developer would try to compare them as numbers (losing information in the process). Many PHP users don't consider that a problem. Many PHP developers don't consider that a problem. (Some realize it's stupid but don't want to break backwards compatibility).

<comment><AUTHOR> I typically use === or hash_equals() depending on the use case ;)

Magic quotes needed to die.

There are also a lot of other improvements in the past few years that I've grown to appreciate.

MD5/SHA1 password hashing need(ed/s) to die; password_hash() and password_verify() needed to become a thing.

Register globals needed to die.

There are still some changes that I believe are necessary to clean up the rest of the ecosystem.

MCRYPT_RAND needs to die.

Devs choosing MCRYPT_RIJNDAEL_256 thinking it's AES with a 256 bit key rather than a non-AES flavor of Rijndael still needs to die.

Composer's unverified curl | php needs to die.

</comment></comment><comment><USER6> If I had to guess, it is because many people came into web development and would write PHP code with basic security bugs - some of the old built in functions didn't help PHP any (mysql and mysqli).

I don't share this belief mind you.

</comment><comment><USER7> 1)Memories of the older days where mysql_escape vs mysql_real_escape 2)It's 2014 and Drupal just got exploited by a sql injection attack. 3)Because of php's weak typing, php will accept a lot of strange input such as arrays with variables in them. Which is weird and can lead to some remote code execution 4) If you're busy defending against xss and sql injection still who is defending against more esoteric attacks like csrf, denial of service, timing attacks, etc? (If you can tell me about csrf and have set up csrf protection in a project you're in the minority of php developers)

<comment><AUTHOR> > (If you can tell me about csrf and have set up csrf protection in a project > you're in the minority of php developers)

Incidentally, I wrote this: [https://github.com/resonantcore/lib/blob/master/src/Security...](https://github.com/resonantcore/lib/blob/master/src/Security/CSRF.php)

#3 is surprising to me. I've seen some strange behavior (throwing [0] after a post field can lead to unexpected errors and sometimes lead to an information leak) but never RCE.

</comment></comment><comment><USER8> Like it or not, a cross-sample of PHP developers will have more bad programmers than possibly any other language (barring ColdFusion, Flash, and ASP, possibly).

Our good developers are just as good as the good developers in Python or Ruby or JavaScript, but we have enough bad developers to keep the guys at Soylent fed for a long, long time.

Edit: It also doesn't help that two of the biggest PHP projects are Drupal and WordPress, two pieces of software with atrocious security records.

<comment><AUTHOR> Is WordPress's record really that bad? Most of the vulns I hear about come from shoddy plugins, not WP itself.

<comment><USER8> WordPress core for a long time was very vulnerable, probably still has vulnerabilities, and if you're running even a slightly out of date version of the software (which might be a requirement if you've made a lot of customizations or are using a plugin that is no longer supported), you are likely vulnerable _and_ it is almost trivial to identify that you're running WordPress and your WordPress version.

Experience has taught me that no one is going to make a distinction between WP core and a third party plugin when they could instead shit on PHP and PHP programmers.

<comment><AUTHOR> Heh. Well, I'm going to be contributing to the WP core soon (making their auto-updater use openssl_verify), I'll fix anything I find there.

The worst thing I spotted when I was looking through it in June was a lack of a CS in their PRNG. I don't consider md5(uniqid(mt_rand())) adequate; urandom or bust :)

</comment></comment></comment></comment><comment><USER9> Insecure code can be written in any language. Its not something that is built- in (to some extent its true). Its not the language to be blamed, but the one who is developing insecure code. PHP is bad reputed only due the the inexperienced developers. Actually, PHP is so easy to pick up that any one can start building stuff with it. PHP is a great language, it has some odd sides, but overall its a great language if you use it wisely.

<comment><USER10> While I agree in general, security holes can be (and often are) introduced at the interpreter level. PHP even has a project that attempts to patch these with an independent module[1].

A good security practice is to stand on the shoulders of giants. Just as Windows is highly secure because it's widely used and incessantly attacked, so are the major web software stacks.

1\. [http://www.suhosin.org/stories/index.html](http://www.suhosin.org/stories/index.html)

<comment><USER3> >> Just as Windows is highly secure

That's a bold statement.

I don't presume to know more than you, but I don't hear that sentiment echoed very often.

<comment><USER10> This depends on your definition of secure. The way I use it, "security" is the lowest level of vulnerability to the highest level of attack.

Some OS's (notably OS X a few years ago) are thought to be secure because their installed base is low, so they're low-value targets for attackers. Apple, in general, has a terrible track record with security, and OS X's lack of malware was just security by obscurity -- the vulnerabilities hadn't been discovered because no one was looking for them.

Windows, on the other hand, has been incredibly high-value target for decades. It has a huge installed base, and it's used by many governments, militaries, banks, and corporations.

For that reason, Microsoft has been forced to become a leading security organization. You can't keep selling massive contracts to governments and large corporations if you're vulnerable to malware.

There are obviously ways to misuse any tool, including an operating system. Many operating systems are insecure if you configure them incorrectly. My statement was just about the incredible volume of attacks that Windows is resistant to, simply because it's been attacked so heavily for so long.

<comment><AUTHOR> When something becomes more resilient the more it is damaged, it can be said to be antifragile.

However, a closed source product that is engineered centrally still has elements of fragility contained within it that you will not find in decentralized approaches. In the very long-run, antifragility wins over robust yet fragile systems.

That is one reason why I will consider GNU/Linux and BSD to be more secure than Windows. In the long run.

</comment></comment></comment></comment></comment><comment><USER11> " person pretty much said that they will never take me seriously in the realm of [computer/cyber/information/network/application] (select appropriate) security as long as I write PHP code."

that's reason enough not to take that person seriously - a truly experienced fellow programmer would have a tough time making that presumption about another programmer in ANY language

<comment><AUTHOR> The sad part is that a lot of people (especially local) who are at least mildly respected in software development or infosec give me crap for being a PHP dev.

None of the people I've ever talked to who are far in their field (Zooko Wilcox-O'Hearn, Thomas Ptacek, Anthony Ferrara, Dan Kaminsky, Matthew Green, etc.) ever gave me flak for PHP though. :)

<comment><USER11> I wouldn't pay them any mind

There is no true scotsman according to people with that view</comment></comment></comment>


CNET Injecting Malware into Downloads - <AUTHOR> http://insecure.org/news/download-com-fiasco.html

<comment><USER2> Press release from the CNET few minutes ago:

A note from Sean Download.com Developer Community,

My last communication to you was shortly after we launched the Download.com Installer in late summer. At that time I asked for patience as we began work to deliver a mutually beneficial model to market.

We are on the verge of fulfilling our vision of coming to market with an installer model that delivers files faster and more efficiently to users, while enabling developers to a) opt-in to the Installer, b) influence the offers tied to their files, c) gain reporting insight into the download funnel, and d) share in the revenue generated by the installer. However, due to some press that surfaced yesterday and the potential for subsequent misinformation, I am reaching out now to address that press and to provide a progress report on the upcoming launch:

First, on the press that surfaced yesterday: a developer expressed anger and frustration about our current model and how his file was being bundled. This was a mistake on our part and we apologize to the developer and user communities for the unrest it caused. As a rule, we do not bundle open source software and in addition to taking this developers file out of the installer flow, we have gone in and re-checked all open source files in our catalog. We take feedback from our developer & user communities very seriously and take pains to both act on it and respond in a timely manner.

With that, I want to share progress made thus far: This week we will launch the alpha phase of our new installer. This alpha phase is intended to test the tech and do QA, and will roll through the next few weeks to ensure that our installer is bug free. Between this week and the end of January we will be completing the necessary engineering and administrative work to roll out our beta, which will include a small group of developers who've agreed to participate in the beta launch. Our goal is to exit beta by end of February and have the necessary systems in place to enable opt-in, influence over advertising offers (for those offers that impact your product), download funnel reporting and revenue share back to you, the developers. In the weeks/months following the full release, we will continue to iterate on the model, adding more features to the Installer and bringing greater efficiency to our own download funnel (read: increased install conversion). The initial feedback from developers on our new model has been very positive and we are excited to bring this to the broader community as soon as possible. More communication will follow as we move into Q1, and until then, thank you for continuing to work with Download.com.

Sincerely,

\-- Sean

<comment><USER3> Dear CNET,

I hope your servers get fried, along with all your backups.

Sincerely, <USER3>
</comment></comment><comment><USER4> I remember back in 2006 when the Download.com logo had "Safe, Trusted, and Spyware-Free" under it.

EDIT: Picture. [http://www.crunchbase.com/assets/images/original/0000/5821/5...](http://www.crunchbase.com/assets/images/original/0000/5821/5821v1.png)

</comment><comment><USER5> When it comes for Windows software I only use 2 types, Open source software downloaded from the projects website directly or fully paid up commercial software.

I never install anything from ad banners

</comment><comment><USER6> There's three things here. First, adding a toolbar and screwing with user settings is freaking lame, but everyone does it and it's something that's been an accepted way to monitize software development.

However, injecting that into other people's software is low, especially if the developers aren't aware of it. CNET should be ashame.

Lastly, the way they present it to users should be plainly criminal. There's a way to offer additional programs, and that's with a checkbox. The screenshot they show is CLEARLY meant to confuse users, whereas even I would have clicked next hadn't I seen the circled text. On this point CNET should be sued for deceptive tactics, because they put NMAP (or the name of whatever you downloaded) as the title, and present buttons that are meant to deceive, making it seem like it's NMAP's own EULA.

<comment><USER7> "but everyone does it and it's something that's been an accepted way to monitize software development"

No piece of software that I have installed during the past two years has done so, and I sure wouldn't accept it as a way of funding development. I'd rather pay for a product in that case.

Can you give a few examples from your list of "everyone"?

<comment><USER8> I think the Java runtime installer asks to install a toolbar. There is something else that I can't recall (flash runtime?) that asks to install the Ask.com toolbar all the time as well. Some popular open source projects too (PDFCreator).

<comment><USER9> The difference is that Sun adds the toolbar installer itself (and earns the revenue from it).

<comment><USER8> My comment was in response to the fact that everyone is doing it, including software authors such as Sun.

</comment></comment></comment></comment></comment><comment><USER10> When my mother forwards me the latest malware scare chain letter she got frm her friends, I tell her to picture her computer as a plane flying at Mach 4, high above in the stratosphere, confident almost nothing launched from the ground can harm her.

That's because she doesn't use Windows.

<comment><USER11> But this is ignorant and not true.

<comment><USER12> For laymen's purposes it pretty much is, though. When was the last time anyone on Linux/OSX got some adware / popups?

I've also never heard of antivirus for Linux. Which doesn't mean there aren't viruses, it means it's not a concern on the most part.

<comment><USER13> <http://www.clamav.net/> if you were actually wondering. There's also a sweet osx port: <http://www.clamxav.com/>

<comment><USER10> Did you ever catch something with it?

<comment><USER14> If ever, it catches Windows viruses usually. Prevent them from spraying and is also very useful on Linux server setups.

</comment></comment></comment></comment></comment></comment><comment><USER15> Previous post was mentioned on HN (<http://news.ycombinator.com/item?id=3317121>)

<comment><AUTHOR> Yeah, I guess I wasn't paying enough attention but this was the first I'd heard of it.

<comment><USER15> Sorry, I wasn't meaning to say "This is already on HN", but more "Here's some more reading for people who are interested".

I need to practice my tone and style a bit.

<comment><AUTHOR> No worries. Can't have thin skin on the interwebz :D

</comment></comment></comment></comment><comment><USER16> CNET was the top choice for me back 10-12 years ago whenever i wanted to download a utility / piece of freeware/shareware.

Of course when their market share went down... they had to change their business-model...This is just the next step after bloating their pages with ads.

I'm guessing that not the same people are in charge as those who were in their glory days:_)

<comment><USER17> I'm surprised software catalogs are still alive :D Especially when you can get literally everything you need from torrents with keygens/cracks.

</comment></comment><comment><USER18> What good alternatives would people suggest? What should be the "goto" site we could suggest to a novice for finding a clean copy of almost any software...any suggestions? (Assuming that an expert user would straight to the source website)

<comment><USER19> The software producer's website is the only safe place.

<comment><USER20> Regular users have no way to reliably identify the software producer's website. Advising them to "just google it" is likely to end up with them clicking a scammy AdWords link where paying $40 to download some freeware counts as getting off lightly.

</comment></comment></comment><comment><USER21> It's funny seeing this posted so soon after "Don't be a Free User"...

</comment><comment><USER22> CNET was a very tested brand in its day.

</comment><comment><USER2> "This is probably why CNET switch to installing the Babylon Toolbar yesterday. This is a good and welcome move by Microsoft, but the whole process of paying "distribution partners" to changer user's home page to MSN and search engine to Bing is rather sketchy"

I am puzzled by the reaction of some journalists and people here. Have you actually thought why the toolbar is marked as malware? Usually, that's because one guy in one of the AV companies installed the toolbar, didn't like it and so put a flag on. Malware as a definition is something that does harm to your computer. We could argue whether this is actually the case as most of the toolbars, including StartNow just provide search functionality and homepage reset - this is how they make money - there is no reason to do anything sketchy on top of that.

I am not trying to defend toolbar companies here but the quote above that its actually a good thing to replace StartNow with Babylon is misinforming the public. These toolbars all do the same thing and they should either be marked all by AV companies or not. Of course its never gonna happen because there are some AV companies that won't flag toolbars because hey - they distribute toolbars too!

<comment><USER17> Everything on CNET is being tested manually with VirusTotal. If it gets at least 4 positives/false positives from 43 antivirus engines they don't publish it or work with it, until developers get things settled down with anti- virus/anti-malware companies. They get not that much profit from paid accounts cause of small percentage of subscribers, and give away tons of traffic + man hours even for free products. That includes manual testing, checking and writing descriptions, reviewing, and that repeats for each update. And lots of companies update their products like 10 times a week, just to get bumped in search, or create like 20 versions of 1 program under different names, especially Chinese developers. So they just monetizing traffic and stimulating developers to get subscriptions to remove ad for their products. I personally hate all kind of that toolbar stuff, but hey, there are not so many ways to promote an alternative search engines that work for free.

<comment><USER23> Welcome to HN Georgiy.

Here's the deal: That still doesn't mean it's not crapware.

You mention the difficulty of funding your download site (built almost exclusively on supplying other people's free content). I can't imagine what the bandwidth costs must be on a site like that. I'm sure there are plenty of other visitors on HN that are familiar with this issue and are daily encountering similar ethical decisions about how best to fund their business.

There are many ways of resolving difficult ethical decisions. <http://en.wikipedia.org/wiki/Normative_ethics> One useful technique is to ask yourself: _If everyone behaved in this manner, what kind of world would result?_

So let's imagine such a world:

* Want to view a .pdf on the web? ... receive and run an executable downloader from an unrelated party.

* Want to watch a video on YouTube? ... receive and run an executable downloader from an unrelated party.

* Want to install an application? ... receive and run an executable downloader from an unrelated party.

Do you see the problem here?

(Maybe you don't, but most everyone else on HN will and I'm doubtful that you're even reading the responses. But if you are still interested I'm sure we can politely explain it further for you.)

<comment><USER17> It's just my humble opinion as an internet marketer :) i'm not related to CNET atm, worked there as tech for some time. And i think it's really an ingenious idea with wrapper, maybe not so good with all that toolbars. Maybe it's crapware and they lose like all geeks, 20% publishers and 30-40% users maximum - they still will be like x10 profitable than before. Don't get me wrong but Google wasted like hundreds of millions on unprofitable YouTube, and now they airing this shitty advertisements that are so fucking annoying %) luckily there are all theese adblock extensions out there.

<comment><USER23> But it's not an ingenious idea; malware has been doing that kind of thing _forever_.

Downloading and installing software is an activity that is fraught with peril. The authenticity of the app you're downloading is critical and almost all the security properties depend on it.

If you think that breaking app authenticity is a great marketing opportunity, well, your brand will do no business with me or those I advise.</comment></comment></comment></comment></comment>


The 18-Year Side Project: Why I Built and Sold The First Fantasy Basketball Site - <AUTHOR> http://blog.pbutler.com/2013/01/the-most-elaborate-weekend-project-of-my-life-why-i-built-maintained-and-sold-sports-ws/

<comment><USER2> "I can't say it made me the coolest kid in school, but it was fun. Don't worry, I still got chicks because I played trombone and was in advanced math." <\-- I can relate (except I played trumpet)

I enjoyed reading your story. Always inspiring to see someone with a passion just go out and build something themselves. You weren't building a business you were scratching your own itch. Congratulations on the sale.</comment>


Tired of Instagram? Try Instalayer, early signup available - <AUTHOR> http://goinstalayer.com<p>We can't be too specific about what is Instalayer, but soon you will be able to see and create. If you have any questions, feel free to email firstname.lastname@example.com <comment><USER2> > "We can't tell you what it is but sign up!"

This approach rarely works on HN. Much better to launch your project then come back to show the community.</comment>


Language-Agnostic Sentence Representations - sahin-boydas https://github.com/facebookresearch/LASER <comment><AUTHOR> Can somebody explain like I'm 5 what I might use this for?

<comment><USER2> I think one example would be if you wanted to train a text classification system in one language, but also allow it to be useful for classifying text in languages it wasn't trained on. If the language can be mapped to this representation, it's a valid input.

</comment></comment><comment><USER3> Looks interesting, not sure why they went with Creative Commons as a license though. It's "Attribution-NonCommercial 4.0 International" for those curious.

<comment><USER4> I can't speak for this project, but I know I did similarly for one of my projects simply because I wanted to encourage research use and discourage commercial use. If people wanted to use it I thought it'd turn out better that they reimplement it themselves. I'm thinking maybe it's similar here.

</comment></comment><comment><USER5> This is the repo for the FB post submitted a couple days ago: [https://news.ycombinator.com/item?id=18970112](https://news.ycombinator.com/item?id=18970112)

</comment><comment><USER6> It seems to me they opened the source for the encoder but the decoder is not included.

This means we can use it to index sentences in any language and calculate the semantic distance between them, but we can't use it to implement an alternative to Google Translator.

</comment><comment><USER7> The 'conlang' crowd are difficult - a verbless language: [https://en.wikipedia.org/wiki/Kēlen](https://en.wikipedia.org/wiki/Kēlen)

<comment><USER8> I'm fascinated by the concept of a verbless language, but don't want to go to the effort of learning a conlang to experience it. But taking English and removing the verbs, substituting similar structures as in Kelen, wouldn't be all that instructive; I'd spend more time aghast at how seemingly incomprehensible the English is rather than the effect of the change to the language. Difficult one.

(That said, if someone did decide to make some sort of Kelenglish, I'd love to see it thrown into this framework!)</comment></comment>


No one should have to travel in fear - <AUTHOR> https://medium.com/@andreasgal/no-one-should-have-to-travel-in-fear-b2bff4c460e5 <comment><USER2> Here's the thing:

If it was a legitimate search with real public security purpose, there is no excuse for letting him go without completing the search.

If it was not a legitimate search with real public purpose, there is no excuse for the threats or retaliation.

 _Irrespective_ of the legitimacy of the search, the behavior here is unjustifiable.

<comment><USER3> Some other possibilities come to mind, and perhaps there are more:

* It was a legitimate search wrt information available at the time, and then more/better information became available, and it was no longer legitimate. (Assuming a certain definition of "legitimate".)

* It was a legitimate search, and cloning and/or compromising the devices took time.

(Just devil's advocate, for intellectual curiosity, not disagreeing with public interest concern.)

<comment><AUTHOR> My reading of [https://www.aclunc.org/docs/ACLU- NC_2019-03-28_Letter_re._El...](https://www.aclunc.org/docs/ACLU- NC_2019-03-28_Letter_re._Electronic_Device_Search_SFO.pdf) is that they didn't take the devices out of his sight/control, they just demanded he unlock them and hand them over.

> _CBP officers searched Dr. Gal's wallet and all his luggage, and asked > questions about everything they found. When they discovered Dr. Gal's Apple- > issued electronic devices, the officers first asked Dr. Gal to pull up his > itinerary on his mobile phone, and then to hand the unlocked device over to > CBP. Dr. Gal responded that he would email them the itinerary, but that he > would need to speak with a lawyer and his employer before giving CBP > officers full access to his mobile phone._

...

> _Moreover, there was no reason for any CBP officers—TTRT or otherwise—to > detain and interrogate Dr. Gal or his devices. Notably, CBP officers did not > confiscate and retain Dr. Gal's devices, which they were authorized to do > under the Directive and presumably would have done if they truly felt that > they possessed a basis for detaining Dr. Gal or keeping his devices. See > Directive, § 5.3.3. Instead, CBP officers proceeded to demand that Dr. Gal > provide immediate, unlimited access to his devices._

</comment></comment></comment><comment><USER4> Dunno what to do about this. I think TSA is a sham and a waste of my money. I think border control is taking my money and using it to abuse people. I don't think it's ok that I can pay to avoid the poor people line at the airport.

I've written my reps and the president, I call about once a month, but it has no measurable effect. Smarter people than me have done audits on TSA and published them in famous newspapers to show how useless they are. There's people fighting against CBP locking up asylum seekers but it still happens.

Dunno what to do. Partner and I are considering abandoning the USA.

<comment><USER5> You don't have to pay to bypass the lines. The free "Mobile Passport" app allows you to go into a line is almost as quick as Global Entry.

<comment><AUTHOR> Global Entry gets you two things: a faster line when you re-enter the US, and membership in TSA Pre-Check. For me, Pre-Check is far more useful, because most of my travel is domestic (and it also helps you on the outbound portion of international travel).

<comment><USER6> Precheck alone is $15 cheaper.

<comment><USER7> Or to put it another way, Global Entry is only $15 if you're already buying PreCheck.

Global Entry paid for itself the first time I used it when I made a connection after going through customs that I definitely would have missed if I had to wait in the regular line.

</comment></comment></comment></comment></comment><comment><USER8> Glen Greenwald started writing about this back in 2012.

>One of the more extreme government abuses of the post-9/11 era targets U.S. citizens re-entering their own country, and it has received far too little attention. With no oversight or legal framework whatsoever, the Department of Homeland Security routinely singles out individuals who are suspected of no crimes, detains them and questions them at the airport, often for hours, when they return to the U.S. after an international trip, and then copies and even seizes their electronic devices (laptops, cameras, cellphones) and other papers (notebooks, journals, credit card receipts), forever storing their contents in government files. No search warrant is needed for any of this. No oversight exists. And there are no apparent constraints on what the U.S. Government can do with regard to whom it decides to target or why.

[https://www.salon.com/2012/04/08/u_s_filmmaker_repeatedly_de...](https://www.salon.com/2012/04/08/u_s_filmmaker_repeatedly_detained_at_border/)

Laura Poitras, the documentary filmmaker whose story was told in the above link faced several dozen of these incidents between the Bush and the Obama years.

Interestingly, Edward Snowden learned who Poitras was from this series of stories, and Poitras' experiences with repeated searches and seizures led to her learning enough about encryption so that when Snowden decided to contact the press and become a whistleblower, Poitras was the first journalist he attempted to contact who knew enough to be able to exchange encryption keys and communicate with him directly.

</comment><comment><USER9> Although it is difficult to do so, maintaining your calm when faced by intimidation by government agents generally works out. Andreas did exactly the right thing - followed his gut calmly then, filed a case in the courts later.

<comment> forgot-my-pw When did he file a case? It's not mentioned in the blog.

<comment><USER10> > It is in that spirit that I have filed a civil rights complaint with the > help of the ACLU against CBP for unlawfully detaining me and violating my > constitutional rights.

<comment> forgot-my-pw Found the link someone else posted: [https://www.aclunc.org/news/aclu-files- complaint-department-...](https://www.aclunc.org/news/aclu-files-complaint- department-homeland-security-over-unwarranted-interrogation-and-attempted)

<comment><USER11> It's a OCRCL complaint: [https://www.dhs.gov/office-civil-rights-and-civil- liberties](https://www.dhs.gov/office-civil-rights-and-civil-liberties)

</comment></comment></comment></comment></comment><comment><USER12> Every time an article like this pops up (seems like a couple times a month now), I'm validated in my decision to donate monthly to the ACLU. They're always mentioned as fighting this stuff on the front lines.

<comment><USER13> Every time an article like this pops up I am validated in my decision to no longer travel to the United States.

<comment><USER14> This is the part I don't get. Surely they realize there are a large portion of people that will avoid that county just on principle that they may be hassled at the border. I can imagine that these policies have cost them millions of dollars. Imagine going to a county and being turned around all because you had an employers laptop you promised not to unlock for anyone. Or how about a personal laptop with naked pictures of your wife and kids bathing. Especially when we know it is all security theater. So I am with you. I will avoid the USA for now until the climate changes.

<comment><USER15> Pretty much all Europeans I know working in Latin America that travel home 1-2 a year, avoid flights that go trough US airports even tough it would often be the cheapest options by quite some margin. For me not having to deal with US borders is worth the up to 300 USD difference in flight price.

I did it once back in 2008 for a flight from Costa Rica to Switzerland via Miami and was caught completely by surprise that, unlike every other airport in the world I have been prior, Miami (US in general?) did not have a separate transit area, and that I had to go trough the whole customs and migration circus for a 3 hour layover.

<comment><USER16> I just went through this circus for a 1.5-hour layover. Salt in the wound was CBP having just 1 agent serving Non-US travellers for a 737 that just came from Japan…

</comment></comment></comment></comment></comment><comment><USER17> This is becoming too common. Laura Poitras has documented her harassment as have multiple others activists and journalists. The idea of opaque no fly and other secret lists, secret processes and demanding to go through people's personal papers is totalitarian.

If this happened in China or for instance Venezuela there is instant global outrage about 'freedom' and yet every time the exact same thing happens in the UK or the US the outrage is quickly replaced by legalese and apologism. Surely if people cared so much about any of these values they would severely push back when it happens in their own backyard but we rarely see that, just more demonizing others which quickly loses meaning and becomes complicit in the descent to a quasi police state.

Many who make sweeping statement about 'democracy' and 'freedom' seem to be severely disconnected from things on the ground as those those who use these 'freedoms' in any serious way in terms of actual activism or critical journalism however slight end up on some kind of list and singled out for harassment. [1]

[1] [https://www.counterpunch.org/2019/03/25/the-tsas-role-as- jou...](https://www.counterpunch.org/2019/03/25/the-tsas-role-as-journalist- harasser-and-media-watchdog/)

</comment><comment><USER18> It's horrible but the case-law seems fairly well settled; various courts have ruled that lots of searches that would otherwise violate the 4th Amendment are totally permissible for CBP agents within 100 miles of the border and at customs checkpoints within international airports. I'd love to be surprised if there is a legitimate case here.

<comment><AUTHOR> Sure, but you should still have the right to have a lawyer confirm that for you, no? The entire reason we have the right to legal representation is that individuals are not expected to understand all the case law in the country. A lawyer can totally say "Yeah, they're allowed to search you, unlock your phone"—but the ability to confirm that with a lawyer is an important right.

<comment><USER19> The right to an attorney is actually limited to criminal defendants, so if they don't charge you with anything, you aren't actually afforded that protection Constitutionally. So if they just detain you, they can credibly ignore this. I'm not 100% sure on how Miranda rights apply to border detainee situations, but if they do apply, you'd get a phone call. If they don't, your options are basically to wait them out.

</comment></comment></comment><comment><USER20> _They informed me that I had no right to speak to an attorney at the border despite being a U.S. citizen, and threatened me that failure to immediately comply with their demand is a violation of federal criminal code 18 USC 111._

The Justice dept refutes the part about 18 USC 111. A forcible act must be involved, not passive resistance: [https://www.justice.gov/jm/criminal- resource-manual-1565-for...](https://www.justice.gov/jm/criminal-resource- manual-1565-forcible-act-required-18-usc-111-application-statute-threats)

</comment><comment><USER21> You're not alone. I've cut my U.S. travel significantly in the last years due to what I've experienced as hostile border agents for reasons I could never quite figure out but probably related to my nomadic lifestyle. I'm not a U.S. citizen but I do come from a "friendly" nation and it's shameful some of the things that have been said to me in an effort to catch me out in a lie that didn't exist.

</comment><comment><USER22> > The agents proceeded to search my belongings and demanded that I unlock my > smartphone and laptop. This was rather concerning for me. My phone and > laptop are property of my employer and contain unreleased software and > proprietary information. I've signed a non-disclosure agreement promising > not to give anyone access.

His employer is Apple. I was always worried about this same scenario when traveling with an Apple-owned laptop..

<comment><USER23> if his employer is apple then he is fine to unlock. all such employers _require_ you to follow border agent instructions. that said he may be in violation of a policy not to travel with proprietary info

<comment><USER24> > that said he may be in violation of a policy not to travel with proprietary > info

How is this policy supposed to work? Seems like it would a huge pain point for any sort of travel.

<comment><USER25> My company issues travel-specific devices that are only used for web-based services via VPN.

</comment></comment></comment></comment><comment><USER26> It's good he has the ACLU on his side and is working with them, they are the one non-profit org I actually donate to every month.

</comment><comment><USER27> Fantastic that he posted his experience, but it sounded like a pretty standard experience with authorities for many Americans. Genuinely curious why this is news compared to what happens to many other people?

<comment><AUTHOR> As a Global Entry holder myself I expect that because the government has done a background check on me, has my fingerprints, etc., it generally understands that (despite my Indian skin, unshaved stubble, and vote for Hillary) I am not a threat. I have voluntarily subjected myself the government conducting a background check and holding files / information on me in exchange for less hassle. So part of it is that it's baffling they would detain a Global Entry holder and effectively remove his Global Entry status without explanation.

(For what it's worth, I helped my family move cross-country by car in summer 2016; we passed a "border" checkpoint in New Mexico or so, on I-10 relatively far from the border, where they stopped each car, asked us if we were citizens, and let us go on our way when I answered yes. That seems like a much more "standard" experience than what's here.)

Part of it is denial of a lawyer. As I understand it, you might not have a right to deny the search, but you should still have access to counsel, because the point of legal representation is that they can tell you exactly what rights you do / don't have.

Part of it is an apparent government focus on Mozilla. Andreas Gal hasn't been at Mozilla for about four years, but that's what they asked him about. And there was the visa denial for Daniel Stenberg (author of curl) when heading to the Mozilla all-hands: [https://daniel.haxx.se/blog/2018/07/28/administrative- purgat...](https://daniel.haxx.se/blog/2018/07/28/administrative-purgatory/)

And finally, part of it is that it _shouldn 't_ be common. It's a good reason for individuals and companies to leave America.

<comment><USER28> I'm an American and I have been detained and searched by CBP without actually ever leaving the country. They didn't ask my name, just that we needed to get out of the car while they let their dog search the car.

<comment><USER29> You don't have to get out of the car. CBP only have power to stop you to ascertain the citizenship of the passengers. They need reasonable suspicion to further detain you, or probable cause to search you or your car.

You can consent to the search, but you don't need to. If you refuse consent and they lack probable cause, the evidence would be suppressed.

For more details: [https://www.aclu.org/blog/immigrants-rights/immigrants- right...](https://www.aclu.org/blog/immigrants-rights/immigrants-rights-and- detention/your-rights-border-zone)

<comment><USER28> He claimed their dog indicated on our car... but that's a bunch of BS because the dog was already sitting next to them when we pulled up and didn't do anything further(exactly the same thing the dog did for the car in front of us).

He then tried to get us to say we had personal use amounts of drugs on us and he was only looking for massive amounts of narcotics(the "amount cartels have" according to him).

I was with a friend who was not a US citizen but is here legally on a work visa, they took his documents and left me alone while the dog ran through the truck.

And to be honest, do you really think I'm going to put up a fight when I haven't seen a shower in days and have a 7hr drive ahead of me?

We obviously fit a profile of sorts because the first words out of his mouth when we pulled up were to pull to the side because his dog indicated on us and he needed to search our car.

<comment><USER29> If the dog signaled, that's probable cause to search the car. They can take detain you and search every nook and cranny of both the car and its passengers.

Again - nothing distinct about being near the border for that.

As you said, it's not objective whether the dog legitimately signaled. But IIUC you have limited ability to demonstrate that. (anyone know of cases around this?)

<comment><USER30> > If the dog signaled, that's probable cause to search the car.

In other words:

The Fourth Amendment of the Constitution clearly states: "The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated unless a dog barks."

<comment><USER31> Unless a dog is directed by its handler to bark. _FTFY_

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER32> A tip of my hat to the guy for not relenting and unlocking his devices under threats of violence and staying silent! Well done!

</comment><comment><USER12> Border Patrol has become the KGB. Hopefully this will reach a boiling point soon and they'll harass someone important enough to get the gears actually moving toward ending this madness.

<comment><USER33> No. If they find someone important they just let him go with an apology. Penn Jillette fought them years ago and refused their apology; it went nowhere.

</comment></comment><comment><USER34> It's analogous to police "searching" a homeless person by throwing, tearing up and destroying all of their property without even reasonable suspicion... they do it and get away with murdering people time-after-time because they can under a thinly-duplicitous cover of qualified immunity (at least in the US).

Although police at the borders don't have to have any reasonable suspicion for searches, racial profiling, secret watch lists and targeted intimidation are a likely consequent of an unfettered military-industrial complex that long since ceased to do more than security theater and carry water for the corporate elites. So it should come with zero surprise that such an empire's law enforcement acts with impunity however it pleases and only ensures to "serve and protect" the rich elites' and their property, effectively creating a socioeconomic apartheid of gated communities and post-apocalyptic anarchist favelas, both in terms of geography and public discrimination, that tears a society apart into a failed, third-world, backwards country.

</comment><comment><USER35> Immigration lawyers: What is the right thing to do when you are detained at the border as a US citizen?

</comment><comment><USER36> How does a layperson without retained counsel handle this? Is there an ACLU hotline? Do I need to be prepared with a number in my wallet?

<comment><USER12> They didn't even give him the chance to make a call. You're completely helpless unless you've done your research and come up with a game plan ahead of time.

</comment></comment><comment><USER37> Going on a trip in the short term and just got a phone with facial recognition unlock. I think it's important to turn this feature off before returning to the US as it could easily be misused in this exact situation.

<comment><USER38> On an iPhone, you can tap the power button five times consecutively to disable biometric access. However, I think the only way to do this on a MacBook with TouchID is turning it off.

<comment><USER39> You could also ensure you turn off the MBP before you enter customs, as it requires a password on startup

</comment></comment></comment><comment><USER40> This needs to be challenged to the Supreme Court level whereby it is deemed unconstitutional for TSA agents to detain and seize people and their possessions without actual demonstrable cause relating to national security and/or the spirit of the law(s) governing their policies and procedure.

If overly broad legislation is being abused against the spirit and intention of it, then the court needs to step in to legally to rule that this cannot be done, so long as such finding is in line with the constitution.

<comment><USER33> Won't happen until Donald Trump's justices retire.

<comment><USER41> Justice _s_? Trump has nominated exactly one.

<comment><USER42> And this ridiculous customs policy probably dates back to the Clinton administration. I know it was perennial ragebait on Slashdot.

</comment></comment></comment></comment><comment><USER23> i love how "the time is long overdue". everyone says that when it happens to them. he's not wrong, but we need more folks that don't sit around as if it's someone else's problem.

</comment><comment><USER43> Is this something we need to petition congress to fix? Do CBP agents have the right to search the electronic devices of US citizens without a search warrant or not?

<comment><USER44> > Is this something we need to petition congress to fix? Do CBP agents have > the right to search the electronic devices of US citizens without a search > warrant or not?

IIRC, if you're a citizen, they have the power to seize your devices (and anything else you have, for that matter) and temporarily delay/detain you, but not to force you to unlock anything. They can't deny you entry.

If you're _not_ a citizen, then they can deny you entry. So you might have to choose to unlock your devices for them to return home to the US or avoid having your travel plans ruined.

[https://www.aclu.org/blog/privacy-technology/privacy- borders...](https://www.aclu.org/blog/privacy-technology/privacy-borders-and- checkpoints/can-border-agents-search-your-electronic)

<comment><USER45> Indeed, they can not "force" you to unlock the device, however they can deny you entry to the country unless you open the device (although it seems this has not been thoroughly tested in the courts).

<comment><USER44> > however they can deny you entry to the country unless you open the device

I think that's only true for noncitizens, they're required to let citizens in. Sorry, I think I was in the middle of updating my post as you replied.

</comment></comment></comment></comment><comment><USER46> Border responses are little different to the support the average person gets from a tech giant. You get the response you get and that's it. You need deep pockets, serious friends or an online furore or you have no choice but to remain oblivious. As with the tech giants, for the decent people caught up by mistake, it's frustrating and terrifying.

</comment><comment><USER47> CBP/TSA/DHS are thugs who have virtually unlimited power, zero accountability, and relish the chance to abuse their power. Its no different from cops celebrating killing innocent people.

The US media is a joke, they drump up fear without holding anyone in govt accountable, and the people are stupid, no one cares about this kind of thing, they'd rather believe the usual nonsense about 'keeping us safe'.

</comment><comment><USER48> > but agents confiscated Gal's Global Entry card

The irony (and borderline hypocrisy) of a "privacy advocate" who have a Global Entry card.

</comment><comment><USER49> > The customs agents did however keep my Global Entry card as a punishment

?????

You never need your global entry card at airport customs because your flight information is encoded to your passport, which the machine scans.

Was that supposed to be punishment? Why did he even have it? Does the Global Entry number still work and automatically give you TSA Pre on the new tickets you purchase?

<comment><USER50> I'd assume that they also revoked Global Entry, which they can do arbitrarily and I'd be surprised if "you didn't comply with our arbitrary demands" wasn't explicitly listed as one of the specific examples of reasons for revoking it.

<comment><USER49> > I'd assume that they also revoked Global Entry

instead of assuming can we get an answer? OP? ACLU? The author mentioned he has taken flights since then, he should be able to answer if he still gets TSA Pre, nobody's asked yet

its just as likely that they literally only took the card from him.

<comment><USER11> They found the card with my passport. They took the card, and a few days later my status was revoked as well.

<comment><AUTHOR> Are you in the process of trying to get it reinstated, or not yet? (The ACLU letter doesn't seem to include a demand for reinstating it, but I guess you'd be approaching it in some other way)

</comment></comment></comment></comment></comment><comment><USER51> He's saying he was targeted because he's known to disapprove of the Trump administration? Please. If anything, it was considerably worse prior to 2016.

A better question would be why someone technically knowledgeable would be carrying a laptop through airline security at all. As soon as it's out of your hands, you have to assume it's been blown, security-wise. Far better to just buy a burner Chromebook at your destination.

<comment><AUTHOR> Taking a laptop through airport security as a carry-on doesn't involve letting it out of your hands. (I assume they do not hire hobbits to hide inside the X-ray machine and implant hardware on your motherboard.)

<comment><USER51> Let's just say I have a lot or respect for the possibilities I'm aware of, together with a general sense that there's a lot that I _don 't_ know.

In any case, just because you _usually_ get your laptop handed right back, it doesn't follow that you always will. If it matters to you, buy that burner.

<comment><AUTHOR> Even so:

1\. I can expect that there's a chance that my laptop will be taken from me (and perhaps returned modified or perhaps taken permanently) while still not being okay with that. It's one thing to expect a right to be violated; it's another thing to give up.

2\. It's not unreasonable to travel with a laptop while expecting a small chance that it's taken, in which case you'll buy a new one and restore from backup, instead of buying a burner every time.

<comment><USER25> Seems easier to buy a "burner" at home though, and then it's indefinitely reusable.</comment></comment></comment></comment></comment>


Why .NET Core Made C# Your Next Programming Language to Learn - <AUTHOR> https://stackify.com/net-core-csharp-next-programming-language/ <comment><USER2> I had been working in the Windows / .NET ecosystem for almost a decade prior to my current role. I always thought C# was a nice language to work in, CLR is a really capable runtime, and Visual Studio is one of the best IDE out there. But my observations is that C# in .NET core seemed to appeal only to existing C# / .NET devs.

I am excited for the new functional features coming in C# 7, but to be honest, these days it would not be my first choice of language when starting a new project. That choice falls to Scala due to its versatility:

\- Blending of OO and FP.

\- Works in backend, frontend (ScalaJS), or compile to native.

\- Multi-discipline applications, e.g. web apps, data science, scientific computing, etc.

One of the biggest benefit as well, is that it leverages the JVM ecosystem. Big, mature community and choice is abundant. This is actually one of the things that really struck me when first working in it (JVM). It seems like you always have at least three choice for anything, that to most extent works well with each other:

\- Alternative languages: Scala, Kotlin, Clojure, etc.

\- Build system: Maven, Gradle, SBT, etc.

\- GC: HotSpot, Zulu / Zing, Shenandoah, etc.

<comment><USER3> Honestly I just don't like the Java runtime. I'm probably biased, but years of hating Java are the only reason I still haven't learned Clojure. The biggest issue I remember having was with the build system. Sure there are plenty of capable make-like programs, but I want to understand how to run the compiler and linker myself, and I seem to remember butting my head against classpath last time I tried to get into Java, and simply giving up. Am I just crazy?

<comment><USER4> The last few times I worked with Java, I had the same issues but that was several years ago as a very novice programmer, so I can't tell if my information is outdated and/or whether my inexperience was what led to my difficulties.

<comment><USER3> Part of me wants to give it another shot, if only for clojure. (no pun intended)

</comment></comment></comment></comment><comment><USER5> I find C# to be pretty easy to pick up. (I'm wrapping up a project now with C# even though I've had very little experience in it before.) Since .NET has a wide range of applications and it's now cross-platform, I can see how it could become more important as time goes on.

</comment><comment><USER6> Sadly the article does not actually tell me why .NET Core made C# Your Next Programming Language to Learn.

<comment><USER7> It must be cross platform and run on a variety of architectures with a large mutli-vendor ecosystem and huge conferences around the world.

</comment></comment><comment><USER3> s/C#/F#/g</comment>