Hedge Fund Private Investigators - <AUTHOR> https://www.institutionalinvestor.com/article/b1f6yg8n93jyfh/The-Ruthless-Secretive-and-Sometimes-Seedy-World-of-Hedge-Fund-Private-Investigators <comment><USER2> Sounds like a good idea.

I wonder how well a fund would work if you started with a broad index and deleted the companies with scumbag executives.

I ran "downside.com" during the first dot-com boom, picking losers based on cash flow. Picking winners is hard, but picking losers is not so hard. A broad fund minus likely losers might outperform the market.

<comment><USER3> Hmm. I wish I had seen your site. I do recall "fuckedcompany.com" a crowd- sourced chronicle of dotcom excess and failures.

<comment><USER4> The same guy who started that site wrote a great book that documents many of the "losers" with detailed, and hilarious "case-studies." Highly recommended!

IIRC it is called F'ed Companies

<comment><USER5> Indeed. And its author is a regular if somewhat infrequent HN poster under the username "pud", as one would expect.

</comment></comment></comment></comment><comment><USER6> > "on its website, DDC says it once found that "the president of a large U.S. > asset manager was arrested twice for major art theft""

> "Another case involved a Bear Stearns executive whose murder conviction had > previously gone undetected because, Barakett suspects, a casual background > check either did not look at records in every state he had lived in or > checked the wrong name or date of birth"

Its sobering to see the type of criminality that that they are uncovering at the top level of established financial services companies. You do wonder if people genuinely didn't know, or if their crimes were simply ignored.

<comment><USER7> More likely anyone official who found out was added to the bribes lists - actual bribes, political contributions, etc.

</comment></comment><comment><USER8> >That the field is awash in unscrupulous characters who stretch the outer bounds of legality and morality, individuals willing to secretly record targets, pay off sources, hack, and steal, all covered by what one due diligence researcher calls an attitude of "don't ask, don't tell."

Outer bounds? Is there a single place where those aren't crimes? Where do they find these people?

<comment><USER9> Secretly recording people is legal in many states and from public property in most. Paying off sources is usually legal. "Hacking" is too broadly defined, some of it is legal in some situations, most isn't. Stealing by definition isn't legal.

</comment></comment><comment><USER10> That video of the guy pretending to be a reporter... hilarious and sad. My gut tells me that should be illegal in some way, I don't know how or why, but it is wrong.

</comment><comment><USER11> Makes sense, I watch Billions.

<comment><USER12> Had the same thought exactly!

</comment></comment><comment><USER13> Elliott fund has influenced several tech companies, e.g CEO/board changes and M&A. Samsung were not fans.

<comment><USER14> My last company was outright owned by EMF, a brutal reorganization and gutting of company culture followed quickly.

</comment></comment><comment><USER15> isn't this how Spitzer's enemies took him down?

[https://en.wikipedia.org/wiki/Client_9:_The_Rise_and_Fall_of...](https://en.wikipedia.org/wiki/Client_9:_The_Rise_and_Fall_of_Eliot_Spitzer)

</comment><comment><USER16> Yet another reason to invest in Index Funds.

</comment><comment><USER17> If they actually do this:

"Nussbaum says Blue Heron employees will not misrepresent themselves or lie for a client. "And we will not knowingly violate any rules, regulations, or laws. We will keep our client's confidence very strictly. We will never disclose the name of our client or provide any identifying information that would allow somebody else to identify our clients. We will not say we are working for X if we're working for Y. We would just decline to answer a question or say we're not at liberty to say," he explains."

Then I think it's actually a noble profession.

'Truth Hackers'.

There's a big podcast on FT about these guys - they are the one's the dig out all of the corrupt dictators illegal holdings around the world (i.e. Argentina wants to default on it's loans, when a ton of money was stolen by politicos and hidden in offshore accounts, so the hedge fund managers holding the bonds want to 'find the money') and arguably that's a 'social good'.

But do they stick to that moral impetus ? That's the question ...

<comment><USER18> Link to the podcast?

<comment><USER17> It's in iTunes, sorry no link.

Search FT Alphachat podcast. It's recent about 'the most complicated debt restructuring ever'. About a month old. They talk about PE companies who buy up distressed debt and then go after it aggressively.

</comment></comment></comment><comment><USER19> Only activists would probably go to the trouble of hiring these kinds of people. Don't make the mistake of thinking that Billions is in anyway representive of the industry.

From personal experience, hedge funds are a lot more boring and a lot less cloak-and-dagger than the general public thinks.

<comment><USER20> I don't know about that. I've seen first hand, through close acquaintances, where some hedge funds will expend enormous amounts of financial and human capital resources when it comes to legal fights. Especially when it involves current and former employees of said funds that get sideways with founders and partners.

These guys running a lot of these funds didn't get to where they are without really throwing some sharp elbows at times. With the amount of money at stake, and the sheer megalomaniacal attitudes in play between parties, you can bet the drive to get ahead in any dispute will be especially acute.

<comment><USER19> I mean certainly it happens but the vast vast majority of hedge funds just deal in the trading of vanilla equities, options, bonds, and futures. And there's less/not much to sue about for those kind of things.

There are some who deal in bespoke debt, swaps, CDS, etc, where there are often things to sue about. But it's a less popular space compared to the former.</comment></comment></comment>


Reverse-emulating the NES - <AUTHOR> http://radar.spacebar.org/f/a/weblog/comment/1/1157 <comment><USER2> The title is misleading and the video is a bit obtuse, but the project is really fun. Basically, he's driving a physical NES through it's cartridge slot using a custom rigged hardware+software package based on a Raspberry Pi.

<comment><USER3> I mean, he explains in the video what he means by "reverse emulating". Instead of emulated hardware (software) driving software, he's having the actual hardware interface with hardware.

Maybe a misnomer, but a fairly accurate description, IMO.

<comment><USER4> The reverse part seems to be that a less powerful machine is emulating a more powerful machine (with some help from an external CPU :))

<comment><USER5> The reverse part is that he's running the real hardware with an emulated cartridge ROM, rather than a (dump of) a real ROM on emulated hardware. It's explained in the video.

</comment></comment></comment></comment><comment><USER4> Awesome video! Really worth the watch until the end, with the interesting mix of explaining an electronics project, philosphy, AI and brain augmentation.

Cartridges with CPUs inside is not new and was used in real games.

The website or video description could use a bit more context around it:

-In the youtube video, how is one to know tom7 refers to the author when his youtube name is suckerpinch.

-On the website, how is one to know what this is about when it's just talking about "some project that was 24 hours backdated and blah blah...", and in the further text still doesn't explain what it is, just things like "it was presented in seattle" etc...

<comment><USER6> It's a personal blog post with a link to his new video. It's not the author's job to write his entire bio in every blog post. He didn't post it to HN himself.

</comment></comment><comment><USER7> One thing that's interesting is that is also how the SuperFX chip for the SNES worked, IIRC. It basically was it's own processor and rendering loop. The SNES's onboard CPU was provided only a basic program to interface with the frame buffer, sound, and input.

The major difference is that in addition to the actual rendering CPU, it also had hardware that specifically converted the frame buffer into the SNES tile format to easily dump without issues.

<comment><USER8> So it was like a primitive graphics card?

<comment><USER9> Kind of? SuperFX was essentially a second CPU paired with RAM that served as a framebuffer. You would set a pointer that contained code in its ISA format and it would asynchronously calculate graphics (almost like a second thread) and dump it into the RAM, which the SNES would then DMA right into its tile-based VRAM.

</comment></comment></comment><comment><USER10> I thought the project was fun and the video was interesting and well made.

There is something that reminds me of Bret Victor about his reasoning. Is this a thing? I will call it Engineering Epistemological Reasoning - can more people pull that off now? Awesome. If so great news for me, because I enjoy such reasoning immensely.

<comment><AUTHOR> I'm not sure many people can pull this off. The author here was also great in his presentation about automated NES playing, [https://www.youtube.com/watch?v=xOCurBYI_gY](https://www.youtube.com/watch?v=xOCurBYI_gY). You don't see often academics & hacker work that is also combined with the right amount of humor. He even 3Dified the original Zelda!

</comment></comment><comment><USER11> This guy is hilarious and his work is really awesome.

</comment><comment><USER12> The presentation is absolutely charming. It kept my attention far more than some PowerPoint.

</comment><comment><USER13> The Nintendo GameBoy Player for Gamecube and the Nintendo Super GameBoy did this exact thing.

<comment><USER6> No, those didn't drive _more powerful system_ through the PPU of the _less powerful system_. They used a separate communication channel to connect to the graphics output of the host device.

It's the difference between hooking a device up your video card's input port and running a whole external computer system via the USB mass storage API. The latter is way more of an amazing hack.

<comment><USER13> That's wrong. The Super Gameboy worked exactly like this.

It was a SNES ROM which displayed an external framebuffer using PPU sprites. The external frames came from a hardware Gameboy CPU, but could have just as easily come from anything else - an Atari 2600, an XBox One, an iPhone, etc.

</comment></comment></comment><comment><USER14> I had desire to do similar things but with a HP48 calculator. Basically have a beefy arm thing as a 'coprocessor' to unload long computations and let the calculator be mostly the user interface.

</comment><comment><USER15> oh i just discovered this guy like yesterday and it's nice to see he has a website with all of his projects and such in it :)</comment>


App Feedback Wanted: Betty – Scheduling completely within email - <AUTHOR> http://www.trybetty.com/?utm_source=hacker-news&utm_medium=website&utm_campaign=hacker-news-feedback

<comment><AUTHOR> Hi all! I'm currently working on a product called Betty ([http://trybetty.com](http://trybetty.com)) that allows users to schedule completely within email without the back and forth.

I recently opened up the product to a public beta and I'd love to get some feedback (good or bad).

Try it out here: [http://www.trybetty.com](http://www.trybetty.com)

1\. What do you think of the product? 2\. What is the one feature would you like it to have?

Thanks in advance!</comment>


Show HN: Industrial Control Systems on the Internet - <AUTHOR> https://icsmap.shodan.io

<comment><USER2> Maybe this is a good time to show off our little IEC 60870-5-104 Explorer: [http://ibh-systems.com/iec60870/](http://ibh-systems.com/iec60870/)

There are only a few free 104 clients avaiable, but most of them are terrible (and even pretty buggy), especially if you just want to have a quick overview.

The good ones are expensive (around 1500 bucks) so its not something you would buy on a whim.

Tell us what you think, and if you need any features we are happy to get feedback from you.

By the way, we also develop a EPL licensed IEC 60870-5-104 java implementation. At the moment we are looking to crowdfund the development of a cleanroom OPC UA implementation: [https://wiki.eclipse.org/EclipseSCADA/Plan/IEC_62541](https://wiki.eclipse.org/EclipseSCADA/Plan/IEC_62541)</comment>


Amazon Earnings Result 2Q 2020 [pdf] - <AUTHOR> https://ir.aboutamazon.com/files/doc_financials/2020/q2/Q2-2020-Amazon-Earnings-Release.pdf <comment><AUTHOR> • Net sales increased 40% to $88.9 billion in the second quarter, compared with $63.4 billion in second quarter 2019. Excluding the $582 million unfavorable impact from year-over-year changes in foreign exchange rates throughout the quarter, net sales increased 41% compared with second quarter 2019.

• Operating cash flow increased 42% to $51.2 billion for the trailing twelve months, compared with $36.0 billion for the trailing twelve months ended June 30, 2019.

• Free cash flow increased to $31.9 billion for the trailing twelve months, compared with $25.0 billion for the trailing twelve months ended June 30, 2019.

"As expected, we spent over $4 billion on incremental COVID-19-related costs in the quarter to help keep employees safe and deliver products to customers in this time of high demand—purchasing personal protective equipment, increasing cleaning of our facilities, following new safety process paths, adding new backup family care benefits, and paying a special thank you bonus of over $500 million to front-line employees and delivery partners. We've created over 175,000 new jobs since March and are in the process of bringing 125,000 of these employees into regular, full- time positions. And third-party sales again grew faster this quarter than Amazon's first-party sales"</comment>


Tell HN: Deeply creepy people you may know, suggested by Facebook. - <AUTHOR> So I'm on a dating site, chatting to a nice girl.  A few messages back and forth through their system.
There's no identifying information in my profile. She has my first name and that's all apart from my suburb, which is listed on the dating site. Also I don't know anything about her except her first name and suburb.
Now I'm not a big Facebook user but I do check in from time to time.
So I log in to Facebook and click on the notifications and in the list of "People you might know" is this girl from the dating site, same photo, and her full name, which I didn't know till this point - I only knew her first name. I've never searched for her, never tried to find her in Google or Facebook or anywhere else on the Internet.
So What The Fuck? I mean really, WHAT. THE. FUCK? Can I say WTF any louder?
How is this possible? And is it Facebook's fault that this information is leaking?
I've had online stalkers before and somehow it looks like Facebook is making it super easy for them.
I really wish these goddam creepy "people you might know" suggestions were illegal because they are the scariest fucking using of technology next to the NSA. LinkedIn is probably worse.
Can someone explain how this happened?
If anyone from Facebook is here at HN, please explain how your company knows this information. Someone needs to explain how this is possible. <comment><USER2> Have you not heard of the Facebook ad network? Are you under the impression your dating site doesn't advertise?

"how is this possible?"? That's been obvious for a while now. They track you. Everywhere. Same with google.

<comment><USER3> Doesn't "everyone in IT/CS" use tools like Request Policy, uBlock Origin, Privacy Badger, etc. or a good old-fashioned hosts file to prevent said tracking? Not to mention VPN+Privoxy on a VPS?

<comment><USER2> Well, considering I'm in the IT/CS group and _I_ don't use those tools, the idea that "everyone" uses them is demonstrably false.

Secondly, the fact that it's the most probable explanation of the link between facebook/dating sites, and it hasn't been mentioned yet....clearly they're not _that_ popular.

Finally, can people _stop_ thinking that the way _they_ use the internet is the same way _everyone_ does? That's so far from reality it's not funny.

<comment><USER3> I do not believe everyone uses the internet like I do, but I have assumed many people on HN do something similar. Considering the number of threads I've read about such tools _on HN_ over the years, I don't think it is far fetched to believe that many people on HN use these tools.

</comment></comment></comment></comment><comment><USER4> Maybe this won't be a popular response, but what we do know is that Facebook couldn't give a single fuck about your privacy or protecting your private information. (Insofar as they "care" it is to protect their own interests.) It is prudent to assume and expect that they will exploit you in any way possible. So if you are so concerned, why are you even on Facebook?

</comment><comment><USER5> I would guess she searched for you.

<comment><AUTHOR> But HOW? All she knows is my first name and suburb, and I have a very common first name.

<comment><USER6> With a more complex search perhaps?

Facebook parses and actually works with queries such as "single [gender] friends of friends of friends who live in [X] and like [Y]".

</comment></comment></comment><comment><USER7> The person could have internet stalked you and viewed your FB profile. You could have exchanged phone numbers and one of you is using the FB app which uploads your contacts in the background.

IF this is the standard FB friend suggest then I don't believe its via their ad network. So the above suggestions are more likely.

</comment><comment><USER8> I had the same experience with facebook but in a different way, facebook suggested my father and my uncle though I have completely different nick name. No mutual friend what so ever. I still can not figure out how facebook recommendation system found my dad and uncle!

</comment><comment><USER9> Did you sign to this site using Facebook?

<comment><AUTHOR> To the dating site? No. My user account is created via email.

<comment><USER10> You didn't link your account on the dating site to your facebook account, but maybe the girl did, so facebook knew that the girl was in touch with your dating account, and somehow they had access to your dating profile which includes your email, which they matched in their email database to get your facebook account.

<comment> bro-stick FB likely buys, sells and aggregates graph data from numerous other social sites and applies deep learning in order to pre-stalk possible connections and make other suggestions for users' "convenience."

</comment></comment></comment></comment><comment><USER11> Wait, wait... You signed up for Facebook, used it, continue to use it, and then got upset when they violated your privacy?

So What The Fuck? I mean really, WHAT. THE. FUCK? Can I say WTF any louder?

How is this possible?

</comment><comment><USER12> It's happened to me as well. Facebook has unmasked the full identity of many girls I've simply messaged through apps like Tinder or Happn. It's so predictable I often check the suggested friends expecting to see people I've been chatting with on other services.

</comment><comment><USER13> How much do you value your privacy? Do you allow requests from Dating Site to Facebook? Unless you explicitly value your privacy and take steps to ensure it assume all webpages report back to Facebook, Google, Twitter.</comment>


US, EU Reach Internet Gambling Agreement - <AUTHOR> http://www.readwriteweb.com/archives/us_eu_reach_internet_gambling_agreement.php

<comment><USER2> How does making a deal with a _country_ compensate the business owners for lost revenue? It's just bizarre that they would rather bribe other countries than allow money to come into their _own_ country via legally-operated sites.

 _"Instead of rewriting its gambling laws, the U.S. rewrote its trade rules to remove the issue from the WTO's jurisdiction," writes Lorraine Woellert. "The prospect that other countries may take a similar tack if cases do not go their way has alarmed the international trade community."_

Hey! No erasies!

Rewriting the rules after you already agreed to them... priceless.</comment>


The Great CDN Shootout – A RUM Test for Global CDN Supremacy - <AUTHOR> http://www.mobify.com/blog/cdn-rum-2014/

<comment><USER2> That's an interesting comparison, although I must confess that the absence of Akamai makes it feel like they left the "gold standard" out and just tested the middle of the pack. Of course, I only think that's the case – I was hoping to find out if that true or not.

</comment><comment><USER3> It's pretty "funny" the article took 20+ seconds to load. (Flamebait; Off- Topic; Insightful)

</comment><comment><USER4> Terrible graphing, similar colors!</comment>


Fingerprints are usernames, not passwords (2013) - <AUTHOR> http://blog.dustinkirkland.com/2013/10/fingerprints-are-user-names-not.html <comment><USER2> Fingerprints are not passwords, but I don't think it's useful to think of them as usernames either.

This is a much more pragmatic take on it by Troy Hunt, the person behind "Have I been pwned?": [https://www.troyhunt.com/face-id-touch-id-pins-no-id-and- pra...](https://www.troyhunt.com/face-id-touch-id-pins-no-id-and-pragmatic- security/)

> The first point I'll make here as I begin talking about the 3 main security > constructs available is that they're all _differently_ secure.

<comment><USER3> They are as much a password as the key to your house is a password.

And agree that Troy's description is best as it takes us away from unhelpful metaphors.

<comment><USER4> If you believe your key has been compromised (say duplicated), you can change the lock and your key.

If you believe your fingerprint data has been compromised, can you change your fingerprint data?

<comment><USER5> What exactly does "fingerprint data has been compromised" mean? Someone lifted my print off a glass?

<comment><USER6> Lifted it off a glass/phone/anything else you touched. Or it can be "compromised" in the same way your SSN can be compromised through hacking. The millions of people who were exposed in the OPM hack all have records of their fingerprints now floating out on the darkweb somewhere.

</comment></comment></comment></comment></comment><comment><USER7> Why is this getting reposted? I'd argue this is very shortsighted especially coming from a security professional. TouchID has been a huge leap forward in consumer device security.

Security design must take into account usability. Fingerprints (and now faces) make it easy to use stronger passcodes. If you don't use biometrics, people use weak passcodes. That's clearly a worse outcome.

Sure, it's even stronger to not use biometrics and enter a strong high entropy passcode every time you want to unlock your phone. But to actually advise something like that as a better approach in a consumer device than TouchID is simply to advocate a guaranteed worse security outcome. Maybe you "cover your ass" as a security acolyte and blame the compromised user for not following your stringent prescriptions, but that's not owning the outcome. You have to consider usability.

<comment><USER8> Considering the law can compel you to use your fingerprint to unlock a device, it cannot do the same for a passcode, which only lives in your head.

For this simple, pragmatic reason alone, a pass code will ALWAYS, 100% of the time, beat out any supposed biometric security advantage.

Usability only goes so far, otherwise we wouldn't even have doors on our houses.

<comment><USER7> First of all TouchID is layered on top of a passcode, so you still have good protection from being compelled to provide a fingerprint.[1]

Second, you're missing the point. Passcodes do not "always 100% of the time beat out" biometrics if the passcodes are weak or nonexistent. Which was the case prior to TouchID.

[1] [https://www.theverge.com/2017/8/17/16161758/ios-11-touch- id-...](https://www.theverge.com/2017/8/17/16161758/ios-11-touch-id-disable- emergency-services-lock)

</comment></comment></comment><comment><USER3> No, they're really not either. The whole username vs. password debate is like asking whether the key to your house is a username or password.

Biometrics are used as the key that unlocks a device (or app or asset within the device). And like the house they require physical proximity. And, yes, just like the house key there's a decent chance that someone who lives near you has the same key type (device type -- apple/samsung/lg/etc.) and keying (fingerprint data points) on their front door (phone).

But those odds are basically irrelevant as an attack surface.

For a native app on a phone the "username" is proxied to the device id, once linked to the user.

I think the article being 4 years old reflects a 4-year-old fear of the new and misapprehension of where security problems would arise in the future on biometrically locked phones.

<comment><USER9> I can rekey my house locks, I can change my password, I can.... what my fingerprints?

The reason that fingerprints are a username is that they're a static value associated with the identity of the person, which is later impossible to change.

There's no reason you can't _also_ use a username as a password (though there are lots of reasons you shouldn't), but it's clear that fingerprints are closer to username than password.

By contrast, the key to your house is clearly a password -- it a changeable value used to authenticate to a mechanism that you're authorize to operate it.

<comment><USER10> >I can rekey my house locks, I can change my password, I can.... what my fingerprints?

Years of poor security have taught us that we need our authentication to be easily changeable in order to be secure. It's not true. Passwords need to be changed because they can be guessed. They can be leaked. Any person sitting down at any keyboard could type any random string of characters and, given enough time, figure out someone's password. It doesn't work the same for fingerprints. There is no number of times I can press my finger on your scanner and trick your scanner into thinking I am you. Your fingerprint only needs to be changed if someone steals your finger and keeps it in a state where modern fingerprint scanners will still recognize it. That is exceedingly difficult to do.

We need to get it out of our mind that "we change our passwords regularly, we should change our fingerprints too". Bad security advice led to routine password expiration, and that bad security advice lives on. It's still bad.

>it's clear that fingerprints are closer to username than password

That is not clear in any way, either in theory or in practice. The entire argument works on "fingerprints are publicly visible and cannot be changed" which would suck for a password, but fingerprints are not a password. That's why there's an entirely different name for it. Yes, I can see your fingerprint. But TouchID isn't going to be fooled by a piece of scotch tape lifted from your desk, so it doesn't matter.

Fingerprints are neither a username nor a password. They are a uniquely identifying attribute. Usernames and passwords are not. There is no comparison between the two authentication systems.

<comment><USER9> > There is no number of times I can press my finger on your scanner and trick > your scanner into thinking I am you.

Or I could print random patterns on gel circles I put on my finger and try until one works, which is the equivalent of your password example. (There are digital equivalents of spamming fingerprint reader values to the security chips, which in practice are faster.)

It's exceedingly easy to try a fake fingerprint, and even if it weren't, it would still be possible to generate fake signals between the sensor and verification chip or fake signals to the sensor. There's no difference here between finger prints and passwords.

> Passwords need to be changed because they can be guessed.

lol, no.

Passwords need to be changed when they're compromised -- a good password is exceedingly hard to guess, to the point we should never expect it to happen, but they can be leaked through other means.

Similarly, you leave you fingerprints _everywhere_. So you actually leak your fingerprint values constantly while leaking password values only occasionally. This makes passwords substantially more resistant to capturing the value out- of-band than fingerprints.

> we change our passwords regularly,

This isn't best practice and isn't what most of us do; we change our passwords when they become compromised, which happens through a variety of mechanisms. (Or when we suspect that they may be compromised.)

> Bad security advice led to routine password expiration, and that bad > security advice lives on. It's still bad.

Everyone knew this was bad, and NIST recently updated their recommendations against routine password expiration. However, that has nothing to do with what we're talking about in terms of username-versus-password status for fingerprints.

> it's clear that fingerprints are closer to username than password

> fingerprints are not a password

Well, I'm glad we agree.

> But TouchID isn't going to be fooled by a piece of scotch tape lifted from > your desk, so it doesn't matter.

But it is fooled by easy-to-produce prints placed over my finger based on the Scotch tape lifted from your desk. This has routinely been demonstrated with fingerprint scanners, including on iPhones.

> They are a uniquely identifying attribute.

That's what a username _is_ , lol.

I'm going to recommend you learn more about most of these things before you make security recommendations, because you were factually wrong a few times, and made erroneous conclusions based on that.

<comment><USER10> Your opinions are based on exceedingly bad and outdated security practices, and you seem proud of this for some reason.

I'm wondering what you might say if you were living in the time when cars began to replace horses. Would you have said cars were a terrible mode of transportation because they won't defend themselves against a thief and don't consume hay?

<comment><USER9> I would appreciate you pointing out specific practices you think I have wrong, and what the right ones are for those issues.

<comment><USER10> [https://news.ycombinator.com/item?id=15254291](https://news.ycombinator.com/item?id=15254291)

<comment><USER9> Yes, your argument is based on the idea that fingerprints can't be leaked in practice, which is false.

It's worked for years against a variety of scanners, and is likely always going to be viable because of how scanners work -- a thin overlay can be made of things that are indistinguishable from a finger surface to the scanner, but which triggers the critical points.

If you think that's changed in the past few years (which you seem to), I would appreciate something a little more substantive than your random comment on HN.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER11> Original author here. This article is more pertinent today than ever before!

Your face is your username, not your password.

Use it like you use your username. But never as something secret, personal, unknown like your password.

The same goes for any biometric. Fingerprints, voice, iris, gait, DNA, etc. No matter how much they try to sell you authentication through biometrics, it's total b.s.

@DustinKirkland

<comment><USER12> I said this in a previous thread [1], but I'll restate here:

Your face or fingerprint is neither your username nor your password. It's a form of identity. The combination of username and password is another form of identity. A certificate chain is another form of identity. Not all forms of identity are separated into two components like username and password. And different forms of identity have different properties and applicability.

Trying to shoehorn a form of identity like a face or a fingerprint into the username/password template is counterproductive and will only add unnecessary confusion. Please stop. Dumbing down security and removing the nuance is how people get it horribly wrong.

Security is very dependent on context. Authenticating with a phone is very different from authenticating over the internet which is very different from authenticating in a situation where you're physically present with another human being (credit card, bank teller, etc). Authentication schemes need to be designed for the specific use case in which they're used and no rule is universal.

[1] [https://news.ycombinator.com/item?id=15233454](https://news.ycombinator.com/item?id=15233454)

</comment></comment><comment><USER13> Fingerprints are tokens, just like usernames and passwords.

Oddly enough, from a trust calculus standpoint usernames are not particularly valuable; we could do away with them entirely and the logic of authentication wouldn't change (though usernames add some very nice logistics that from a practical standpoint we don't want to give up).

At a very basic level, a single token suffices to authenticate: something you have, know, or are does prove you are who you claim to be (usernames just give a convenient handle to that). So, a 1TP from a fob, a password, or a fingerprint at a very basic level is enough.

<comment><USER14> Huh? Usernames are essential as they scope the credential.

If you just uttered the magic word to a service logon page, anyone uttering the word gets in.

You see the weakness in this type of scenario with Touch ID. If my wife's fingerprint is on my phone, she can access my Touch ID enrolled banking app.

<comment><USER13> > anyone uttering the word gets in.

Right. That's how a speakeasy works. It's the most basic form of authorization

</comment></comment></comment><comment><USER15> This overly simplifies things. Passwords are primary authentication, biometrics are secondary authentication. Biometrics should only be used when a password has already been established, and then only as a shortcut to entering that password; furthermore, authenticating via biometrics should put one into a limited-access state that disallows tampering with primary authentication mechanisms. The result is that anyone spoofing a fingerprint would be unable to completely own another device.

The tradeoffs inherent to this are well-described elsewhere: a lower degree of absolute security in exchange for a higher proportion of users with _any security at all_ ; in lieu of the convenience offered by biometric authentication, enormous swaths of users leave themselves wide open. And since biometrics are just a convenience, anyone who does require absolute security can easily choose to forgo them entirely.

</comment><comment><USER16> Thoroughly agree, though more from a philosophical standpoint. I would argue using biometrics as passwords removes an element of intent.

A fingerprint can be used against your will; it is significantly harder to be forced to use a password that exists only in your mind.

<comment><USER17> That's a very interesting perspective! But you must recognize that it's a very abstract approach, no?

I mean, when someone identifies themselves through biometry, there's clearly an element of intent. And if they write down passwords on sticky notes, or anywhere else really, it's about as available as a fingerprint is, if not more.

<comment><USER16> When someone identifies themselves, yes; what about when we identify others through biometry?

The scene I'm reminded of is the on in Minority Report(?) where the main character is walking through a bank of bio-sensing ad displays, and has to not look at them to make sure they can't identify him from his iris/retinas.

As an analogy, imagine you take a picture of someone at an antifa vs. alt- right protest that turns violent.

All the picture tells you is they were there; it doesn't tell you whether they supported antifa, or supported the alt-right; it doesn't tell you if they were there as a police officer trying to keep the peace, or if they were simply trying to get in the front door of their apartment building when a clash broke out outside.

The biometry reveals their presence - it doesn't reveal their intent.

<comment><USER17> I was really thinking in biometry as used in a more ordinary situation, like a laptop fingerprint reader. With the most likely form of malicious behavior here being that of identity theft by a small-time attacker. Having to dodge biometric sensors or trying to avoid having your photograph taken at protest are more an issue of surveillance, either by government or by private citizens.

Sorry for not making myself clear at first, but what I mean is that passwords aren't a sufficient guarantee of intent either. If anyone has access to them, they can spoof someone's identity. I reckon that this doesn't really fit a civil rights discussion, because we haven't (I think) reached such a point yet, but government-backed attacker might spoof someone's identity in order to either infiltrate or hijack a civil organization. Essentially, a virtual mole.

</comment></comment></comment></comment><comment><USER18> I see this argument a lot, but I don't really see it accompanied by an argument about what the passwords should be. Companies are gravitating toward biometric authentication methods because consumers have "password fatigue". They can't memorize a long secure password for every site, app, and device, so they resort to using a single password everywhere (which may or may not be displayed on a postit note stuck to their monitor).

All this article offers is:

> For authentication, you need a password or passphrase. Something that can be > independently chosen, changed, and rotated.

Okay, so fingerprints aren't passwords, but what we need instead are passwords, which we know don't work either. Best practices for password security are ignored by consumers because they're onerous, and biometric authentication seems to be insecure by default. What's the solution then?

<comment><USER19> Just use a password manager with a single long secure pass phrase you can remember.

<comment><USER18> That falls under the "too onerous" category I think. I'm not speaking for myself, but for the fact that password managers exist, and yet we still have issues with password security. So that doesn't seem to be a fix for the problem.

We're really fighting human nature here, so maybe the solution is psychological, rather than technological.

</comment></comment></comment><comment><USER20> Something you have. Something you know. Something you are.

The problem with the third factor has always been a balance between cost, inconvenience and how easy it is to turn it into just another something an attacker has.

Retinographic analysis is gold standard but it's hellishly expensive. Fingerprints can be copied. Easily. Facial and behavioural analysis sit somewhere in the middle, with too much scope for false negatives.

So fingerprints aren't a username or password because they're not that factor... But used alone, they can be as weak as a username, in many senses.

</comment><comment><USER21> This argument seems especially dated in retrospect. Since Apple introduced Touch ID in 2013, I can't recall even _one single case_ of criminals or law enforcement using biometrics to access someone's iPhone. Same for any other phone manufacturer.

<comment><USER22> One such case: [http://www.businessinsider.com/police-3d-printed-a-dead- mans...](http://www.businessinsider.com/police-3d-printed-a-dead-mans-finger- to-unlock-his-iphone-2016-8)

<comment><USER23> This sound like an Apple Watch feature! Watch removed, or your pulse stops for more than a few minutes, or your pulse goes too high without physical activity (adrenaline), a passcode is required for all devices on next use.

</comment></comment></comment><comment><USER24> Agree about fingerprints, as they are left around everywhere and thus easy to capture. However, FaceID should be significantly better. As Apple talked about, FaceID only works when your eyes are open and also tested/hardened against modeling.

</comment><comment><USER25> this is a common argument by those who do not understand biometrics

a biometric is a username _and_ a password

\- yes, i know the purpose is to say that the biometric should be used as a password, but that changes the declarative statement quite a bit in my opinion

<comment><USER26> I think it's a common argument for people who think biometrics are a bad idea for security.

IE. You can change your password, you can't change your thumb/face/biometric (easily).

At best, a fingerprint establishes identity, therefore it has more in common with a username, drivers license, social security number, etc. than it has in common with a password.

<comment><USER10> >At best, a fingerprint establishes identity

Nope. At best a fingerprint establishes identity in a unique and authoritative manner. My name is an identity, and anyone can say or write my name. My SSN is an identity, and anyone can say or write my SSN. No one else can speak, type, write, or otherwise express my fingerprint. That is far beyond simple "identity".

<comment><USER27> > _No one else can speak, type, write, or otherwise express my fingerprint._

Neither can you. You can only show your fingerprint for inspection - and _so can anyone else_.

And, unlike SSN or even your name, you leak fingerprints (and facial info) everywhere, all the time.

<comment><USER10> >Neither can you.

That's the point. It's not something I know, it's something I _am_ and only _I_ am that thing.

And unlike a password, if you want my fingerprint you have to be physically near me, and if you want to authenticate as me you need my authentication hardware. A Brazilian hacker isn't going to unlock my iPhone without first flying to the US and then locating me in both space and time to gain access to my fingerprint and my phone simultaneously. But with a password, they could easily go to www.gmail.com and type whatever they want from the comfort of their own home.

</comment></comment></comment></comment></comment><comment><USER28> Yes, but the author preaching to the choir. The real problem here is educating the public at large as to why it's insecure and in what situations biometrics are unacceptable.

<comment><USER29> Is it? If say the public has a pretty good intuitive idea of the security properties of fingerprints. Better than the author here anyway who seems to think fingerprints are as easy to copy as usernames.

</comment></comment><comment><USER30> Discussion at the time (257 comments):

[https://news.ycombinator.com/item?id=6477505](https://news.ycombinator.com/item?id=6477505)

</comment><comment><USER31> I'd rather use my fingerprint on my phone than have a hacker look at the finger oil smudge patterns on the glass to decipher my password. And with my fingerprint I don't need to worry about hiding my password entry.

</comment><comment><USER32> I'm don't even like the idea of biometrics for user names. I don't want malicious actors to easily correlate distinct accounts (this guy's fingerprint has an account at Facebook, Reddit, Chase Bank, ...).

</comment><comment><USER33> I am more than the checksum of my whorls and curves, sir/madame!

<comment><USER27> Not to the Machine, f45875e0b18fa3bb81e0739952acbea9ed458113. Get in line.

</comment></comment><comment><USER34> +1 on this

though I use fingerprints on my laptop, I'm quite aware that it's really easy to leave any fingerprint anywhere

(I use it because I type slow)

</comment><comment><USER35> My mother's maiden name and the color of my first car are also usernames.

</comment><comment><USER36> Biometrics are for identification. Passwords are for authentication.

</comment><comment><USER37> In the same way SSN's in the US are usernames, not passwords.</comment>


Show HN: Typed.pw – a simple way to write online - <AUTHOR> I wanted a site to write one-off articles in a completely anonymous way. No ads, Google analytics or requests to external sites. It's simple and lightweight.
Try it out

  http://typed.pw
 the code is on GitHub
https://github.com/xojoc/typed <comment><USER2> I know! It can be used for morning writers pages. Its when you wake up and first write all the mess that there is in your head to start your day with "empty" and fresh head))))

<comment><AUTHOR> Nice idea. Sometimes my head is a mess and could be useful to unload it by writing. But please beware that what you write is _not_ private. For example try [http://typed.pw/a/n](http://typed.pw/a/n) where n is a number...

EDIT: the first 10 articles are haiku/quotes (I personally like [http://typed.pw/a/3](http://typed.pw/a/3))

</comment></comment><comment><USER3> It looks like you need to remove the XSS attacks; [http://typed.pw/a/397](http://typed.pw/a/397)

<comment><AUTHOR> On my server I have an old version of pandoc which doesn't support

      pandoc -f markdown-raw_html

</comment></comment><comment><USER4> Funny, made something on the same path [http://bloq.in](http://bloq.in)

</comment><comment><USER5> hmm I don't see the use but interesting. Will be great to write a blog like this.

</comment><comment><USER2> Zen for writers)))</comment>


New Therapy Inhibit Neuro-Inflammation and Reverse Multiple Sclerosis in Mice - <AUTHOR> http://www.cell.com/molecular-therapy-family/molecular-therapy/fulltext/S1525-0016(17)30413-6 <comment><AUTHOR> OT: "Gene Therapy-Induced Antigen-Specific Tregs Inhibit Neuro-inflammation and Reverse Disease in a Mouse Model of Multiple Sclerosis"</comment>


Ask HN: What developer tooling are you missing the most? - <AUTHOR> What's the one nonexistent tool that would most improve your productivity when developing? Could be editor, language etc <comment><USER2> a "do not disturb" sign that people actually read and follow!

<comment><USER3> Remote working + disconnected Skype/whatever?

Lock yourself up in a faraway conference room?</comment></comment>


GitLab.com Downtime Postmortem - <AUTHOR> https://docs.google.com/document/d/1ScqXAdb6BjhsDzCo3qdPYbt1uULzgZqPO8zHeHHarS0/edit?usp=sharing <comment><USER2> The bit about the large repositories reminds me tangentially of something I read about Amazon: when tuning for performance, they don't look at, say, the median response time. They look at the 99.9% level.

If I recall rightly, their example was a customer searching their old orders. The customers with the slowest response times were their very best customers, and they wanted those people to have at least as good as an experience as the median customer.

That definitely change my attitude to performance tests: now whenever I'm picking metrics, I think hard the real-world implications of the levels I'm setting.

<comment><USER3> Very true, and you can be sure we'll pay a bit more attention to the 0.1% biggest repositories from now on.

</comment></comment><comment><USER4> One important learning from the postmortem: always set your servers up to be in UTC rather than any other time zone. Helps debugging and log correlation and eliminates confusion during incidents.

<comment><USER2> Is that the lesson? Or just that everything should be in the same time zone?

If the company's staff is all in one time zone, I'm inclined to use that for servers, as otherwise people have to mentally juggle two time zones: local and UTC.

<comment><USER4> That's a good question. UTC is almost certainly still the best candidate even in that case because:

* it's not affected by daylight savings time, which in many candidate timezones causes at least two complex and error fraught time discontinuities every year, and which requires manual intervention at the whims of the US Congress in the USA.

* UTC is the lingua franca of machine time communication -- if you ever have to, e.g., send data about transaction times, server event logs, order histories, etc., to any third party or API, then because there are 23 other timezones besides yours, and data normalization is important, they will almost certainly expect ISO8601 UTC. Yes, ISO8601 has time offsets. No, not all libraries implement them properly on either side.

* The first time you ever have logs from two different timezones -- e.g., a service provider log denominated in UTC and yours in PST -- you will hate computers so much that you will likely quit your job, throw your keys on the floor, and go run a hotdog stand down by the pier rather than deal with it. This is an honest response to time and localization issues but think of your children.

<comment><USER5> ...and just when you thought it was safe to go back outside leap seconds rear their ugly head and ruin your day.

</comment></comment></comment></comment><comment><USER3> GitLab B.V. CEO here, please let us know if you have any questions (you can also leave a comment or suggestion in the doc if you want). This whole real- time postmortem is something we thought of to contribute back after having downtime. Feel free to let us know what you think of it.

<comment><USER6> It's only after I saw the "B.V." I realized Gitlab is a Dutch company, cool! :)

Just one question, I saw a lot of logs being copy-pasted, aren't you concerned about any security sensitive data leaking out?

<comment><USER3> Thanks! We are based in the Netherlands but we're mostly a remote company [https://about.gitlab.com/2014/07/03/how-gitlab-works- remotel...](https://about.gitlab.com/2014/07/03/how-gitlab-works-remotely/)

We're worried about sensitive data, see my other answer [https://news.ycombinator.com/item?id=8003800](https://news.ycombinator.com/item?id=8003800)

</comment></comment></comment><comment><USER7> "6\. Production filesystem IS NOT mounted at this point

9\. gitlab-ctl start starts the GitLab with the staging data in /var/opt/gitlab on the root filesystem that doesn't have any production data. At this point logs report that the production db doesn't exist which is correct because we are not on the production file system. No production data has been touched at this point. The Gitlab web UI is not responding (502 error from nginx)"

This is what strikes me as needing addressing. There shouldn't be staging data that is normally hidden by mounting the production filesystem. If the production database isn't there, Postgres should fail to start. The Postgres team is pretty adamant that otherwise bad things can happen; see [http://www.postgresql.org/message- email@example.com...](http://www.postgresql.org/message- email@example.com)

<comment><USER3> We fixed part of the root issue by restarting GitLab automatically when we configure a server as master, preventing it from continuing with the staging data. The staging data was created automatically by gitlab-ctl. I agree that this is confusing and created the item: "Why did GitLab start when it shouldn't?" in the postmortem. Thanks for raising this point.

</comment></comment><comment><USER8> I wonder what their drbd is using as its backing store and why it's needed at all.

Personally, I honestly wouldn't trust to run a database on top of drbd and I'm unsure whether using a drbd volume as a database directory will even cause the other replica to have correct and usable data in case of an error.

Personally, I would use a real disk or maybe LVM as the store for the database in order to reduce points of failures and remove less tested components from the picture.

Then of course you need a database slave, but it looks like you had that anyways which, again, leads me to question why drbd was even involved.

<comment><USER3> We use EXT4 on DRBD on LVM on RAID10. We already have DRBD for the git repo's and prefer to reuse our experience for the database. There are other reasons too some of which are articulated in [http://wiki.postgresql.org/images/0/07/Ha_postgres.pdf](http://wiki.postgresql.org/images/0/07/Ha_postgres.pdf)

<comment><USER3> I gave a presentation yesterday about our HA setup [https://docs.google.com/presentation/d/1gIzmp-d5X86jJMQz7Ixs...](https://docs.google.com/presentation/d/1gIzmp-d5X86jJMQz7Ixs_dzyhC1OTVK0w3uV_Rtc_Us/edit#slide=id.p)

</comment></comment></comment><comment><USER9> Could this be caused by DRBD not reading the changes from the Postgresql database quickly enough? Or is it some issue with the interaction between the software RAID10, DRBD under high postgresql I/O load? What are the respective versions of the kernel, database and DRBD? Are there disk I/O, network I/O and cpu logs available of the time leading up to the crash?

<comment><USER3> We're not sure. There was a lot of disk locking going on at the time.

</comment></comment><comment><USER10> Well, this is not back for us: our repositories are corrupted...

<comment><USER3> I'm sorry to hear you are experiencing problems. This is the first report we see of possible corruption. Please contact email@example.com and note the urls and commands that do not work for you. Edit: there another report I just found: [https://gitlab.com/gitlab-com/support- forum/issues/2](https://gitlab.com/gitlab-com/support-forum/issues/2)

</comment></comment><comment><USER3> We're talking a break until 16:00 CEST, many questions are answered already and TODO's are given after the => in the document.

<comment><USER3> We're back again.

<comment><USER3> And we're done for today, thanks for stopping by everyone.</comment></comment></comment>


Hacky version control for html - <AUTHOR> http://www.neverfriday.com/html-version-control/web-vc.html

<comment><AUTHOR> I want to thank God, my mom, _looks at camera_ hi mom! and the HTML spec writers who included the INS and DEL tags and of course, jQuery. I love you jQuery!

(any feedback is welcome)

<comment><USER2> There doesn't seem to be much correlation between buttons and what happens on the page.

Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:220.127.116.11) Gecko/20090729 Firefox/3.5.2

For example, if I click on one revision (Gerry Giraffe) and then on the next (Kramer Koala) stuff happens, but if I click back on Gerry, nothing happens. Perhaps further instructions are required.

<comment><AUTHOR> Yeah, right now I have it displaying the changes. The trouble is I don't have an ordering for the versions. Gerry Giraffe doesn't depend on Kramer Koala. I'll fix that up though so that it toggles the changes. Might turn them into checkboxes to make it clearer?

</comment></comment></comment><comment><USER3> The <ins> and <del> tags have always seemed weird to me in that they talk about the document's history, rather than the document itself, or what the document is talking about. The problem I've always seen with using them for version control is, what happens when the document you're trying to version control has <ins> and <del> tags?

I suppose you'd have the same problem if you put a diff under version control, but it seems like this kind of thing implies that there should be something different about those tags (I'd say another namespace, but those have been abused enough already).

I don't know how/if I'd solve this, I'm just wondering if anyone else feels the same.

<comment><USER4> They are not supposed to be used for versioning HTML documents. For example they cannot indicate if you change the HTML head or if you change markup. What they can indicate, is changes in _content_.

I don't think you should necessarily _store_ versioning history of content with INS and DEL tags. If you have a CMS you might have each historic version of content. If the user requests a diff, you can generate it automatically by comparing versions, but you can represent that diff for the user by using INS and DEL elements.

<comment><AUTHOR> It's beautiful that this is the one spot where the W3C got the content/presentation separation correctly.

* but you can represent that diff for the user by using INS and DEL elements.*

This would be false. No thank you. The whole point of including the datetime attribute is to allow for storing the versions _in_ the document itself. HTML should never be hand-coded and should only be interacted with via a good editor. However, there aren't too many of those around.

The default web browser behaviour for dealing with the INS and DEL elements is incorrect and the cause of it is a lack of understanding of what those elements are for and why they were included in the spec.

</comment></comment></comment><comment><USER5> How the heck does this thing work? Looks like it has some nice bells and whistles- wish I knew how to ring/blow them.

<comment><AUTHOR> It stores versions of the document within the document itself via the INS and DEL elements.

Each date up at the top as various changes associated with it. On each day, changes were made to the document. By clicking show/hide you can toggle the changes from that day. By clicking Apply Changes, you can apply all changes up until that day (so if you're applying changes up till day 3, it will apply the changes from day 1 and 2 as well). Play Through Changes does the same thing, however it pauses for a second or two between the changes so you can visually see the changes (fade in/out of the elements).

Applying all changes will run through everything and give you the "final" version of the document.

I'll include a better explanation on the website itself, I was just tired as heck at 4am ;)

</comment></comment><comment><USER6> Needs JS to work (there's no warning about that) and... this is awesome.

<comment><AUTHOR> Ah sorry, I'll include that as well.</comment></comment>


A Nobel Prize Scam - <AUTHOR> https://kirstenhacker.wordpress.com/2020/02/20/a-nobel-scam-2/ <comment><USER2> Now that's a proper Internet rant! I don't know whether her assertions related to all the listed theories being wrong (or simply dumb) are correct. Would any physicists care to corroborate or refute her points?</comment>


Statement by Apple - <AUTHOR> http://www.apple.com/pr/library/2013/02/07Statement-by-Apple.html <comment><USER2> Some things Apple could buy, for cash:

* SpaceX (market cap $10Bn, AIUI)

* Dell (a mere $23Bn!)

* Boeing

* Ford

* The entire global publishing industry (figures for the top 50 publishers' turnover are here: [http://www.publishersweekly.com/pw/by-topic/industry-news/fi...](http://www.publishersweekly.com/pw/by-topic/industry-news/financial-reporting/article/52677-the-world-s-54-largest-book-publishers-2012.html) \-- the largest only turns over $8.4Bn)

* A year of Puerto Rico's GDP (roughly $100Bn)

It is _really hard_ to get your head around just how big Apple's cash pile is.

<comment><USER3> Or they could pay their tax bill. On revenues of $6B in Australia, they paid only $40M in tax, claiming only $99M in profit.

[http://www.theage.com.au/opinion/political-news/labor-mp- tak...](http://www.theage.com.au/opinion/political-news/labor-mp-takes-aim-at- apples-tax-bill-20130206-2dycv.html)

<comment><USER4> Are they being prosecuted for tax evasion? If not, sounds like they are paying their bill. Take it up with your politicians.

<comment><USER5> That's a pretty hyprocritical statement. Big companies know how to legally pay almost no taxes, see: <http://en.wikipedia.org/wiki/Double_Irish_arrangement>

And that's probably not "our" politicians who are to blame.

<comment><USER4> >legally

So it sounds to me like they are paying their tax bill. The fact that it's not as high as vacri or you may like is not their fault.

<comment><USER6> This attitude is annoying. They're forming overseas shell corporations with at most a few employees in those offices who claim an extremely high percentage of all IP-derived income. To claim these companies aren't doing anything illegal, simply because we can't prove that a few people in Ireland aren't responsible for all IP, isn't quite fair. Just because you've arranged fancy license agreements with your Ireland offices doesn't mean those contracts are valid or conscionable.

These companies pay almost no taxes yet feed off our public universities, court systems, patent and trademark offices, copyright offices, public airwaves, highways, federal banking infrastructure, etc. It's sick.

<comment><USER4> > These companies pay almost no taxes yet feed off our public universities, > court systems, patent and trademark offices, copyright offices, public > airwaves, highways, federal banking infrastructure, etc. It's sick.

You misunderstand me.

I absolutely agree that it's sick.

But it is 100% legal because the government allows it to occur. If you are expecting private organizations to not act in their own interest, you're basically fighting gravity.

<comment><USER7> but if you think about how it got to this point, this is almost an inevitability.

Lets suppose that a country wised up, and tried to crack down on this sort of thing. Or better yet, all countries did this at the same time! What would happen?

At first, things would be sweet - the "proper" amount of tax (by proper, i mean similar taxing schemes for corporate entities as well as individuals) means more money to the gov't for social services etc.

However, a country might start thinking that they could attract move investment by making these laws a little more lax - tax incentives? tax breaks, or whatever else you name it. The thing is, companies that operate in a particular country does provide that country with useful output (in terms of jobs etc). It's in a country's best interest to attract as many businesses as possible. This leads to the sort of behaviour we see today - lobby groups have power, because they actually do!

I don't think equality is achievable. Not realistically.

<comment><USER4> > but if you think about how it got to this point, this is almost an > inevitability.

Of course. I also agree here.

Which is why all of this complaining is just barking up a tree.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> This letter looks like it exposes Apple to an enormous potential tax penalty.

From [http://www.irs.gov/publications/p542/ar02.html#en_US_2011_pu...](http://www.irs.gov/publications/p542/ar02.html#en_US_2011_publink1000257893)

"A corporation can accumulate its earnings for a possible expansion or other bona fide business reasons. However, if a corporation allows earnings to accumulate beyond the reasonable needs of the business, it may be subject to an accumulated earnings tax of 15%. If the accumulated earnings tax applies, interest applies to the tax from the date the corporate return was originally due, without extensions.

"To determine if the corporation is subject to this tax, first treat an accumulation of $250,000 or less generally as within the reasonable needs of most businesses.....

"In determining if the corporation has accumulated earnings and profits beyond its reasonable needs, value the listed and readily marketable securities owned by the corporation and purchased with its earnings and profits at net liquidation value, not at cost.

"Reasonable needs of the business include the following.

"Specific, definite, and feasible plans for use of the earnings accumulation in the business.....

"The absence of a bona fide business reason for a corporation's accumulated earnings may be indicated by many different circumstances, such as a lack of regular distributions to its shareholders....

Good thing for Apple that the tax laws of the USA don't seem to apply to megacorps.

<comment><USER9> The last quote there seems to indemnify them...they need cash to pay out "regular distributions to its shareholders" thus any amount of money they have is justified by the need for cash to pay dividends.

</comment></comment><comment><USER10> Can someone explain what this means and why it's happening?

<comment><USER11> Some shareholders want to sue Apple to force them to pay out more of Apple's cash to shareholders. This is a fairly legitimate claim, as companies are meant to pay out excess profits back to shareholders in the form of dividends/preference shares, and Apple is earning more money every quarter than they can use or are paying back. They are also sueing over a special term that allows Apple to create preference shares... not a big deal.

This press release states that Apple is making plans to pay out more cash to shareholders, and that the special term does not exclude the board of directors from doing other things with preference shares in addition.

Apple shares are likely to rise on this news in the short term, but may be a signal that Apple has no new healthy investments, and may lower share price in the long term. Nobody knows, share markets are volatile.

<comment><USER12> If a public company does not pay dividends, what is the motivation for an investor to buy their stock? As far as I can see, an investor can only make money by selling to a "greater fool" or waiting in anticipation that the company will pay a dividend.

<comment><USER13> the company can also buy back shares. the point is that essentially that as long as the company is profitable and continuing to generate cash flow, _some_ shareholder down the road will get his or her due, so the stock is worth some value of these projected cash flows.

</comment></comment></comment></comment><comment><USER14> In a volatile industry like technology, where a competitors industry changing technology can destroy your profitability in a very short time (eg. Nokia, RIM, Yahoo!, etc) does it make sense for Apple to double down on research with this 'excess cash'?

It seems Apple spends considerably less effort on the long-term research like Google and Microsoft. In Microsoft's case, it may be some of these longer range technologies which will keep it relevant, for Google, it seems their research may keep them growing.

<comment><USER15> Apple is far more efficient than companies like Google or Microsoft when it comes to reasearch. In the last 15 years, they have produced the iPod, iPhone, iPad, radically different computer designs, OS X, Final Cut, and quite a few other products.

Over the same period, google has produced PageRank. Microsoft has produced nothing innovative.

Apple pays less of its revenue in R&D, but that's because its revenue is so big.

<comment><USER16> > Over the same period, google has produced PageRank. Microsoft has produced > nothing innovative.

What are you, an idiot? Seriously.

EDIT: Downvote away, I stand by my comment - parent has got to be the dumbest thing I've read on HN for a while and deserves to be called out on it.

<comment><USER17> It's a very fanboyish argument, I agree. Self driving cars don't fund themselves.

</comment></comment></comment></comment><comment><USER18> This looks like a _very_ tax-efficient way to repatriate cash.

<comment><USER19> They actually don't touch the cash in this scheme.

<comment><USER18> Agreed, and they don't want to... Apple's cash is much more useful to Apple wherever it happens to be. It's the shareholders who want the cash, which in a lot of cases means repatriation.

<comment><USER19> I think you misunderstand me. The existing cash pile would remain untouched and therefore would not be subject to any taxes. The preferred shares would earn dividends from Apple which would be paid out from free cash flow. It's a tax efficient way to deliver shareholder value without taking the tax hit like they would if done in the traditional way of a regular dividend or buybacks.

This is just one method of course, another way is to issue debt in the US and use that to repurchase shares/pay dividends. The board will determine what the best way to go about it is, as there are pros and cons to both.

</comment></comment></comment></comment><comment><USER20> I take this as good news, i found in the most unfortunate way how deceptively diversified I actually was compared to how much I thought I was. For the most part I was invested in an array of mutual funds, which I really haven't been watching closely for a while as I have been seeing fairly good return. However when Apple started dipping, I saw myself dipping too. Upon further investigation I found my exposure to Apple was quite significant :\

</comment><comment><USER21> Apple is learning that a record sales and established leadership in your market can still cause your stock to drop 40% over a quarter...So now they are working with hedge fund managers and wall street analysts to offer some complicated trading package. Now Wall street can take credit for AAPL's revival in the markets.

</comment><comment><USER22> Why is Apple not just buying back it's shares? Would that not be the most tax efficient way of increasing shareholder value?

<comment><USER23> That would transfer value only to those shareholders who sold shares. A special dividend benefits all shareholders. Both effectively accomplish the same thing (less money in the company, more among the shareholders), though a buyback would also inflate share price (fewer shares outstanding).

</comment></comment><comment><USER24> Preferred Shares are more like bonds (in that they generally pay a higher dividend rate and are more immune to market swings). In the event of bankruptcy, preferred shares have more priority over common shares but less than bonds.

Apple doesn't need the money so I'm not sure why they would want to issue them.

<comment><USER19> The preferred shares would be issued to everyone that holds the common equity. They wouldn't be raising money if they followed Einhorn's plan.

</comment></comment><comment><USER25> Is that corporate-speak for "We don't have any new mind blowing products that will benefit from extra capital"?

<comment><USER26> $120B (and growing) probably goes a bit above and beyond "extra capital".

</comment></comment><comment><USER27> So does this mean that it is likely to be profitable to buy Apple stock now?

<comment><USER28> In classical stock markets, if Apple is worth $450 a share and they issue a $10 dividend after trading closes, the next morning the stock will trade at $440. If you grew up reading the stock listings in things called "newspapers" sometimes you would see a letter (I think "x" for "ex-dividend" but it's literally been decades) in the listings next to stocks that were doing this, so you knew that a price drop was about to/had just happened.

So even if no one were engaging in arbitrage opportunities, it would make no difference when you purchase the stock.

<comment><USER29> Alternately, we have this market. Apple went ex-dividend today, which would (ordinarily) result in their opening price being adjusted to 2.65 below yesterday's closing (457.26). In this (real) market, it opened up somewhere between $2 and $5 (459-463). (google's data isn't very fine grained here).

</comment></comment></comment><comment><USER19> This bodes well for shareholders. I imagine any additional return will be announced in March (when dividends/buybacks were announced last year).

</comment><comment><USER30> Now that Steve is gone they no longer know what to do with their money. The current management rather then reinvesting the money in the company will simply squander it away by giving it back to stock holders. I'm sure that in a couple of years, when Apple actually starts needing this money, everybody will realize how stupid it was to give away their war chest.

Really, that the current CEO could not think of anything better than to give money back to the stock holders tells me that Apple is now doomed. The guy has no imagination. This move is so typical for a numbers guy. Steve would never have done that. At least not to this extent.

Right now Apple is simply running on inertia but once the momentum is over I expect the entire company will collapse.

<comment><USER31> You made about twenty leaps of logic there. And you're also ridiculously wrong. Even if Tim Cook is an awful CEO (which, come on, at least give him a chance to prove it)... well, Ballmer has had 12 years to run Microsoft into the ground and they're still ticking.</comment></comment>


Unlikely Recommendations for Startups and Entrepreneurs - <AUTHOR> http://moz.com/rand/7-unlikely-recommendations-for-startups-entrepreneurs/ <comment><USER2> Very interesting article!

His point about MVPs is particularly interesting, IMO - but I'm not entirely sure it's correct.

The point of an MVP is to identify an excellent product/market fit. One of the ways you can tell if you've got one of those is if your crappy, half-finished product still attracts users.

If you're refusing to test at MVP stage, you're in serious danger of applying lipstick to a pig.

Of course, it's worth noting that Rand's company has the money to commit to testing multiple "EVPs" \- but for bootstrappers, out of all the advice in this article, I'm not convinced by that point.

(The "build an audience first" advice, by contrast, is proven to work pretty well. Brian Clark at Copyblogger has referred to it as "MVA" \- Minimum Viable Audience - strategy.)

<comment><USER3> I think his tips are sort of a chain. So if you've done #1 then #2 about EVP works. Since you already have a marketing channel built an exceptional product will be able to grab hold and take off right away.

</comment></comment><comment><USER4> This could have been written by my ex-boss, who hired me as a 'lean consultant', then proceeded to ignore everything I said, and do this instead. We're about to find out which of us was right; I suspect she was.

But getting to an 'Exceptional Viable Product' was tough. Constantly moving release deadlines. No idea who was 'right' in the team when it came to UX. No idea if a feature was valuable or necessary so 'done' was a constantly moving target. We ended up with a beautiful, if not bulky EVP (homerlearning.com).

<comment><USER5> Well, the initialism "EVP" says it all: "exceptional" is not measurable, so it's going to come down to the most powerful person asserting their sense of when the VP becomes E.

</comment></comment><comment><USER6> The problem with MVPs is that no one clearly know what they are and the folks that came up with it or evangelize it are often full of shit. On one end, lean is pitched being similar to the scientific method. But on the same note, when someone raises the objection about how to get _statistically significant_ data, we are instructed to use our judgement. Well, that is not the scientific method then!

Next, let's move on to the case studies related to lean. Most people who credit lean _rarely_ treat their project as a carefully designed scientific experiment. They do the common things like dry testing for demand, making quick landing pages, talking to their market...a lot. And _yet_ , if you went to the lean folks and said if these things equate to being lean, they would say NO, lean is a lot more.

So what is lean? No one really knows. It's just that when it works out, people are quick to give it credit. But no one wants to see the graveyard of start- ups that give up their ideas everyday because according to their understanding of the lean method, they did not achieve product/market fit. You know this is bullshit because you can take a cursory look at the same product/market they gave up on and see multiple start-ups doing well.

I say all this as a former cheerleader for lean that is mostly disappointed with how poorly it is being taught and clarified.

</comment><comment><USER7> ...I think that article about "1 Weird Tip" has perpetually ruined me.

I see the "X (Unusual|Unlikely|Weird|Bizarre) (Tip(s)|Recommendation(s)|Trick(s)) for blah blah blah" format everywhere.

<comment><USER8> And he works for a SEO company! This is a sales pitch to use his tools.

Unfortunately, the above tips will not work if you are bootstrapped too.

<comment><USER9> So if he didn't own an SEO company, would this post have been acceptable? Or would you still have accused him of writing a thinly veiled product pitch?

And yes, this stuff would work for a bootstrapped startup. I have a bootstrapped startup (a competitor to Moz actually) and I can vouch for the points he's making.

<comment><USER5> _So if he didn 't own an SEO company, would this post have been acceptable?_

I think the point is that if he wasn't an SEO maximizer, it would be worded and/or titled differently, perhaps more outwardly usefully. In other words, why does the number of tips or the likelihood that the reader is aware of them matter in a headline? Linkbait, there is no other explanation.

</comment></comment></comment></comment><comment><USER10> Damn, I thought it was a Mozilla article for a second and clicked. I quickly realized my mistake - it's a former SEOmoz tricksters in different clothing :)

</comment><comment><USER11> \- create linkbait articles with arbitrary number of items mentioned in the title

\- throw in alternative version of "1 weird tip" wording for good measure

</comment><comment><USER12> Definitely don't agree on his point about MVPs. I waited too long and built an "EVP" and found out I had no customers.

Beautiful product, no business.

There is a lot of time spent in between "quite small" and "decent" on that graph.

<comment><USER7> Moz have a weird view of how to obtain success, because due to their fame they're guaranteed to succeed every time they put up a post. Take any _practical_ tips they give with a hefty helping of salt.

They are very good at the theory, it's just they don't live on the same planet as everyone else.

</comment></comment><comment><USER13> Can anybody share experience on "Marketing First"?</comment>


Disrupting the $80B SEO Services Industry - <AUTHOR> https://www.deseret.com/utah/2020/2/18/21142627/huckabuy-2-3-million-seed-round-google-search-optimization-utah-tech-startup <comment><AUTHOR> Any other software companies out there doing something similar?</comment>


JHERE - A Simple But Powerful Map API As A jQuery/Zepto.js Plugin - <AUTHOR> http://jhere.net <comment><USER2> Hey, I am the guy that wrote jHERE. You can find out more about the HERE maps API usage terms and limits here: <http://developer.here.net/web/guest/plans>

</comment><comment><USER3> What map does it use ? Won't there be a licensing problem when using these maps ?

<comment><AUTHOR> Apparently uses <http://here.net> maps, you can check out the Terms Of Use here: <http://here.net/help></comment></comment>