The "other" side of file sharing - <AUTHOR> http://www.imdb.com/title/tt1071804/trivia

<comment><USER2> Ink is a really good movie - obviously subjective, but its a must see.

That point aside, there's something I just don't understand about some pirates. Why do they insist on justifying stealing? I understand that, in this case, its the owners of the art saying it worked out for them. Generally though, just steal and shut up. Someone else (possibly an evil conglomerate) owns the work and they have every right to discard your economic theories. Sure, you can stick it to them, but, again, why justify it?

Is it because people don't think art should be owned?

<comment><USER3> Saying piracy is theft is theoretically incorrect. Stealing something means that it you takes something from someone who doesn't have it anymore. Digital copy just doesn't work that way.

As for the question if it is good or bad, it's up to you. I'll just say that to me at least, having thought long about it, intellectual property is a very unnatural concept.

<comment><USER4> Whilst I agree that no intellectual property whatsoever promotes progress, I think that intellectual property protects the interests of people whose main asset is their intellect. Think about someone who have spent years to develop some innovative product: doesn't he/she deserve to make a profit from it? Or is it better for some other people who are just smarter about business to make gobs of money over the effort of somebody else?

<comment><USER3> I think that lots of times, someone who is capable of making something remarkable is someone worth having around. So often, things will work out that way.

Actually, it already does : people invent things at companies, and the companies then own the intellectual property.

</comment></comment></comment></comment><comment><USER5> Stealing is wrong in any form, but I have no sympathy for the losses major studios and record labels have suffered due to online piracy. Illegal downloading hasn't robbed the industry from profit, Avatar/Inception/The Dark Knight box office sales have disproven that. What has ended, is the business model of putting garbage inside a shiny mystery box that people have to pay for the opportunity to peek inside. Gone are the days of cd's that have one good song and fifteen filler tracks, movies that show their only worthwhile parts during the trailer leaving the story begging for a plot. Forget you Hollywood, I hope your industry suffers needlessly for years. The 'mystery box' business model only works when people can't preview the garbage inside

<comment><USER6> _Illegal downloading hasn't robbed the industry from profit, Avatar/Inception/The Dark Knight box office sales have disproven that._

So, you have the box office numbers from the parallel universe in which there was no pirating to prove this claim?

Just because they didn't tank doesn't mean they didn't loose profit.

<comment><USER7> So, you have the box office numbers from the parallel universe in which there was no pirating to prove this claim?

Just because they didn't make more profit doesn't mean they lost profit due to downloading.

<comment><USER8> The fact that there are downloaders proves that there is demand for the items in question. I find it difficult to imagine a price elasticity scenario whereby not a single person among those downloaders would have paid a single cent to the studios in order to fulfill the demand had the option to freely, illegally download not been present.

Do you honestly think that DVD sales are not even _slightly_ affected by pirating?

<comment><USER7> I think DVD sales are affected by the fact that people watch films on computes and not TVs, to attribute that to piracy is just wrong. The fact that people download something proves only that there is a demand at cost 0, how this translates into a demand for a physical item at a cost >0 is hard to tell and sure not linear.

<comment><USER8> I agree that it is not linear. But can you agree that it does translate to _some_ demand at cost > 0?

If so, that demonstrates that piracy represents _some_ loss of potential income for the studios.

</comment></comment></comment></comment></comment></comment><comment><USER9> This is in line with my pet theory on why Disney even bothered with a sequel to the original Tron.

They claim Tron became a 'cult classic' and hence a sequel was a good idea. It's a 1982 movie, how did it suddenly explode into popularity in the later 90s/early 2000s? The widespread file-sharing of the movie, of course.

I don't have a citation to back me up here (hence my 'pet theory'), but here's your data point of one - I downloaded Tron from a 'shady' source a few years back, and became part of the 'cult following' it has.

</comment><comment><USER10> I'm surprised that this site, which is more sophisticated than most out there, still has a relatively high proportion of people who think copyright violation is "stealing".

</comment><comment><USER11> I think "The Man from Earth" was also partially distributed through torrents. At least that's what the wikipedia claims - <http://en.wikipedia.org/wiki/The_Man_from_Earth>

</comment><comment><USER6> Odds that the filmmakers made their production costs back before being ready to claim they are happy it has been pirated...?</comment>


Ask HN: Is there anything interesting about social productivity? - <AUTHOR>

We are working on a simple solution to work-life balance in college. Students sign up with their current schedules.
They are reminded of academic obligations (tests, assignments) via a shared class calendar. Students can also create social plans like ("Coffee with Tim and Sarah") with friends. They can check in for either of these so other students can see them and possibly join.
We've got great feedback. But I'm wondering, what's a good way to make "social productivity" seem more interesting? <comment><USER2> Teamup is an easy shared calendar tool, [http://www.teamup.com](http://www.teamup.com).</comment>


Ask HN: How to stay fit? - <AUTHOR> As software developers we sit many hours at a desk. How do you stay slim/fit? <comment><USER2> For me, it's mainly about eating healthy and lots of bike riding. I had a heart attack last year, so I've been really focused on this stuff for the past year. I've recently decided to adopt a ketogenic diet (although I did break it earlier today). I started back doing a lot of bike riding again earlier this year, mostly mountain biking up until I fell and tore my rotator cuff. After that, I switched to mostly road biking until I have the surgery to get my shoulder fixed.

The big breakthrough for me was when I decided to start biking to work a couple of days a week. It's a 12 mile ride (one way) so the days I ride I get a pretty good workout in. My goal is to eventually reach a point where I'm doing that 3 days a week pretty consistently. That'll put me right around 75 miles a week, plus any other random riding I do.

Next year, after my shoulder is healed, I'll start backing with mountain biking and MTB racing again. I did one 6 hour MTB endurance race this year, but missed the rest of the season due to the shoulder injury.

</comment><comment><USER3> I train Jujitsu and I also sit a a lot. One of the things that can make it a little harder to stay fit is muscle imbalances that can occur from constant sitting.

If your posture is out of balance it might be a little harder to keep an exercise routine if your body doesn't feel right.

[http://breakingmuscle.com/brazilian-jiu-jitsu/it-s-all-in- th...](http://breakingmuscle.com/brazilian-jiu-jitsu/it-s-all-in-the-hips-hip- care-101-for-bjj-practitioners)

[https://www.defrancostraining.com/joe-ds- qlimber-11q-flexibi...](https://www.defrancostraining.com/joe-ds- qlimber-11q-flexibility-routine/)

[https://www.youtube.com/watch?v=3B-3Khbht5s](https://www.youtube.com/watch?v=3B-3Khbht5s)

I'm in really good shape but if I don't stay stretched out and limber all of that goes out the window. I would say a good start to staying fit is minimizing the determent that siting does on the body.

</comment><comment><USER4> Set a performance goal. Don't focus on weight loss, focus on finishing a half marathon, swimming a mile, or something else you might like to do. Then set up a training plan 3-5 days a week and keep a calendar where you get to cross off every day where you follow through (off days are freebies). Don't Break the Chain: [https://www.writersstore.com/dont-break-the-chain-jerry- sein...](https://www.writersstore.com/dont-break-the-chain-jerry-seinfeld/)

<comment><USER5> I agree. Signing up for a race motivated me to train. I hated running. The first part was the hardest, but I learned to love it. My garmin device and online tracking has made it quite a fun and rewarding experience.

</comment></comment><comment><USER6> I've lost 50 pounds in 2 years. The first 30 I did with diet alone in a year. I started by cutting out alcohol, pizza, and fast food. The last 20 I lost with exercise. I hired a personal trainer and trained twice a week and worked out an additional 3 days a week on my own.

</comment><comment><USER7> Eat real food, and exercise.

Not exactly rocket science.

<comment><USER3> How to program: Just pick up a keyboard and start pressing keys? Not exactly rocket science either since, you know everything that isn't rocket science isn't rocket science...I think.

<comment><USER7> Nope, that's not how you program. But what I said _is_ how to stay in shape. Which is the confusing part? What constitutes "real food"? What are appropriate exercises? A half-hour on Google should clear that up real quick for you.

Not a great analogy, really.

</comment></comment></comment><comment><USER8> Nike+ app. Use the built in coach (training programme). Half-marathon training, thoroughly recommended.

Don't eat junk food too.</comment>


Raspberry Pi has PCBs for 100 beta $25 PCs - <AUTHOR> http://www.geek.com/articles/chips/raspberry-pi-has-pcbs-for-100-beta-25-pcs-2011121/ <comment><USER2> Additionally, it looks like they won't sell boards (post-beta) until sometime early next year.

Source: <http://www.raspberrypi.org/archives/389#comment-5402>

"I don't think, sadly, that you're going to be able to give them away as Christmas gifts this year. We will, however, be making as many of these as we can sell (not just 10k) in the new year, so I suggest you get planning for birthdays, anniversaries and wedding presents!"

<comment><USER3> Yes this is indeed very disappointing. I guess I might have misunderstood most of the blog posts when they said they would be releasing by the end of this year, and that the prices were set to $25 and $35. So I guess we all have to wait for next year.

<comment><USER4> A couple month slips is pretty typical, especially for a project that is everyone's 'side-project' and not day job.

I'm happier with their open communication instead of having built it in private and released it suddenly one day.

<comment><USER3> I agree. Still I was hoping to get at least a couple of those by the end year... I have a couple cool ideas I wanted to use it for.

But I do agree. It is understandable. It doesn't make me feel better though.

</comment></comment></comment></comment><comment><USER5> This is a solid step in proving that the project isn't just a dream and isn't vaporware. Although I wonder why a plain board would be ordered, when it looks to be all very small SMT components that a hobbyist would have a difficult time with anyway?

<comment><USER6> They won't be selling unpopulated PCBs, only assembled boards.

<comment><USER5> Right, but on the blog post they say they'll offer a few to the community most likely. 100 seems a little excessive for a board test batch, but maybe it was the smallest order number they could get.

<comment><USER7> 100 seems reasonable for QA when you are planning on making >10K right after.

They are auctioning these 100 boards (populated).

<comment><USER8> Exactly. You might make 10 for your early prototypes but it's not unusual to make 100 or more for the final test run.

</comment></comment></comment></comment></comment><comment><USER9> Unfortunately, my predictions have come true, volume availability of Pi will not happen this year.

At least we can take solace at the fact that the delays are unlikely to be as bad as with Pandora console.

</comment><comment><USER4> Exciting!

I guess the proceeds of the auction will help them scale?

Even with support from Broadcom I'm sure at $25/piece there's not a lot of room for paying off their fixed costs.

<comment><USER7> It's also helpful that one of the guys involved owns a PCB manufacturer!</comment></comment>


Hidden is a lie - <AUTHOR> http://hidden.is.a.lie.fyi <comment><USER2> "Because this attribute is typically implemented using CSS, it's also possible to override it using CSS. For instance, a rule that applies 'display: block' to all elements will cancel the effects of the hidden attribute. Authors therefore have to take care when writing their style sheets to make sure that the attribute is still styled as expected."

\-- HTML 5.1 - W3C Recommendation, 1 November 2016

So, as you can see, this is by design.

If this attribute behaved only in the manner the author assumes it would be essentially useless.

Instead, we have an option to have it act as "display:none", "visibility:hidden", etc.

Also, it has accessibility benefits beyond "aria-hidden":

[https://www.paciellogroup.com/blog/2012/05/html5-accessibili...](https://www.paciellogroup.com/blog/2012/05/html5-accessibility- chops-hidden-and-aria-hidden/)</comment>


Ukraine to block Russian social networks - <AUTHOR> http://www.bbc.co.uk/news/world-europe-39934666 <comment><USER2> >The companies' offices in Ukraine will also face asset freezes and other restrictions

It's probably a cash grab by the corrupt government.

</comment><comment><USER3> Hardly surprising, as Ukraine has historical reasons to distrust Russia: [https://en.wikipedia.org/wiki/Holodomor](https://en.wikipedia.org/wiki/Holodomor)</comment>


Ask HN: How did you build your first real side project? - <AUTHOR>

I'm looking for success stories on how you went from 0 to implemented, maintainable project to serve as fodder for my own project building.
In the past, I've read books on development (in C++, PHP, etc), but it doesn't seem to help all that much. I've started this time by using a book as a guide but diverging quickly to implement my own features.  I'm a bit upset with my pace of development, as it has taken me about a week (with school) to roll my own auth/login/registration system in rails.
I feel scared to dive in as if I'll be in over my head, end up in dependency hell, or not be able to solve my own problems. <comment><USER2> Start with a really good spec. I started ProjectPulse.io by clearly defining the problem, and what the solution would look like. Then I dove into defining the needs of all the MVP features. From there, it wasn't hard for me to make wireframes and get awesome designs from a designer. Then, I also made a list of features I'm going to want to add, but not for the MVP, so they felt like they were on paper, but not the same as MVP features.

Once you have a list down of things that need to be built because you know the sum of those things is an MVP, put your head down and work until it's done. Don't question anything until you have an MVP. Stop second guessing the product or the market and just build it.

I'm leaving out the whole "research and learn from potential users" \- that comes first, but that's not what we're talking about here.

TL;DR: Write a detailed spec for an MVP, then put your head down in code until you have an MVP.

</comment><comment><USER3> I am currently building my first side project a android app which send users location based tweets alerts ( if user has subscribe for a particular location) and also let user location based tweets searching and following is mine schedule of day

8:00 AM - Get up from Bed and get ready for office 9:00 AM - 6:00 PM office timings 6:00 PM - 9:00 PM come back from office after dinner take rest a while 9:00 PM - 12:00 AM Side project work

Out of my hectic routine i only manage 3 hours + full Saturday & Sunday.

For you my suggestion would be to move to Ruby on Rails framework because it will save your time spent on auth/login/registration (donkey work) it only take take 5 minute on rails to configure Devise gem if you cannot move to Ruby on Rails move to Laravel ( php framework similar to rails) + you really need to stay motivated during 0 implementation till you get your production DONE Best of luck

</comment><comment><USER4> Just find a problem you'd like to solve and start working on it. My problem is that I keep thinking of new features I want to add along the way. Right when I'm ready to release something I always feel like I really need to add just this one more feature for it to be good enough. The project I'm on now was supposed to take a month, I'm in my 6th month now. But I think I'm almost done haha.....

For my next projects I'm going to try to work on some smaller things I can hopefully finish in a weekend. I feel better about myself when I complete things, which motivates me to keep working/learning new things.

Good luck!

</comment><comment><USER5> Avoid analysis paralysis by just making the thing you want to make using the methods you already know.

</comment><comment><USER6> If you're using rails, explore its libraries. Devise is an excellent gem for user auth/login/registration. On Rails, you should move fast to build MVP, and test the audience.

</comment><comment><USER7> I was in Costa Rica, and conflicted between building the SaaS and...well, surfing, mostly.

I built the app. Took most of my spare time for about a month.

I have fond memories of Costa Rica, that month included.

</comment><comment><USER8> You just build it.

</comment><comment><USER9> Just start building. "The journey of a thousand miles begins with a single step" and all that. It sounds cliched, and maybe it is, but there's real truth there. Just start... write a line of code _right now_ , even it is nothing more than

      public static void main( String[] args )
      {

        // TODO: implement the rest here...

        System.out.println( "done" );
      }

and just start adding to it. If you get to a point where you don't know how to solve a particular problem, stop, google, read, experiment, fail, learn, retry, until you figure it out. Move on to the next step.

Yes, progress will be slow at the beginning. As you alluded to, doing things like auth/login quickly get complicated, especially if you are dealing with things like OAuth, OpenID, etc, and you have to learn one 3rd party library after another... which probably won't be well documented, and which will require you to read source code, use StackOverflow, use trial-and-error, etc. That's OK, that's just the way this stuff goes sometimes.

Over time, it does get easier in a sense, like most things. You gain intuition for solving certain problems, rooted in your experience. And the more you understand about how things work "in the large" the better you get at solving certain kinds of problems. Unfortunately, you usually also wind up taking on progressively more challenging problems, so you always feel like you're struggling just the same, even if you are actually moving much faster.

When I first started mountain biking, an experienced rider told me "it never gets any easier, you just go faster". In many ways, programming is the same way. But, like mountain biking, it has the potential to be a total blast. And unlike MTB (for the most part) you can actually make money doing this.</comment>


FreeBSD coming to DigitalOcean - <AUTHOR> http://digitalocean.uservoice.com/forums/136585-digitalocean/suggestions/3232571-support-bsd-os

<comment><USER2> Until this actually happens for DigitalOcean, if you want to mess around with FreeBSD right away, you should just check out the Atlantic.net $.99 a month Go Plan.

</comment><comment><USER3> The key part is the last sentence:

 _" In regards to FreeBSD, we've begun the work necessary to get it supported in DO. We've already begun testing it internally and hope to launch within the next 2 months."_

Finally!

<comment><AUTHOR> Yeah at first its a lot to read but at least it gets to it at the end :)

</comment></comment><comment><USER4> I would definitely sign up for a FreeBSD droplet, I haven't found a *BSD VPS anywhere near what I'm paying comparable to the specs of a couple OpenVZ Debian GNU/Linux nodes (512MB Ram/50Gb Disk/2TB net) $15/yr. I would hope OpenBSD adoption would soon follow to host many of my services in a more default hardened OS.

<comment><USER5> Er, seems odd to be using OpenVZ if security/hardening is what you're after.

The shared kernel is a larger attack surface compared to KVM or Xen, and the OpenVZ host admin can easily see/manipulate your running processes.

No hate for OpenVZ though, I've used it constantly for about 4 years, but it makes me nervous when its discussed in a multi-tenant context.

<comment><USER6> Why do you think a shared kernel is somehow more secure than a hypervisor?

<comment><USER5> Me? My point was that HV/PV virtualization is likely to be more secure than OpenVZ, sorry if it was unclear.

</comment></comment></comment></comment><comment><USER7> I used to have a Linux VM on DigitalOcean. At times it became unreachable, there were some downtimes here and there. I decided to go back to FreeBSD (I used to have a FreeBSD VM on John Companies), and did some research. Vultr.com came up at the top, so I moved to them. Two months in, so far so good.

</comment><comment><USER8> Well this is great news! I can finally stop trying to use Depenguinator [http://www.daemonology.net/depenguinator/](http://www.daemonology.net/depenguinator/) ;-)

</comment><comment><USER9> It's good to see FreeBSD moving up. Maybe it's time to give ArchBSD a try?</comment>


Firefox 7 Live: Download Here - <AUTHOR> http://www.mozilla.org/firefox/new/

<comment><USER2> Desktop highlights:

* Drastically improved memory handling for certain use cases

* Added a new rendering backend to speed up Canvas operations on Windows systems

* Bookmark and password changes now sync almost instantly when using Firefox Sync

* The '<http://> URL prefix is now hidden by default

* Added support for text-overflow: ellipsis

* Added support for the Web Timing specification

* Enhanced support for MathML

* The WebSocket protocol has been updated from version 7 to version 8

* Added an opt-in system for users to send performance data back to Mozilla to improve future versions of Firefox

* Fixed several stability issues

* Fixed several security issues

[http://blog.mozilla.com/blog/2011/09/27/mozilla-firefox- sign...](http://blog.mozilla.com/blog/2011/09/27/mozilla-firefox- significantly-reduces-memory-use-to-make-web-browsing-faster/)

\--

Android highlights:

* Android-style Copy & Paste

* Ability to quit

* Use Firefox in your language

* WebSocket API

[http://blog.mozilla.com/blog/2011/09/27/firefox-for- android-...](http://blog.mozilla.com/blog/2011/09/27/firefox-for-android- empowers-developers-to-build-seamless-web-experiences/)

[Edit] Updated the list of highlights

<comment><USER3> >* The '<http://> URL prefix is now hidden by default

I hate that:( I hate that they removed the rss button too:(

<comment><USER4> RSS urlbar icon <https://addons.mozilla.org/en-US/firefox/addon/rss-icon/>

<comment><USER5> That's weird -- the icon is still there, but not default, and it just takes about two clicks to restore it.

So what's the purpose of the addon?

<comment><USER4> You mean the icon in customize? You cannot put that one inside the urlbar.

<comment><USER5> Aha, all is now clear. (I really liked the idea of the RSS button when they added it, but never actually ended up using it...)

</comment></comment></comment></comment></comment></comment><comment><USER6> IMHO quite importantly, this version also includes a list of Microsoft fonts that don't render well with DirectWrite, and will switch back to GDI font rendering for those.

On my machine, this fixes the "fuzzy fonts" issue that existed since Firefox 4 if you enabled hardware acceleration.

<comment><USER7> Thanks for the information! I first noticed the improvement in Aurora and Nightly builds, and was wondering what they did to fix the problem.

Here is some more information I just found for anyone interested:

Main bug report:

<https://bugzilla.mozilla.org/show_bug.cgi?id=661471>

The two new preferences:

gfx.font_rendering.cleartype_params.force_gdi_classic_for_families

gfx.font_rendering.cleartype_params.force_gdi_classic_max_size

And a post talking in detail about the issue:

[http://blog.mozilla.com/nattokirai/2011/08/11/directwrite- te...](http://blog.mozilla.com/nattokirai/2011/08/11/directwrite-text- rendering-in-firefox-6/)

</comment></comment><comment><USER8> Why would I go there to download a new version of Firefox? I went to 'About Firefox', it downloaded a 10 MB update, restarted, and here's Firefox 7.

<comment><USER9> Consider the case of not having Firefox already installed.

<comment><USER10> As a user of Firefox since 0.x versions, I am happy FF still keeps up with nice updates in 2011 and onwards.

</comment></comment></comment><comment><USER11> * Drastically improved memory handling for certain use cases

^^ apparently not the use cases I use. FF7's been running for about 12 hours on my win7 box and is using over a gig of ram just like normal...

It started off good but then just kept growing over the hours. Nothing really improved here. :(

<comment><USER12> > FF7's been running for about 12 hours on my win7 box and is using over a gig > of ram just like normal...

Are you looking at resident set size (aka real memory), versus virtual set size (aka virtual memory)?

The memory VMs in both Windows and Linux kernels will happily let an app malloc all they want until they hit the userspace address limit, with no affect on performance. It's only when those apps use the memory that there's a perf hit.

</comment></comment><comment><USER13> I thought the point of Mozilla's new release scheme was that we don't have to download anything anymore. The updates just come to us, as if by magic. <https://support.mozilla.com/en-US/kb/Updating%20Firefox>

<comment><USER14> But extensions are still version dependent.

I was just about to update my installation, but it told me that my Roboform extension isn't compatible with v7.

If they allow the application to update when it wants, they're going to quickly render me unable to use Firefox, since I won't be able to log into secure web sites.

<comment><USER15> _I was just about to update my installation, but it told me that my Roboform extension isn't compatible with v7._

How do you get to that information prior to the upgrade?

I've only realized extensions were incompatible _after_ updating, because Firefox disables them.

<comment><USER16> Did you receive the update automatically, or did you download and install it manually? If you are using automatic updates, Firefox should ask before updating if any of your add-ons will be disabled.

<comment><USER15> My experience is that if I click "Check for updates" and an update happens to be available, then there's no way to prevent that update from being installed, even if it causes add-ons to be disabled.

</comment></comment></comment></comment></comment><comment><USER17> Great. So now I have to be _two_ versions behind if I need to use GWT hosted mode.

(Grrr... yet more evidence of G's gradual sunsetting of GWT.)

<comment><USER18> I came here to see if anyone had anything to say about this. Hadn't heard rumblings about sunsetting GWT, but the conspiracy portion of my brain wondered if Google not trying too hard to keep the plugin up to date was a subtle push for GWT dev's to move to Chrome. :)

Last I checked the plugin for FF6 can be found here: [http://www.google.com/url?sa=D&q=https://dl.google.com/d...](http://www.google.com/url?sa=D&q=https://dl.google.com/dl/gwt/plugins/firefox/1.0.10582/gwt- dev-plugin.xpi&usg=AFQjCNE1fEGhqK6BxLJNcYAlYMlPYN6Jhg)

More discussion here: [http://groups.google.com/group/google-web- toolkit/browse_thr...](http://groups.google.com/group/google-web- toolkit/browse_thread/thread/48d34a9fb54af7e6/bfc299c964a61172)

<comment><USER17> Well, the main evidence for me can be found in the leaked "Dart/Dash" memo, where GWT is referenced a few times:

"The JSPrime effort was begun to unify and be a (single!) successor to GWT and Closure/JSCompiler"

"What is the future of the JSCompiler and GWT? JSCompiler and GWT were already on a merger path. This effort gives us a direction for that unification around the Dash language. _We will actively support teams for a long time on the current generation of JSCompiler and GWT_ and provide fantastic co-existence and migration tools to Dash."

See: <http://markmail.org/message/uro3jtoitlmq6x7t>

(My emphasis added. I read that as "maintenance mode".)

(Edit: thanks for the heads-up on the FF6 version of the plugin - but I guess I have now missed the two-week window where both FF6 and the compatible version of the plugin where available to download!)

<comment><USER19> Whoa! I had no idea, thanks for sharing. This needs its own submission, so that more people can see it.

</comment></comment></comment></comment><comment><USER20> >The '<http://> URL prefix is now hidden by default

This can be changed back with browser.urlbar.trimURLs in about:config. They should've provided an option for it.

<comment><USER21> No, they really shouldn't. If you care, you already know about about:prefs.

<comment><USER22> This is one example of a devastatingly common category of assumptions. Never assume that the set of people who care about something is the same as the set of people who know how to fix it. Similarly, distrust statements of the form, "Anyone who is/does/has X already knows about Y."

I myself have been bitten by this assumption when I discovered a new subject for study (e.g. math, entity formation, physics, a new programming language, etc.), but found most of the web pages related to the subject assumed that all those interested in the subject were already fully knowledgeable about it.

</comment></comment></comment><comment><USER23> The designer sitting next to me is most excited about this: >* Added support for text-overflow: ellipsis

<comment><USER17> This one drove me nuts. Many developers were achieving the same result in firefox 3.6 and earlier using an XUL hack - but in FF4, the ability to do that XUL hack was removed for (valid) security reasons - but without addressing the text-overflow: ellipsis issue for which they'd had an open bug tracker entry for about 5 years. There were many complaints about this months before FF4 was released but they went ahead anyway.

</comment></comment><comment><USER24> After Firefox 4 came out I had to install so many extensions to make it feel like 3.6 that it became unstable and incredibly slow. Because Firefox apparently tries to be more like Chrome I decided to switch to the original and I haven't looked back yet. I only fire up Firefox when Chromes built-in developer tools lack functionality compared to Firebug, which is rarely the case. The way Firefox decided to take makes me really sad, as I was a big Firefox supporter, until they screwed me over with the new UI. I hope this is not too off topic, but I never got the chance to comment on the changes.

<comment><USER25> I actually still run 3.6 since I like the UI on it better. The speed of the browser means very little to me, I'd rather have the familiar UI. If you liked FF 3.6, why not stick with it?

<comment><USER26> And FF 7 (which I've been using for about 5 months now) is not even _noticeably_ faster than 3.6 on my usage pattern. In fact it seems to spend more time with an unresponsive UI than 3.6.

</comment></comment></comment><comment><USER27> Great! Love the new canvas renderer. Anyone know when they're planning to add generational GC or other improvements to the GC? It's making some HTML5 games choppy as far as I can tell.

<comment><USER6> Smooth animation would require shorter GC pauses, i.e. incremental GC.

<https://wiki.mozilla.org/Platform/Features/Incremental_GC>

The implementation seems to be in active progress, which means it's going to take at least a few more versions to make it to stable.

</comment></comment><comment><USER28> If you're looking for an updated version of Firequery (<http://firequery.binaryage.com/>) I patched and submitted a pull request: <https://github.com/davemo/firequery/tree/firefox7>

Until it's officially accepted you can fork, build it with rake and have yourself a working copy for Firefox 7 :)

</comment><comment><USER29> Still no 64-bit version? I can't find a clear page on the status of Mozilla's x64 stuff.

<comment><USER30> Firefox reflects the general state of x64 adoption: <http://en.wikipedia.org/wiki/Firefox#64-bit_builds>

</comment></comment><comment><USER31> why is the channels[1] page never up-to-date? the 'download beta' link still sends 7.0 - if they don't want to confuse people, they should try to be more consisten across their site (which is in general not very well thought-out in my opinion)

[1]: <http://www.mozilla.org/en-US/firefox/channel/>

<comment><USER16> The Aurora and Beta channel updates are released a few days after the stable channel update. See the text on <https://wiki.mozilla.org/RapidRelease/Calendar> \- or for even more details see [http://blog.mozilla.com/channels/2011/05/11/merge-dates- vs-r...](http://blog.mozilla.com/channels/2011/05/11/merge-dates-vs-release- dates/)

<comment><USER31> "Code is not always released to users on the same day as the branch migration. The release to users may be a few days later, to allow for manual testing and sign-off."

I think this is confusing. Either you synch the switch (i.e. when you release the "release" version to users you release the "beta" too), or it doesn't make a whole lot of sense.

</comment></comment></comment><comment><USER32> I upgraded, but Fast Dial is broken on 7.0, so I downgraded to 6.0.2. Hopefully it'll get fixed soon.

</comment><comment><USER33> I like this BUT addons need to catch up and for many it's impossible due to such frequent changes.

<comment><USER34> 99% of the add-ons that are hosted on <http://addons.mozilla.org> are compatible and had been automatically updated to be compatible. Can you list which ones you use that are not?

<comment><USER33> My most important one, roboform is coming as 'will be disabled.'

<comment><USER35> This may be because roboform proper isn't hosted on addons.mozilla.org, so they can't vouch for it or bump the version for you. The Roboform Lite that is on addons.mozilla.org is properly marked.

[https://addons.mozilla.org/en-US/firefox/addon/roboform- onli...](https://addons.mozilla.org/en-US/firefox/addon/roboform-online- password-manag/)

</comment></comment></comment></comment><comment><USER36> I have been having terrible freeze issues with 6.x so hopefully this update fixes it.

<comment><USER37> what OS? what extensions do you have installed? I'm very interested in your freezes. can you say more?

<comment><USER38> I've had these as well. Firefox 6 on win7-32, with latest Adblock-Plus, Firebug(usually disabled), Flashblock, Greasemonkey, Noscript(in allow- everything mode), Foxit plugin, latest Flash, no antivirus, no other media plugins.

<comment><USER5> Just read this and thought of your comment...

[http://blog.bonardo.net/2011/09/30/is-your-firefor- freezing-...](http://blog.bonardo.net/2011/09/30/is-your-firefor-freezing-at- regular-intervals)

<comment><USER36> That sounds like my bug. Hopefully this fixes it! Thanks!

</comment></comment></comment></comment></comment><comment><USER39> Nice to see Web Timing support make it into this catching up with Chrome and IE.

</comment><comment><USER40> Anyone know a reason the auto updater goes from 5.0 -> 6.0.2 -> 7.0?

<comment><USER16> It looks like some of the old configurations on the update server have not been updated to reflect the latest release; some details at <http://bugzil.la/689004>

</comment></comment><comment><USER41> Looking at the features, it looks like they're fashioning the UI after Chrome's. The reload/stop button and tabs on top are new, and what is an "Awesome Bar" but an omnibar?

<comment><USER42> An omnibar that predates the omnibar.</comment></comment>


Trolling To Win: Can trolling work better than asking for help? - <AUTHOR> http://bash.org/?152037

<comment><USER2> The egotistical urge to correct misinformation appears to commonly be stronger than the philanthropic urge to help.

<comment><USER3> This seems to be changing on sites like HN and Stack Overflow. The only difference I can see is that the moderators intentionally guide the discussion away from trolling. Are there other factors here that I'm missing?

<comment><USER2> I think the points systems on such sites give a different incentive. Many people help just to help, but others take part primarily for the point gaining (which rapidly becomes addictive) or to gain some sense of achieving more than others. Despite these motivations, if the ultimate result is a good one, I see no harm.

</comment></comment></comment><comment><USER4> "Frequent Troll Statements" might work better than FAQs for some projects.

 _jQuery is hard to use for remote AJAX requests_

 _django doesn't even support memcached_

 _PERL has the worst support for SOAP of any language out there_

<comment><USER5> FTS "Frequently Trolled Statements" ?

</comment></comment><comment><AUTHOR> I have to admit that I reliably fall for this one, particularly in one-on-one exchanges with friends or acquaintances. Perhaps the best reply would actually be, "yep, you're right, Linux/Lisp/Emacs does suck," but even just typing that now rubbed strongly against my natural evangelism.

<comment><USER6> Sometimes all I can do is say "Excuse me," and walk away.

Then I call my therapist/support vendor for the next three hours, sobbing about deep emotional scarring I had from DOS when I was a small child.

</comment></comment><comment><USER7> A slightly less trollish alternative, which I attribute to Penny Arcade but can't easily source, is to post the wrong answer to a question. This prompts people to prove themselves smarter than you by providing the correct answer.

In the example I remember, it was related to finding quest details in World of Warcraft. If you ask in General chat "where is the foo?" you will be met with flames and rtfm-style responses, but if you say "the foo is in [wrong location]" out of the blue, you'll receive a cacophony of corrections.

</comment><comment><USER8> When I first moved to the Bay Area, my roommate told me that the best way to find good places to eat and drink was to go onto a foodie forum like Chowhound and say something along the lines of "At [X], I had the best [Y] I've ever had!" because before you know it, you would have dozens of responses saying how wrong you were and among those responses, you'd find the best places to get [Y].

Is this trolling? Probably. But now I have an extensive list of great Bay Area eateries.

</comment><comment><USER9> The RTFMan responses are one of the worst things in Linux culture. Man pages are an exhaustive reference about what you can do with commands, that's true. But they are not written in a helpful way: you pretty much have to read it all every time in order to see what you need. If Google had the same attitude with their search, they would be satisfied with a query for "george bush" that returns the page of some random George Bush out there, you would have to add "US president" to get what you need.

</comment><comment><USER10> This is really unfortunate, on several levels.

It's probably also self-reinforcing once it starts, because once a mailing list, IRC channel, etc. has a reputation of being populated by abrasive know- it-alls, new members have less of an incentive to bother being civil. Also, people mock-trolling to get useful answers is incredibly irritating to everyone else, which probably makes the overall attitude even less patient with newbie questions.

I don't know of a better way around this, either, but it reminds me of an offhand comment somebody made recently about how once cultural forces take a certain amount of bribery and corruption for granted, doing things honestly at all becomes much more difficult.

</comment><comment><USER11> It doesn't always work. Watch:

news.ycombinator doesn't even let you downvote warmed-over reddit stories.

<comment><USER12> Oh, yeah? I just saw one of those with 0 points! (How did that happen???).

</comment></comment><comment><USER13> It's a technique very used by some bosses (that dont know shxt). It's specially effective with young/big-ego !! developers. The modus operandi would be saying thay some work you did is crap. After that you provide a detailed report on the advantages of your work. And after that, he can tell his own boss what are the wonders he is acomplishing, all without reading a single line of the related documentation.

!! replace young/big-ego with any of these: ninja, guru, hacker, elvis, etc. :D

</comment><comment><USER14> In my IRC days saying word "linux" aloud on #unix will get you kicked instantly no matter what you say about the OS. And yes, asking for obvious will get you kicked as well ;-)

</comment><comment><USER15> That's not trolling. It's abrasive as hell, but the ultimate purpose of that behavior is to improve discussion.</comment>


Ask HN: Good tools for text extraction from PDF - <AUTHOR>

Hi guys,
I'm needing a tool that allows me to convert PDF to html files. Since I work with public documents, sometimes the layout from the pdf can be pretty nasty (i've attached some links at the end of this post).
We have a in house soluction forked several years ago from Apache pdfBox. After a while we realized that forking a open source solution isnt the best answer, but kept on going because it worked.
Does anyone have sugestions? We are willing to contribute to the open source project we choose :)
Many thanks!
https://www.evernote.com/shard/s226/sh/17b87c1f-8f18-4b23-96ac-a9fbc2ac8502/ea5618043f3a9c818071bd93df9f74c3
https://www.evernote.com/shard/s226/sh/17b87c1f-8f18-4b23-96ac-a9fbc2ac8502/ea5618043f3a9c818071bd93df9f74c3 <comment><USER2> I've had good luck with the tools that come with xpdf:

[http://www.foolabs.com/xpdf/about.html](http://www.foolabs.com/xpdf/about.html)

But some of that is because the source I was pulling text from didn't change the document format much from month to month.

I guess it is the library underneath jeffmould's link.

</comment><comment><USER3> I have used the following with some success:

[http://pdftohtml.sourceforge.net/](http://pdftohtml.sourceforge.net/)

Not sure how well maintained it is still, but it did a good job of converting basic PDF files to HTML.

There is also a Google Code product for going from HTML to PDF which works pretty well.</comment>


Leaked NSA Malware Threatens Windows Users Around the World - <AUTHOR> https://theintercept.com/2017/04/14/leaked-nsa-malware-threatens-windows-users-around-the-world/ <comment><USER2> I think jlgaddis' link[1] is more informative than the theintercept.com article : [https://www.bleepingcomputer.com/news/security/shadow- broker...](https://www.bleepingcomputer.com/news/security/shadow-brokers- release-new-files-revealing-windows-exploits-swift-attacks/)

I feel the HN submission should point to that instead.

The Outlook Exchange, RDP, Kerberos, ... exploits are scary, even though some only seem to affect older Windows versions.

[1] [https://news.ycombinator.com/item?id=14117336](https://news.ycombinator.com/item?id=14117336)

</comment><comment><USER3> I find it very irresponsible that NSA did not report these vulnerabilities to Microsoft after they had fallen into hands of shadow broker (no longer zeroday). Shadowbroker announced possession of these zerodays around 3 months ago. NSA had good 3 months to work with Microsoft to patch these. They chose not to.

<comment><USER4> It's possible the NSA isn't sure what the Shadow Brokers have.

<comment><USER5> ...which doesn't make it any less irresponsible.

However, judging by [https://technet.microsoft.com/en- us/library/security/ms17-01...](https://technet.microsoft.com/en- us/library/security/ms17-010.aspx) it's likely somebody had some advance knowledge, somehow.

Oh, and hey: [https://blogs.technet.microsoft.com/msrc/2017/04/14/protecti...](https://blogs.technet.microsoft.com/msrc/2017/04/14/protecting- customers-and-evaluating-risk/)

</comment></comment></comment><comment><USER6> What I find sort of (a little) comforting is that the NSA seems to be relying on zero days. All these leaks have not really revealed any structural backdoor in any of the major operating systems.

<comment><USER7> 1\. I imagine they'd be more or less the same thing. Any mandated/deliberate backdoor is probably going to look very similar to an accidental bug - it lets you deny it exists, gives a valid explanation for if/when it is found, and potentially lets an NSA/software company "double-employee" add it without the company knowing.

2\. It'd probably be a method of last resort, so the NSA et al. would gather and use zero days anyway. Any use of the backdoor risks it being noticed, so using other entry points make sense if possible.

A less comforting interpretation would be that relying on zero days suggests they are confident in their ongoing ability to find them and/or have a sizeable cache of unknown exploits already, so adding a deliberate backdoor wouldn't provide any additional access.

<comment><USER8> > lets an NSA/software company "double-employee" add it without the company > knowing.

I always wondered how that works. I am a full time employee at software company. Cannot imagine having extra time to report to another employer (NSA) and deal with their red tape and crap as well.

Or does NSA show up at their doorstep with a bag full of cash - "Here you go, have this, and install a backdoor in your company's software. And we never met <wink>, <wink>"

That sounds good on paper so to speak, I just have a hard time imagining a realistic scenario.

Now finding 0-days and hoarding them, I can see that.

<comment><USER9> You assume the mole is an MS employee first and an NSA op second. Traditionally, the opposite is true: if you want to infiltrate a somewhat friendly entity, you do it by engineering the hire of trusted individuals. This is more secure, since there is no risk that one of the guys will get cold feet and blow the whistle.

So you monitor universities and you make contact with some of the brightest sparks. You promise them a good job in exchange for the possibility that, one day, they might have to act For The Good of The Country; and in the meantime they'll even be In The Know, which will place them above their peers - excitement! Ambition! Then you lobby a few higher-ups you're friend with, to hire these guys in this or that group. They are top-notch talent, immaculate credentials, so the hire is a slam dunk. They go about their business, being good kernel devs or whatnot, and every few months you give them a quick call to catch up - there is no need for extensive briefing, nobody really cares about the going-ons of Team Kernel A356. When "the favour" is required, the guy is comfortable in his position and doesn't want to leave it, so there is no chance he'll say no.

</comment></comment></comment></comment><comment><USER10> I've been following this closely over the last couple of hours on Twitter as the news broke. What does it mean in practice?

From what I have read one of the vulnerabilities seems to be a 0day targeting SMB on Windows. One commentator suggested it's enabled by default on the majority of Windows machines (of that I am sceptical). Presumably most people are behind a router which would stop this in its tracks?

A lot of people (who I would probably take seriously) suggest disconnecting Windows machines from the internet for the time-being. Is it really this bad? Are there millions of Windows (home-)users who are vulnerable (by default) today?

<comment><USER11> > Presumably most people are behind a router which would stop this in its > tracks?

Trouble is there are millions of IoT devices with terrible security some of which are alway owned and inside the network. They could be used as a delivery tool to attack multiple machines inside of a network.

I'm not sure how many folks connect directly to the internet anymore. Hopefully not many.

<comment><USER12> "Connect directly". Could you please elaborate on that?

<comment><USER11> Connecting a computer directly to a modem, not a router.

<comment><USER12> Thanks.

</comment></comment></comment></comment></comment><comment><USER13> Relevant tweets from/retweeted_by @snowden

\- [https://twitter.com/Snowden/status/852950725881712640](https://twitter.com/Snowden/status/852950725881712640) \- [https://twitter.com/campuscodi/status/852885596221689856](https://twitter.com/campuscodi/status/852885596221689856) \- [https://twitter.com/Snowden/status/852989758364147712](https://twitter.com/Snowden/status/852989758364147712) \- [https://twitter.com/josephfcox/status/852983848862461953](https://twitter.com/josephfcox/status/852983848862461953) \- [https://twitter.com/Snowden/status/852987207170371587](https://twitter.com/Snowden/status/852987207170371587) \- [https://twitter.com/alexstamos/status/852984589463175169](https://twitter.com/alexstamos/status/852984589463175169) \- [https://twitter.com/Snowden/status/852974864461963265](https://twitter.com/Snowden/status/852974864461963265) \- [https://twitter.com/TalBeerySec/status/852869388067844096](https://twitter.com/TalBeerySec/status/852869388067844096) \- [https://twitter.com/Snowden/status/852967606088806401](https://twitter.com/Snowden/status/852967606088806401) \- [https://twitter.com/Snowden/status/852966739084275712](https://twitter.com/Snowden/status/852966739084275712) \- [https://twitter.com/josephfcox/status/852908421703753728](https://twitter.com/josephfcox/status/852908421703753728)

<comment><USER14> I really regret reading some of the replies to those tweets. There's something I need to know: the people going on about Snowden being a traitor, helping 'the Russians' etc... On the 'average American' to 'village idiot' scale, which end are these people closer to?

This is not a rhetorical question btw. I just want to get some insight into what the 'average American' thinks about Snowden.

<comment><USER15> Average American.

[http://www.newsmax.com/Newsfront/edward-snowden-rasmussen- po...](http://www.newsmax.com/Newsfront/edward-snowden-rasmussen-poll-hero- russia/2016/09/23/id/749866/)

<comment><USER14> Thanks.

And now I feel ill.

</comment></comment></comment></comment><comment><USER16> Is there a list of exact attack vectors for the lazy?

Both tools in the demo video are SMB-based. I wonder how exploitable is a machine if it has SMB properly disabled and blocked.

<comment><USER17> There's an incomplete "summary of leaked data" at [https://www.bleepingcomputer.com/news/security/shadow- broker...](https://www.bleepingcomputer.com/news/security/shadow-brokers- release-new-files-revealing-windows-exploits-swift-attacks/)

<comment><USER6> Looking at this list it seems to affect mostly older versions of windows servers and servers with SMB running. I'd say it would mostly be a problem on intranets than windows based web servers.

<comment><USER18> > and servers with SMB running.

Which is going to be Domain Controllers, the most highly privileged servers on most corporate networks. And accessible to the "entire" network too. Group Policy is distributed through SMB shares.

</comment></comment></comment></comment><comment><USER19> Wouldn't it be nice if the NSA turned over all of its now compromised zero days to Microsoft so that Microsoft could patch them all?

</comment><comment><USER20> So MSFT to take a pasting when the exchange reopens?

</comment><comment><USER21> Direct link to the leak: [https://steemit.com/shadowbrokers/@theshadowbrokers/lost- in-...](https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in- translation)

RIP Windows users.

</comment><comment><USER22> Using Windows threatens Windows Users Around the World.

</comment><comment><USER23> This entire article is a gross mischaracterisation of the facts and risks.

The only major zero days released for Windows in this bundle targeted SMB (SMBv1, SMBv2, & SMBv3). By default Windows firewalls SMB and has since Windows XP SP2. Many home and business users then typically have a NAT between the Windows Firewall and the internet, offering a second layer of protection.

Few companies intentionally expose SMB to the internet. Generally users are required to VPN in before then being able to contact an SMB endpoint.

The type of language in this article is designed to mislead non-technical readers into believing they're at risk e.g.:

> The software could give nearly anyone with sufficient technical knowledge > the ability to wreak havoc on millions of Microsoft users.

So either the article author lacks the technical literacy to understand why this is untrue, or they know it to be untrue and are trying to implant fear into their readership. In either case, not a good look for The Intercept.

<comment><USER24> > Few companies intentionally expose SMB to the internet.

True, but in your average coffee shop setup if a user has SMB running you could reach them via a local IP if it isn't firewalled off on the machine itself.

<comment><USER16> And why would it not be firewalled off on the machine itself?

<comment><USER25> why would it be ?

<comment><USER16> Because it's a standard Windows policy for public, non-trusted networks?</comment></comment></comment></comment></comment>


Ask HN: "If that was not open source, I would be screwed" - <AUTHOR> I recently had a moment where I really appreciated running most of our stack on open source system. Needless to say it was a weird interaction with the way flask handles files, boto/s3, flask admin, and a core mimetype util in python. A name was being set on a file stream as an integer which triggered a mime type check in boto, which caused the mimetype check to error because it expected a string. (I still have not figure why that name is being set on the stream of mostly excel file uploads.)
Needless to say, if I needed to go through some recent support hire from some enterprise service, it could have taken a long time to figure it all out. Reading the source made actually solving this much easier.
This is obviously not unique, as it is a core part of why open source is successful.
It would be great to hear of any other stories. <comment><USER2> A future-tense corollary: "What if it turns out not to be open source?"

As someone who works in crypto-currency, the enduring mystery over who invented bitcoin bothers me a lot.

The going belief is in a still-anonymous fairy godfather, Satoshi Nakamoto, who gave unto the world his/her/their foundational idea, or intellectual property, and said go forth and multiply.

Just one problem: What if Nakamoto invented his/her/their technology at a company or academic institution? That institution c/would claw back the intellectual property. Where there is intellectual property, there are patent lawyers; and where there are patent lawyers, there are licensing fees! See Oracle v. Google over Sun Microsystems' Java.

What if the reason he/she/it maintains anonymity is because to reveal himself is to reveal where he worked when he invented bitcoin? That employer would be the true owner of the IP, and open-source bitcoin would go private. The foundational idea that's launched a thousand startups, supposedly open-source, turns out to be anything but open-source. That would suck.

I wager that, at some point in the future, bitcoin will be private property owned by a corporation or academic institution.

<comment><USER3> You can't retroactively patent something after its design has already been released to the general public, can you? Imagine trying to patent a car engine today, if it were a similar situation: the operation would be total nonsense. The derivative works existed _before_ you claimed control; you can't just go and say they now owe you money for it

At best I would imagine that nakamoto could get sued for releasing IP that wasn't his to release, and they might be able to lay claim over the bitcoin name and codebase for future updates... but they can't do anything about all the existing forks and derivatives. They already exist!

And as I understood it, the Oracle v Google case was based on the fact that Oracle was already licensing java for mobile devices, and android basically wrote a new not-java, which is all fine and well, but Oracle was claiming that not just the implementation but also the _API_ fell under their licensing operation. That is, _licensing was already part of the story_ , it was just a question of whether it applied to Google's usage.

Bitcoin is not that situation: _no licensing story currently exists_. If it were taken into closed source, it wouldn't be much different from forking the code and making a proprietary version of it, and licensing that out. But the codebase that already exists, in the open, and includes a whole lot of code that is by no means property of sakamoto's institution, can't just be removed from the internet

Also, can you even patent a network protocol? Because the client itself doesn't hold much value, especially not for the derivative works. It's the protocol that's key

ofc I'm not a lawyer, I don't know squat about the topic, but intuitively it seems nonsensical. Imagine doing that operation _intentionally_ : releasing a design so you could retroactively patent and force licenses after worldwide adoption. It'd be dumb as hell

<comment><USER2> That makes a lot of sense. I can see a case if his/her/their intention was to deceive for whatever reason, like personal gain.

The creative solution to the "double spend" problem is the valuable piece. The other pieces, cryptographic hashing and proof-of-work have been around for some time. Algorithms make up the largest pool of software patents.

If it went private (it's actually patent pending once publically released; even if CC licensed, the license is null re: invalid ownership), an owner could do what MasterCard and Visa do: percentage of transaction, etc. I bet they could even make a case for ownership of his 1+ million coins ($6.4 billion USD).

The technology is already out of the bag, though, it's not going back in.

This article is interesting re: retroactivity: [http://www.toikkalawgroup.com/blog/the-patent-bargain-and- th...](http://www.toikkalawgroup.com/blog/the-patent-bargain-and-the-curse-of- retroactivity)

<comment><USER3> If I read your link correctly, retroactivity, at least by what your article is addressing, is an ability held by _the federal government_ , and _only_ the government. And moreover, its about updating the rules and validity of the patent.

Im not sure its relevancy to retroactive creation of patents in this context. I agree it was interesting though.

</comment></comment></comment></comment><comment><USER4> Linus Torvalds takes most of the cake : Linux + Git.

Most developers wouldn't have their job without these two, heck even Github and Gitlab wouldn't exist.

<comment><USER5> I think that's going a bit far. We'd be using BSD, or a commercial Unix like Solaris. Mercurial, SVN, and god forbid even CVS would still work for most projects.

<comment><USER6> We'd all be using Windows NT. Well, y'all would, I'd have become a mechanic or chef or something.

Seriously, in the dim days of the early 90's it seemed like the overpricing and fragmentation of the various Unix vendors would hand the mid-size and small systems space to NT. Which was all part of Microsoft's plan. The BSDs were themselves too factionalized to be a credible alternative. The Unix wars were winding down and NT was winning.

Linux not only blocked NT's takeover of the data center it also ended the Unix wars and ultimately destroyed the market for incompatible Unixes.

</comment></comment></comment><comment><USER7> Too many too enumerate.

Once had used an HTML lib that didn't properly escape characters. I was able to see the source, propose a change, and do it the correct way in my code. I won't say which one it was, but it was extremely popular.

Used a JavaScript lib to create sheet music. The lib worked fine for the most part, but I needed certain features to work, and that required diving into the raw source and making many manual changes. If it was closed source, I'd have to figure out how to write the whole thing myself. That probably wouldn't have been possible for me.

A popular API had an official Python implementation. It was "ready" for Python3, but there were a lot of bugs that would cause crashes. I was able to fix them and send back proposed changes. It took over a year for them to finally do the updates. I needed it that day.

</comment><comment><USER8> Obviously. There was a moment an online application form was broken. myself being CS student, inspected the source code and typed `javascript:fnEditApplication` in chrome URL bar, which worked out.</comment>


The Justice Department could file an antitrust lawsuit against Google this month - <AUTHOR> https://www.washingtonpost.com/technology/2020/09/03/doj-google-antitrust/ <comment><AUTHOR> Note: title was too long so it was shortened. Also added "antitrust" to clarify what the lawsuit was about.

TLDR: Barr overruled the consensus of Justice Dept lawyers and is pushing to file an antitrust lawsuit against Google ahead of the election.</comment>


Ask HN: best HN app for iPhone? - <AUTHOR>

I've tried a few of the free ones and not found anything that consistently loads comments, or displays web pages in a native browser. Any recommendations please! <comment><USER2> It is possibly this: <http://samuelhughes.com/HNWeb.tar.gz>

It got rejected from the App Store.

It tracks unread posts based on your scrolling and highlights new unread posts. It displays web pages in a native browser, makes voting buttons bigger and asks for confirmation, makes the font size appropriate. It works by filtering the HTML that goes to the browser widget, and that aspect of it might need updating if the site's HTML has changed.

</comment><comment><USER3> Try my app <http://hackerno.de>

Still in beta but works well on the iPhone.

If you need a promo code let me know.

</comment><comment><USER4> There are none that really work, but I use this to read

<http://ihackernews.com/>

<comment><AUTHOR> nice - this works much better than the apps</comment></comment>


Nvidia GTC presentation claims "RTX 2080 next gen console" - <AUTHOR> https://www.joyfreak.com/threads/nvidia-gtc-presentation-claims-rtx-2080-next-gen-console.2519/ <comment><USER2> "Link is time stamped." Yet on mobile Safari the 2 hot video starts at 0:00 and I don't even know where to manually seek to since they don't bother saying what the timestamp actually is - why since the link is timestamped, right?</comment>


Goodreads offloads DynamoDB tables to S3 and queries them with Athena - <AUTHOR> https://aws.amazon.com/blogs/big-data/how-goodreads-offloads-amazon-dynamodb-tables-to-amazon-s3-and-queries-them-using-amazon-athena/ <comment><USER2> I use Goodreads as my main book tracker and reviewer. My impression is that Amazon bought it for whatever reason, and then ignored it. It seems like there's so much more potential to a social community around books than what Goodreads offers. The UI also never fails to disappoint. One of the core user features, searching for books, has all sorts of weird quirks. I'll use a very specific query that should guarantee a hit, and nothing comes up. Or, the book that I want will come up for a second, and right as I'm going to select it, the results completely change and the book I want has vanished.

<comment><USER3> The website search seems to not be tokenized, it seems to use the entire word only... so if there's a slight difference it won't find anything.

The main thing I've noticed in Goodreads since they were bought is a strong focus on Kindle integration. The newer Kindles all have Goodreads integration, you can send notes etc. to the Goodreads profile, the site itself has changed very little

(although Goodreads changed a lot of rules around the ability to delete user reviews if they focus too much on author behaviour around the time the Amazon purchase went through [https://www.washingtonpost.com/blogs/compost/wp/2013/09/23/i...](https://www.washingtonpost.com/blogs/compost/wp/2013/09/23/is- good-reads-new-policy-really-censorship/?noredirect=on&utm_term=.356b12aa12ab) )

<comment><USER4> Feature-rich text search with elasticsearch is stupidly easy. It's a real shame.

<comment><USER5> I haven't found this to be exactly the case - I recently worked with an engineer for more than a month tuning Elasticsearch (which required non- trivial changes to our catalog service). (It also took a good amount of effort to coordinate these changes across devices.)

Like Goodreads, we have a fairly constrained catalog and we probably get a similar amount of queries.

The search results are now much, much better, but ES has a pretty poor edit distance / fuzziness algorithm so they still aren't perfect.

<comment><USER6> I know that the tuning you made is probably very context-dependent, but could you elaborate a bit on what kind of things you tuned up?

I am about to start using ES for a project and just knowing which kinds of things could be useful to tune would be helpful.

Thanks!

<comment><USER5> Sure thing!

I'll see if we can make a blog post, but here are a bunch of things that jump out (I work at a company that sells tickets to live events, so our users search for 'live events' like sporting events / concerts and 'performers' like teams and musicians):

\- word order matters _a lot_. we did a lot of fiddling with the n-gram tokenzier ([https://www.elastic.co/guide/en/elasticsearch/reference/curr...](https://www.elastic.co/guide/en/elasticsearch/reference/current/analysis- ngram-tokenizer.html)).. we ended up making word order matter a good amount (e.g., 'new york' vs 'york new' return very different results... considering them the same resulted in a lot of noise)

\- where the user is searching from is pretty important -- we would fetch the 25 best results and then boost (i.e., reorder) them based on the user's distance from the event venue or the sports team's home venue. we also experimented with fetching more and more results (up to 250) and then boosting from this larger result set. note that ES couldn't take location into account out of the box -- we had to manually boost on the ES output

\- we set up versioning with our autocomplete endpoint so we could more easily A/B test variants (highly recommend this)

\- we built a system so non-technical employees could create "synonyms." for example, "nyc" could expand to "New York City." we also worked with our data science team to get a list of bad queries that might need synonyms to improve them. (we also automatically triggered a real-time re-index on synonym creation)

\- we similarly had an "expectations" tool for bug reporting and finding patterns from common bugs

\- we had to add a bunch of other metadata / suffixes to our documents. for example, we might want to return a 1pm Yankees game on August 4 when someone queries "august yankees afternoon game". so we have to interpret the time and add the month to what's being queried. similarly, we want this event to return when someone queries 'nyc baseball', so we need to ensure the league/sport is associated with the event document

\- we also had to add "stop words" that we ignored when querying. these include 'game(s)', 'versus', 'concert(s)', 'tickets', etc

\- we have an internal definition of performer or event "popularity", and needed to normalize this so ES's "match score" made more sense. (we had limited success here)

\- their documentation describes fuzziness as: `fuzziness is interpreted as a Levenshtein Edit Distance — the number of one character changes that need to be made to one string to make it the same as another string` which is overly simplistic and really messy to override (we decided against it)

\- because we had two different entities in our results ('events' and 'performers'), we had to figure out how to compare different entities (it was generally easier to compare results within entities) based on what was returned, time to event, location of event, and home location of the performer. we also added additional entities / pages on an ad-hoc basis which further complicated things

\- we also needed to exclude low quality performers and events from our catalog (e.g., performers with no events, events with no tickets for sale)

In addition to configuring ES, it was pretty difficult to settle on a KPI because it's not that easy to put searches in the context of the entire user session... we could see if a given query resulted in: the user clicking on a result, or no search results, or the user deleting everything in the box and starting over, but we had a hard time following the user and seeing if the click led to a purchase.

Also, as a disclaimer, I didn't actually write any code for this project (I'm a product manager). But I did take a computational linguistics class in college and worked very closely with the developer :)

<comment><USER6> Awesome answer!

I'm hoping you do find the time to write a blog post on this.

Thanks a lot!

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> Hey! I'm the author of this post. I'm pretty chuffed to see this here. Happy to answer any questions.

<comment><AUTHOR> Why didn't you push the data into a traditional data warehouse or sql database?

<comment><USER8> For a lot of teams, S3 is a data warehouse, and you can treat it just like HDFS for the most part with most things in the big-data ecosystem. Presto works well for letting you access it from these locations without having to explicitly import it (assuming it's in a traditional data warehouse or a common SQL DB).

<comment><USER9> I wonder if anyone here has a good heuristic for identifying the conditions under which using S3 + SQL layer as a data warehouse is a better choice than a SQL database?

I've been exploring the former and it seems to only make sense if the size of your data is at a scale that is beyond what a single SQL database instance can handle, and even then, you can continue to scale out with systems like Citus so the limit isn't a hard one. SQL gives one so much (data mutability, consistency, indexes, etc.) that I am hesitant to give it up unless the tradeoffs make sense.

<comment><USER10> I've worked with a S3 + SQL system. It was used for serving data for a reporting dashboard where the stored data was in the 0.1-10 TB range. As the use case was only semi-interactive (users didn't mind waiting 1-10 seconds for a report), and all the queries were pre-defined, this solution was a good fit.

I think it makes sense when there's no in-place updates; either querying write-once data like logs or the output of batch data processing roll-ups that replace the previous data. The less you need the relational model (like joins), the better, but some of those needs can be met through careful design of the storage schema and denormalization.

I wouldn't advocate this sort of solution if your requirements include in- place updates of existing data, frequent/granular updates of new data, expressive ad-hoc queries that use the full capability of relational algebra, or tight latency requirements. You also lose the safety net of referential integrity and table-level constraints, as those are now enforced in custom code that can have bugs.

I would say maintaining this system cost about a half-engineer for ongoing maintenance and new functionality.

</comment></comment></comment></comment></comment><comment><USER11> Weren't Goodreads bought by Amazon a couple of years ago? If so, they might've been pushed to do the move (to microservices, s3, etc) to comply with corporate guidelines/policy not because there wasn't a better/more efficient way to scale.

<comment><USER7> There's no real policy that I'm aware of internally for teams to use microservices. Amazon has a lot of tooling to make it easy to spin up services, however.

The first major project after being acquired was to make a pared down Goodreads experience available on the Kindle Paperwhite. Our first services came out of that initiative to provide a buffer between the Kindle traffic and the Goodreads Rails app.

That being said I'll be the first to caution small teams should avoid microservices at first for fear of creating a distributed monolith.

<comment><USER12> Are internal Amazon projects cross charged for their AWS use? Or is it essentially free for internal use?

<comment><USER7> Come join my team and I'll be happy to spill all the beans!

<comment><USER13> Do you guys have internships on the Goodreads team?

<comment><USER7> Absolutely! We have internships in San Francisco and Seattle. Usually, they coincide with the summer, but we on occasion have Fall interns.

Reach out to me feeneyj @ amazon if you'd like I can forward you to the right people.

</comment></comment></comment></comment></comment></comment><comment><USER14> I like the approach, and I've been considering building something similar. Nice writeup. Is this used only for BI or is it used for real-time queries? The reason I ask is because goodreads.com is slow AF, and performance is a concern for me at this point.

<comment><USER7> We use carrier pigeons from an S3 data center high in the Himalayas to a CloudFront distribution center in Atlantic City (don't ask me, ask the pigeons) to serve all requests.

Just BI.

<comment><USER15> It annoys me that AWS only supports RFC 1149. When will RFC 2549 support be added?

<comment><USER7> You, dear person, win my undying support and affection.

</comment></comment></comment></comment><comment><USER16> First lesson - it's taken Goodreads so long and so many users to actually start moving to microservices.

<comment><USER7> In general, it's not uncommon for startups of the Goodreads vintage to outgrow a simple Rails app and use a more service oriented architecture. We've actually had services for about 5 years now, but we haven't been very vocal about it.

As I mentioned in another comment I, personally, wouldn't advocate for new teams or startups to use a service oriented architecture right out the gate. It's too easy to end up with a distributed monolith (circular dependencies between services, services uptimes that are tightly coupled). Engineers also tend to underestimate the build tooling, observability excellence and discipline you need to make it seamless.

</comment></comment><comment><USER17> We did something similar at a previous position I had, except we set up an amazon lambda function that was triggered on every insert or update to a DynamoDB table. The lambda function flattened the updated record and inserted it into our redshift cluster, which gave us a real-time ETL pipeline for our DynamoDB data. That allowed us to report on our DynamoDB data just like our relational data.

<comment><USER7> We have another GR team that does that and it works well. It's complicated by the fact that at Amazon every team uses their own AWS account. Concretely, a service's DynamoDB tables don't exist in the same AWS account let alone the same VPC as the redshift cluster. Obviously, you can figure out the permissions, etc.

We're trying to get to a place where we have the data in S3 for engineers to build products off of and for the oncalls to do sanity checks and the data in Redshift for our BI needs.

</comment></comment><comment><USER18> What I don't get about Athena is what happens after you've put the data in Athena? Fine, you've got SQL and tabular data, but the type of BI I've had to do usually has a graph or some other visual representation at the end rather than a table. There's only so much data you can import into Excel from a CSV that Athena produces. Usually I find periscope/cluvio to be much better tools for this and then you need to go to redshift. So why bother with all the data pipeline to Athena? Does anyone use this as well as Periscope/Cluvio and can chip in?

<comment><USER7> Athena is just a front end for the data that a typical user can understand (SQL!). the real value is that the data is: in S3, in a more efficient format (parquet), and available in the Glue catalog.

The other replies got it right w.r.t. other BI tools. If you're using Tableau I think it integrates with Redshift, right? In that case Redshift Spectrum is an option.

If you don't have any existing BI tools then Quicksight is an option or alternatively you can spin up an Elastic Map Reduce (EMR) cluster with your fav open source BI tools

</comment></comment><comment><USER19> Isn't it expensive to use S3+Athena instead of DynamoDB?

<comment><USER7> This architecture is meant for business intelligence purposes, not for oltp queries. You're right, it would be pretty expensive to power a user facing service this way.

However, I read a harrowing / awe-inspring blog post about someone doing just that. So...¯\\_(ツ)_/¯

</comment></comment><comment><USER20> This is pretty much straight from the DynamoDB best practices. Offload infrequently accessed data (think time series data from previous months) to S3 and use another tool to query it.

[https://docs.aws.amazon.com/amazondynamodb/latest/developerg...](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/bp- time-series.html#bp-time-series-high-volume)

<comment><USER7> +1 Everything I've learned the hard way with DynamoDB was in the Best Practices documentation the whole time.

Now I've learned to read the Best Practices section of any AWS service before I start implementing. It saves a lot of heartache

</comment></comment><comment><USER21> How does Athena work? The charge is $5 per terrabyte scanned, which indicates (maybe) that no indices are used and queries are processed by a scan through the data. Is this correct?

<comment><USER7> The docs are a good place to start to get a sense of what Athena can do: [https://docs.aws.amazon.com/athena/latest/ug/what- is.html](https://docs.aws.amazon.com/athena/latest/ug/what-is.html)

There are no indexes in the traditional MySQL / Postgres sense of the word. You can, however, layout the data to make your querying more efficient. See: [https://docs.aws.amazon.com/athena/latest/ug/partitions.html](https://docs.aws.amazon.com/athena/latest/ug/partitions.html)

</comment></comment><comment><USER22> how can I make my data more complicated? DynamoDB(non relational, key-value esque WTF-store) + something else

<comment><USER7> Carrier pigeon transport?

</comment></comment><comment><USER23> It looks like busy work to me. I love Rails but sometimes you get to teams where people just don't know what to do with themselves, usually good developers, and they come up with yak shaving and reinventing the wheel for no good reason.

From what I can gather, Amazon acquired them and now they have to figure out something to do. There is plenty of UX to fix.

</comment><comment><USER24> Why is the author's HN comment dead?

Joe feeneys HN account is indeed iamawalrus; he wasn't impersonating anyone. Further his comment just said:

"Hey! I'm the author of this post. I'm pretty chuffed to see this here. Happy to answer any questions."

I want to hear what he has to say.

<comment><USER25> Unsure, but I vouched for it so it's undead now.

<comment><USER24> Thanks. I'm guessing it must have triggered some kind of filter.

</comment></comment></comment><comment><USER26> With the launch of [https://aws.amazon.com/about-aws/whats-new/2018/07/aws- glue-...](https://aws.amazon.com/about-aws/whats-new/2018/07/aws-glue-now- supports-reading-from-amazon-dynamodb-tables/)

Wouldn't using ETL Glue job to directly dump data in parquet format be better?

<comment><USER7> 100%. Expect a follow up in the future with a simplified pipeline.

<comment><USER26> Cool.</comment></comment></comment>


Facebook Brain Computer Interface Program Update - <AUTHOR> https://tech.fb.com/imagining-a-new-interface-hands-free-communication-without-saying-a-word/ <comment><AUTHOR> Nature Article that has the bulk of the information [https://www.nature.com/articles/s41467-019-10994-4](https://www.nature.com/articles/s41467-019-10994-4)</comment>


DRACO (Antiviral Drug) - chroem- https://en.wikipedia.org/wiki/DRACO <comment><AUTHOR> I have wondered what became of this and Prof. Rider. Not many papers or reviews on DRACO are in literature, as to the state of the mechanism, dont know much of virology and the nuances of how DRACO could or coudlnt be applied but good to see i am not the only one who remembers this. Rider has an institute though.</comment>


Saving the Hassle of Shopping - <AUTHOR> https://blog.menswr.com/2016/09/07/whats-new-with-your-style-feed/ <comment><AUTHOR> As consumers, we felt we needed the option to shop great products that inspired us without spending time in the discovery process. What if we could find one place that got to know us in a snap, and offered the latest products from amazing brands? As professionals from the world of search, e-commerce and machine learning, we decided we had to fill that void building a great experience that would turn shopping into an inspiring and satisfying moment.</comment>


Show HN: my new site helps iOS devs share, track and promote promo codes - <AUTHOR>

iOS promo codes are in theory a great way to get people to try and talk about your app, but I found it's really hard to get the most of them. I could tweet a couple of codes, but it's a complicated multi-step process to redeem them. Once I've sent them, I've no way of knowing if the codes have actually been used or not.
I built http://pcod.es/ to make it easier. You paste in some promo codes along with details of your app, and get a short url (like http://pcod.es/pi6) to share. The site tracks which promo codes have been redeemed so it's much easier to make sure you get the maximum exposure for your app. Finally, if users choose to sign up with Facebook and enable the option, a link to your app appears in their feed.
I'd love some feedback! <comment><AUTHOR> Clickable link: <http://pcod.es/>

Free copies of my apps so you can see how it works:

Switch, the multi-user web browser: <http://pcod.es/pi6>

Awesome Shopping, a super-fast shopping list: <http://pcod.es/As1>

</comment><comment><USER2> Can you add some screenshots on the metrics we get as devs?

<comment><AUTHOR> Right now, I'm trying to strike a balance between making info available to devs and respecting user's privacy. The site gets the emails and IP addresses of people who get apps but doesn't reveal those to the dev.

The only "metric" that's available is the number of codes that have been used.

I've thought about making an opt-in so developers can contact users later. This way you could get people's permission to follow them up with questions on the app. How does that sound?

<comment><USER2> Sounds great, though what I want now that I think about it can be achieved by requiring a like or a tweet, It would be great if you can provide that.</comment></comment></comment>


Ask HN: A good forum/site to hang around, ask questions, help others? - <AUTHOR>

I am not a Twitter/Facebook guy, i prefer a forum to mingle with people, ask the doubts i have, or help others with what i know, and in general get to know people from different countries.
I used to frequent computer related forums back in study days. But now i would really like a forum/site with varied range of topics.
For example say i need to ask questions in varied topics like which monitor/tv to buy, info about income taxes, an affordable asian tourist destination, which new movie to watch, etc, you get the idea.
So is there really any big/popular site with lots of people from different countries [i have a hell lot of country specific questions to ask :)] with many different sub-categories/topics? <comment><USER2> I use twitter for that, mostly do a small search to find a target user, based on his location and direct him the question, he often tweet the question to his followers and come back with an answer, otherwise, I don't know of anything like a global forum for that.

</comment><comment><USER3> I haven't a clue but if you find such a place please do post it!

</comment><comment><USER4> coincidently i've been looking for something like that but i haven't found anything of that kind so far.</comment>


Lyft allowed unauthorised access to my account - <AUTHOR> When I travel to the US I usually buy a pay as you go AT&T sim card to use during my stay. I used to take Lyfts to move around, till today.
If you have a phone with pay as you go service and for some reason you don't pay the bill for a month, you will lose your number.
Then a few months later someone buying a new sim card will have your old number, so if they download lyft they will have your account with your credit card. And guess what? They can have free rides charged to your credit card!!!
So there's a creepy guy taking lyft rides in san francisco with my account.
The best part is that I can't remove the credit card from that account because I no longer have that phone number, so I can't access my account!
I sent an email to Lyft support but no one answered. <comment><USER2> Here's a strange Lyft scenario. I tried to send my friend a Lyft invite so we could both get a discount. He got the invite link, downloaded the app and put in his phone number. It kept rejecting his phone number (it's a CA number and we're in NY, does it matter?). So we thought, maybe we need to put in the phone number of the person that referred/invited him (i.e. me). So we put in my number and it lets him in. He takes his ride home and then I see that his ride was charged to my account. Somehow his phone is now linked to my account and he didn't even enter a password. I emailed Lyft and they don't care, they just explained that I agreed to surge pricing - that's not even on topic to my complaint. Needless to say, neither of us got the referral discount.

<comment><USER3> I've dealt with the rejected phone number (for a California number) as well. And of course, no responses to my emails. I tweeted about it, they tweeted back, and then continued to ignore my emails.

...I switched to Uber...

</comment></comment><comment><USER4> This is what I hate about apps and services using phone numbers as primary credentials. Phone numbers can and do change, so they're nowhere near as stable as e.g. a simple email address. I'm recently facing the situation where I may be moving in the near future, and when doing so I'm going to have to change my phone number to a local one in the place I'm moving to. I'm likely going to have to go through every account and app I have my phone number associated with and change it. (Unless there's a better option that I'm not aware of yet.)

<comment><USER5> > Unless there's a better option that I'm not aware of yet.

Keep your number? I love this XKCD on this [0]. I live in a different state that where I got my phone number and when I moved I just kept the number so I didn't have to go through the dog and pony show of updating it everywhere.

[0] [https://xkcd.com/1129/](https://xkcd.com/1129/)

<comment><USER4> That's less useful when you're possibly moving to a different country.

<comment><USER6> You can maintain a US telephone number for a few dollars a year by porting it to a VOIP or prepaid cell provider.

</comment></comment></comment></comment><comment><USER5> Really think the title of this post should be changed Lyft DID NOT leak your credentials.

<comment><AUTHOR> so, who did it? It's lyft responsibility not to have this security bugs.

<comment><USER5> What I'm saying is:

Leaked Credentials != Unauthorised access to your account

Leaked Credentials == exposing username/email + password (unhashed)

<comment><AUTHOR> ok, agree

</comment></comment></comment></comment><comment><USER7> Hi there - this is Zach from Lyft. Our support team has been responding to your original email to resolve this case.

We take security and personal information seriously, and did not leak credentials. The relevant teams within Lyft, including product/engineering, have been alerted of this case to continue ensuring the community's safety.

<comment><USER8> What about this comment: [https://news.ycombinator.com/item?id=9355499](https://news.ycombinator.com/item?id=9355499). How is this happening?

</comment></comment><comment><USER9> Can't you just call the CC and dispute the charges and or freeze charges from that merchant? Granted that doesn't solve the larger problem here but it would at least stop the guy from abusing the system.

<comment><USER10> This is exactly why 30 day chargebacks exist, right?

<comment><USER11> Sure, though lyft may well ban you for life.

<comment><USER12> So? They don't know who he is anymore.

<comment><USER13> Wouldn't his billing info be sufficient to identify him again in the future?

<comment><USER10> It doesn't sound like Lyft is retaining too much info on their customers. I would bet if they used another card they would be able to join again.

</comment></comment></comment></comment></comment></comment><comment><USER14> What you do here is tell your credit card company that the charges are fraudulent and that you have informed Lyft that the card is not authorized, but they refuse to do anything about it. Let them handle it - they will.

<comment><USER15> But Lyft hasn't refused anything. Best to have Lyft resolve. May take an ounce of patience.

<comment><USER16> The guy's e-mailed Lyft support and hasn't got an answer.

What downside is there to reporting the fraudulent charges for what they are, apart from a tiny possibility of being banned from using Lyft in the future?

</comment></comment></comment><comment><USER17> TLDR: I feel your pain.

I went to Scottrade and asked them to close my account, back in 2007 or 2008. They said "sure," cashed out the account, left it open, and continued sending me account status emails for almost ten years.

Last week they told me I had a negative balance of $13. I called them and they can't give me any information over the phone, because I don't know my old address or phone number from whenever I opened the account. (I don't know when that is, only that it was before 2007 or so.)

So I have to go into a physical office. And where I live now, the nearest physical office is more than 60 miles away. And they're not open on weekends.

And they can apply fees to this negative balance, spiral those fees out of control, refer it to a collections agency, and put it on my credit report, all without ever once breaking the law.

So I have to drive 60 miles both ways, because almost ten years ago, one of their employees was too lazy to do their job correctly. And I can't even do it on the weekend.

US consumer law has terrific protections for all the problems that were legitimate risks 100 years ago, but it sucks today. Effectively, the burden of proof is now on me to demonstrate that this $13 fee is not my problem.

<comment><USER10> Same thing happened to a Chase checking account I had.

I cashed & closed it, but the teller must not have actually closed it because they decided to charge it $10/mo for some stupid bank-fee reason. It was diving into negative numbers for months before I discovered it.

</comment></comment><comment><USER18> This is a very serious issue and you should not stop pursuing all available support channels until you get an answer. I can guarantee you that such a glaring bug will immediately get high priority in their issue tracking system. The last thing Lyft wants is for something like this to get reported on and shake confidence in the platform they are trying so hard to build.

<comment><USER19> The problem is that it's not a bug, it's the foolhardy way that the system is designed.

<comment><USER18> I guess it's a semantic disagreement but I would still call this a bug. If they considered this use-case when they designed the system and then decided it was not worth designing for then I suppose it is not a bug, but I find it hard to believe that is the case.

<comment><USER20> I don't (find it hard to believe). A few chargebacks are nothing compared to adding friction to the signup of the majority of users, financially speaking.

</comment></comment></comment></comment><comment><USER21> This might be a stupid question but does this mean that if I have a phone emulator and configure it to have some number and download one of these apps that use the # for account lookup that I could essentially hijack peoples accounts like this?

EDIT: no that doesn't seem to be the case. When you login to Lyft they send a text to the registered number.

<comment><USER22> I think Lyft login/auth would require you to be able to _receive_ messages sent to that number.

</comment></comment><comment><USER23> Tell your bank that you did not authorize the charges. You get the money back; they can't charge you anymore; the banks ding lyft statistically in rates and trust.

</comment><comment><USER24> Sounds like you merely need to inform the bank of the charges on your credit card and let them know that you made an effort to contact the company. Contact the credit card issuer to reverse the charges. Lucky for you you didn't use a debit card then you would have had a real problem.

</comment><comment><USER25> I just emailed this thread to John Zimmer, co-founder & president. Expect it to be handled shortly.

<comment><USER5> As happy as I am that things like this can happen (IDK if you know John or just sent it to his email) it annoys me that problems like this cannot be fixed without complaining on social media/sites like HN.

The number of times I've followed a companies support channels and heard no response in a weeks time then tweeted and got it resolved in less than 3 hours is staggering and quite disappointing. The squeaky wheel gets the grease....

</comment></comment><comment><AUTHOR> Lyft support answered my email:

"After reviewing your statement and digging deeper into our payment back-end, it appears that because your phone number had transferred ownership the new owner of this number may have logged in thinking that this was their account. Due to this occurrence, we at this point in time have placed a hold on all logins using this phone number — this in turn will halt any further use of this account."

<comment><AUTHOR> "thinking that this was their account'??? So now their name is Dayana, and they didn't notice? come on!

</comment></comment><comment><USER26> It's a pain but it sounds like you need to cancel your credit card. Or you can wait and see if this post gets any attention. Obviously they have a gap in their authentication that they need to address.

</comment><comment><USER15> Current headline: "Lyft leaked my credentials"

Sorta thought the story was going to involve leaked credentials.

First, I'm sure Lyft will take care of it in your favor.

Second, this is certainly an issue when utilizing SMS for authentication/login. I'm not sure the best answer since it can be a good way to support easy login/authentication. If phones send along a device ID, that might work. Not sure the frequency of same number on same "disposable" phone.

</comment><comment><USER27> Lyft's support team seems nonexistant. I've sent several emails to them and never received a reply.

</comment><comment><USER28> Lyft is not the only company that will do things like this. Twitter tried this with Twitter Digits, and Yahoo offers single-factor phone based recovery. In all of these cases, companies are sacrificing convenience for security.

<comment><USER5> "companies are sacrificing security for convenience" FTFY

<comment><USER8> You are right. After reading this I requested Uber to delete my account as i was using a prepaid phone while visiting the US. I was very disappointing as they don't have an easy way to delete an account, you need to send an email explaining why.

<comment><USER5> Just to be fair account deletion is not a super easy thing. It may seem easy "DELETE FROM users WHERE id = '123';" but you also need to delete all of their related records. Let's say you have a user table with use username, hashed password, and id in it and then all that address/DOB/etc in a users_data table or similar. Now you need to delete the users_data record as well. But that's not all, what about all the transactions in the "rides" table. They are related to the user but we need to keep them for historical data and/or reports. It can get messy VERY quickly and if the application is changing quickly then your "delete user" logic might leave behind new user data that it doesn't account for.

What I'm saying is that while I do find it mildly annoying that there is no "Delete Account" button there are good reasons for it. Not is this a non- insignificant amount of work to build/maintain but from a business point of view it means spending time/money on a feature that is only for people who no longer want to be your customer so put in that light it's no surprise this feature falls by the wayside often. Also there is the whole "I accidentally deleted my account" (no matter how many warning you put up) and that means you either need to "soft delete" all the data so you can "undo" OR you have to reconstruct the user's data from a backup (either programmatically or by hand).

</comment></comment></comment></comment><comment><USER29> So how long has it been since you emailed them?

</comment><comment><USER30> even if the sim isnt changed, phone number assignements are not safe in any way. just a number in a database. it could be changed by anyone for a few mins and you wouldn't know. it could be social engineered away. etc.

</comment><comment><USER31> Chances are some low level engineer brought up this possible issue but some idiot with a bigger mouth than brain just dismissed it

</comment><comment><USER32> This isn't the proper medium for your complaint. Maybe it'll be resolved somewhat faster but the way you did it wasn't right.

</comment><comment><USER33> You're the one who forgot, or chose not to, pay your bill and got your phone number cancelled. And you chose to use an app that tied your phone number and your credit card together. So, you share some responsibility here.

Lyft's problem is two-fold: 1) they don't warn users not to use their app on a temporary device 2) they don't allow an easy way to cancel the account without the phone number</comment>


First news report on Google - <AUTHOR> http://www.nytimes.com/1999/07/22/technology/i-link-therefore-i-am-a-web-intellectual-s-diary.html?scp=19&sq=google&st=nyt

<comment><USER2> I find ironic that the news page is scattered of "ads by google".</comment>