Why Google won't fix a security bug in almost a billion Android phones - <AUTHOR> http://www.engadget.com/2015/01/14/google-security-bug-billion-android-phones/ <comment><USER2> The fact is that Google _has_ fixed the bug. The fix is in Android 4.4. From Google's perspective, the onus is on manufacturers to then ship Android 4.4 to the end users.

In retrospect it was a poor assumption on Google's part to think that these manufacturers were actually going to support their customers. That is why they have spend the last 2+ years re-architecting the system to shove a bunch of functionality into things that Google can update or libraries that developers can incorporate into their apps. I imagine when they started out, they did not intend to have a huge amount of the system in a support library that is packaged inside every single app. I bet they also didn't intend to have the bulk of new features be in the Google Play Services package. Yet here we are, largely because the manufacturers are much like PC makers in that they put their own interests far ahead of the ecosystem interests.

<comment><USER3> The problem is that even _GOOGLE_ does not support their customers on the Nexus line. I have, in my drawer, an otherwise perfectly good Galaxy Nexus that is stuck running 4.3 because Google cannot be bothered to update it to 4.4. If Google will not update its own Nexus hardware to 4.4, how can anybody reasonably blame other hardware vendors for behaving the same way?

<comment><USER4> Wasn't that because Texas Instruments pulled out of the mobile market?

<comment><USER5> That may be the excuse, but it isn't much of a reason. Google's got the clout to get rid of problems like that. They just didn't deem it worth the expense.

<comment><USER6> Do you have like 0 experience in hardware or just trolling people? If TI refuses to support the hardware, there isn't much you can do. Besides the enormous technical challenge of reverse engineering all of the software, there's likely legal issues as well.

If a hardware vendor pulls support for your product, it's almost always better to end of life the device.

A better argument is that vendors of consumer hardware should require that their partners sign up for long term support agreements where warranted. Let's not pretend that, just because a software company is big, they can force one of the largest chip vendors in the world to bow to their demands.

<comment><USER5> If you're an end user or a small shop, you SOL when the hardware gets dropped. But a company like Google _always_ has options. It's not like TI went out of business or stopped answering Google's phone calls out of spite. Google can totally afford to buy a source code license for the drivers and firmware, and they would realistically only be taking on a small added QA burden since they know everything works as-is with the old OS version and they know what they changed with their new OS version. If they were really serious about maintaining their product leadership, they could even hire some of the original team that wrote the drivers and firmware.

<comment><USER6> They answer your phone calls, they just say "it's not a priority for us to fix this right now" and then the negotiations start. Some times, that's where things end, because you just can't meet the demands of the vendor. Happens all the time in hardware for big and small businesses alike.

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> Given that the bug in Android 4.3 was fixed in Android 4.4, which AFAIK is available to all manufacturers, how much blame should accrue to the manufacturers for being chronically months or years late in pushing out version updates?

I can see arguments both ways.

<comment><USER8> I don't think they're late, I think they choose to stop sending updates to devices. The obvious reason is they want people to buy new devices (i.e. renew 2 year contracts).

<comment><USER7> It's both, really. They stop producing updates entirely after a year or two to deliberately cripple old machines, and when they _do_ send updates they are often many months late.

</comment></comment></comment><comment><USER9> I am not sure whether Google should develop a fix or not for these devices. Version 4.4 does not have this issue, so the obvious solution would be to update the system. In the real world, android updates are not .. ubiquitous though, not to mention that after some time, all OEMs stop updating their terminals (that also includes security patches though ...).

Google has solved webview/browser bugs in 5.0 by having auto-updates during the activation and a chromium based webview which is update through the webstore but there are surely bugs that can't be solved that way or through Play Services.

The absence of 'forced' upgrades was probably a very good idea in order to popularize Android among OEMs but it seems to me that Google should start thinking about a way to make Android easy to update.

In that context, I would not be against reduced customization possibilities. Especially since the need for OEMs to differentiate themselves often lead to UIs with very discutable choices compared to stock Android (cough Samsung cough). Most skins brought large improvements over stock in the 1.x 2.x era, nowadays it is far more debatable.

<comment><USER10> The problem is Google are abusing their position once the customization capability is removed.

For example, they were done for using Google Street View cars to slurp WiFi information, so now they just use Android devices to do it for them. Manufacturers have to have this enabled by default if they want Gmail and the Play Store on the device. (EDIT: and even worse, if you agree to that for one device you have to agree to not release any Android devices which do not have those things, thus removing the ability for the market to decide).

When people, rightly, complain about the Facebook app having permission to do way more than it should they seem to be oblivious to the fact Google are doing things which are far worse.

<comment><USER11> > For example, they were done for using Google Street View cars to slurp WiFi > information, so now they just use Android devices to do it for them.

What? Street View problems were not about slurping SSID, MAC and geolocaction from wifi's, but because of capturing snippets of broadcasted data.

They still use Google Street cars to geolocate wifi's.

> Manufacturers have to have this enabled by default if they want Gmail and > the Play Store on the device.

Source for that?

> and even worse, if you agree to that for one device you have to agree to not > release any Android devices which do not have those things, thus removing > the ability for the market to decide

Source for that?

<comment><USER10> [http://www.cnet.com/news/google-alibabas-os-is-an- incompatib...](http://www.cnet.com/news/google-alibabas-os-is-an-incompatible- version-of-android/)

For example. Try looking and you will find.

<comment><USER11> > For example. Try looking and you will find.

I'm still trying to grasp what has to do the Aliyun case where a member of the OHA was developing an incompatible Android version with pirated Google apps in its store with your claim that Google forces OEM's to have geolocation enabled by default.

<comment><USER10> [http://www.theverge.com/2011/05/12/google-android-skyhook- la...](http://www.theverge.com/2011/05/12/google-android-skyhook-lawsuit- motorola-samsung)

Here's another example of their shit.

I know, it will never be enough.

<comment><USER11> [http://bostinno.streetwise.co/2014/11/06/google-lawsuits- sky...](http://bostinno.streetwise.co/2014/11/06/google-lawsuits-skyhooks- geolocation-tech-was-just-inferior-court-rules/)

Ups, there was not bullying. And, by the way, your claim was that Google forces OEM's to have enabled slurping of wifi data. So, I don't know why you bring the Skyhook case. Perhaps you will bring the Oracle case next. Still waiting

> I know, it will never be enough. Yes, it will never will be enough if you > only bring unrelated thing, and wrong things, by the way

<comment><USER10> You need to take your blinkers off.

The 750 pages of court submissions in that link on the Verge actually answer all your supposed confusions. Seriously. The whole "technical inferiority" angle is discussed as having been invented as a way for Motorola to break off the Skyhook deal. Skyhook pass the CTS in 2009 when Google aren't paying attention but then fail when it's strategically difficult.

Basically "compatibility" is not technical at all, and entirely down to compatibility with Google strategic objectives. As Motorola quite rightly observe.

"And indeed, Skyhook ran headlong into Motorola's dependence on Google: Motorola flat-out told Skyhook that Android devices are "approved essentially at Google's discretion," and that Moto couldn't afford to risk its relationship with Google."

The key point behind the Skyhook case was that it impacted their ability to do the WiFi slurping, again, as discussed at length on that link.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER12> A more detailed response is here: [https://plus.google.com/117193854832907724231/posts/1md7ruEw...](https://plus.google.com/117193854832907724231/posts/1md7ruEwBLF)

<comment><USER13> Sheez. So when the broken code in question is over 2 years old, and is hard to fix, then Google just washed their hands of it? Google is a big company with substantial resources. How about they support their customers beyond the "new and shiny period" like many, many other companies do?

<comment><USER14> Google could invest the resources to create patches. What Google can't do is get those patches delivered to end-user devices. Given the fact that if Google provided patches they'd never reach users anyway, why should Google bother? And we know that OEMs won't provide updates because they are already refusing to provide the one that has existed for some time now: Android 4.4.

(Disclaimer: I'm a Google employee, and I work on Android security, but I'm not a spokesperson and these are only my own opinions.)

<comment><USER15> >What Google can't do is get those patches delivered to end-user devices.

Apple manage to do it. Google made a conscious decision to trade off allowing end users to keep up to date with achieving faster adoption of Android among OEMs and carriers. You can't now pretend that the results of those decisions are some kind of inevitability. It was Google's choice, and they are responsible for the result.

>And we know that OEMs won't provide updates because they are already refusing to provide the one that has existed for some time now: Android 4.4.

Yes, OEMs like Google themselves…

<comment><USER14> Apple makes all of its devices and therefore controls them. Google can't dictate to Samsung, HTC, LG, etc.

Google has updated the in-support Nexus devices. The Galaxy Nexus is something of a question mark, but the number of active Galaxy Nexus devices is tiny. It would make more sense for Google to offer GNex users a new device than to upgrade the few remaining GNex's to 4.4.

</comment></comment></comment></comment></comment><comment><USER16> Here's an excerpt from the article. The very first words of the article:

> A day after Google publicized a flaw in Windows 8.1 before Microsoft could > do anything about it, [...]

I stopped reading after this, for obvious reasons.

<comment><USER8> That's some biased journalism there, shameful for engadget.

</comment></comment><comment><USER17> "Google statues on Google's Mountain View campus. A day after Google publicized a flaw in Windows 8.1 before Microsoft could do anything about it"

Biased article from line 1.

I want to like Microsoft. I really do. This kind of "journalism" isn't doing them any favors in that regard.

</comment><comment><USER18> Is it that PR people are pushing this story, or that the clickbait potential of the headline is irresistible?

The fact is that Android 4.0+ can use Chrome, which doesn't have this bug. That's 85%+ of the installed base. This is an uncontroversial as any of the other bugs recently closed as NTBF.

<comment><USER13> I suspect that your average Android user has no idea about the browser on their phone. These are the users who are most at risk.

Also, correct me if I am wrong, but app-based webviews (or app actions that spawn a browser instance) would defer to the default browser, ignoring any installed 3rd party browser. So i believe that the "install chrome" solution does not actually resolve the problem.

<comment><USER19> > Also, correct me if I am wrong, but app-based webviews (or app actions that > spawn a browser instance) would defer to the default browser [...]

I think that _is_ wrong, based on my phone's behaviour. Still with you, though; neglecting to fix this leaves the most vulnerable users open to attack.

<comment><USER18> That's wrong for _some_ versions of Android, but if you have, for example, a Web wrapper around a Web app in an older version of Android that uses WebView, it's only a risk if the app somehow displays a link to an exploit. A properly designed Web wrapper uses techniques to avoid this risk: filtering urls to stay in the app's domain and, for, e.g., ads that jump outside that domain, to launch a browser.

<comment><USER15> >A properly designed Web wrapper uses techniques to avoid this risk: filtering urls to stay in the app's domain

So you are saying the WebView on Android is unsafe to use for rendering untrusted content. That's a pretty serious limitation and certainly not made clear in the documentation[1]. Infact the first line of the docs suggest that a WebView is suitable to "roll your own web browser" with…

Something is seriously wrong with Google's attitude to security if they are happy to document a class that's totally unsafe for use with untrusted data as being safe. Knowing this is enough to put me off ever using Android again to be honest.

[https://developer.android.com/reference/android/webkit/WebVi...](https://developer.android.com/reference/android/webkit/WebView.html)

<comment><USER18> > _That 's a pretty serious limitation and certainly not made clear in the > documentation_

Having engineered Web wrappers for a few clients, I would not have let them out the door without url filtering, and not just for security. A wild url could mess up the UX way before it becomes a security issue. Any sane "kiosk" style software should behave that way.

As for the documentation, when it was written, those statements were true. Now, with Chrome implementing WebView, that documentation is once more true. And I would STILL include url filtering in a Web wrapper.</comment></comment></comment></comment></comment></comment>


Iran's 'Twitter revolution' was exaggerated - <AUTHOR> http://www.guardian.co.uk/world/2010/jun/09/iran-twitter-revolution-protests

<comment><AUTHOR> The best quote:

 _Such hyperbole reveals more about western fantasies for new media than the reality in Iran_</comment>


Ask HN: Should i quit my lucrative job to work on my startup idea? - <AUTHOR>

I work in a hot startup in SF with >150k salary and >1.5M in stock options at current valuation. I have an idea which i'm yet to implement and work it out. I have heard from my friends if you have to work on your idea you have to quit.
Should i quit my job and start working on my idea?
I have a great salary at the age of 23 and if my idea fails i'm losing a good job with >150k salary and 1.5M in stock options which might go 5X according to my calculations.
What should i do? <comment><USER2> Complete as much work as you can while being at the startup (customer exploration, wireframing, customer development, team development, etc.).

If you manage to get customers to pay you prior to launch, then quit and pursue your venture.

Just my $0.02

</comment><comment><USER3> The expression don't quit your day job seems to suffice here. Don't quit your day job until your idea has a platform to rest on. You could always work for few years then pursue what you originally planned, just you will have more startup capital which is a plus.

On a side note, if your idea is a tech based startup idea you can save a whole lot of time/work/effort and money if you read up a bit on microservices, docker, coreos, devops, and selling Software as a Service(SaaS).

</comment><comment><USER4> You can do things they way you want to. but, you probably need to be working on something full-time to get investment money. I would stick to what your doing until your options vest. As for your idea, you can afford pay for market research to see if your ideas has any meat to it. Also, if there are technical challenges, build a proof of concept.

</comment><comment><USER5> Is it something you can implement solo? If so do it then decide.</comment>


Clustering by Consensus - <AUTHOR> http://aosabook.org/en/500L/clustering-by-consensus.html <comment><USER2> I like a lot of this, and it is particularly interesting to me as I am currently looking for something to replace a multi-node Corosync/Pacemaker clustered application. I have mixed feelings about writing the solution in Python, while I love the language I worry that it is not safe enough for a rock-solid, never-fail clustering implementation.

However, my biggest problem is that the author seems to completely punt on the most important problem. "To avoid this outcome (split brain), creating a new cluster is a user-specified operation." That's... just not good enough. Any clustering stack worth running must be capable of handling a network partition and continuing operation in a safe manner. In a traditional cluster that means the excluded nodes are fenced and the remaining majority continues. There are other valid solutions, but requiring user intervention in the event of a network split would be a complete non-starter for the type of application we run. We ship hundreds of these systems to customers, and they must be able to run without user intervention at all times. If something fails it might be days before we can get a tech out to investigate the problem. Not being able to handle this situation almost seems to miss the entire point of implementing a good consensus algorithm in the first place.</comment>


Ask HN: Review my weekend project - HackerBlogs - <AUTHOR>

A fellow HNer asked days ago about a place for hackers to share their blogs and I dedicated the last week to work on that project, it has been an interesting experience and I wanted to show you all the result. HackerBlogs is an aggregator specifically taylored for developers and entrepreneurs. Please take a look and let me know what you think. <comment><AUTHOR> Link: <http://www.hackerblogs.com>

</comment><comment><AUTHOR> I hope you all help me grow the site by just registering your blogs, no need to create accounts or anything annoying, just enter your blog address and I'll fetch your feeds everyday for new content. Only personal blogs, no meta- aggregators or commercial blogs will be allowed, so no techcrunch, digg, reddit, et al. That will help reduce the marketing noise, fud and payperpost we get all the time inundating our beloved news sites.

HackerBlogs: for hackers, by hackers.

<comment><USER2> What is the stack? Just curious.

<comment><AUTHOR> Python on AppEngine. Zero headaches.

</comment></comment></comment><comment><USER3> I would actually enjoy a blogging platform that is designed for hackers. Such a platform would need syntax highlighting, latex, etc.

There is nothing like this among free blogs. The closest thing is github's jekyll, which does not actually have latex support on the server.

<comment><USER4> WordPress.com does latex and syntax highlighting.

<http://en.support.wordpress.com/latex/> <http://en.support.wordpress.com/code/posting-source-code/>

<comment><USER3> Is it free to use? e.g. can you use it on the free blogs provided by wordpress?

<comment><USER4> yes

</comment></comment></comment></comment><comment><USER5> Great idea. I suggest you also give petercooper's coder.io a look. It's amazing for Ruby/Rails news, but I'm sure it's great for other topics.

<comment><AUTHOR> I saw coder.io on HackerMonthly as I was working on HB, great source of inspiration.

</comment></comment><comment><USER6> Happy to provide ~120 feed URLS from <http://roomcu.slinkset.com>. Drop me an email.

</comment><comment><USER7> Probably would be better to show the category tags beside/below the author/comments subtitle.

I like it though. Rather than inclusive filtering like you have on the right hand side, is there any way to filter out the categories I don't care about? Maybe I want all of the blogs except Haskell and C#, for instance.

<comment><AUTHOR> That's in the todo list, I'll implement tags next to the title, easier to know what the article is about.

I'll think about remembering your settings, since I really don't want to create accounts and stuff. Not easy to implement without accounts tho.

</comment></comment><comment><USER8> I like this idea a lot. I've registered my blog and will be checking it out. Good luck!

</comment><comment><USER9> Awesome. The colour scheme seems very familiar.

What do the numbers mean?

<comment><AUTHOR> I used the same color palette from HackerNews and HackerMonthly, trying to make HackerBlogs part of the family.

I hope I don't get sued.

Numbers to the left are just clicks, like showing how many times people has clicked on such article. Maybe I'll show a top ten of the day or something.

</comment></comment><comment><USER10> An RSS feed would be very useful.

</comment><comment><USER11> Great idea. However, the site does not render properly in IE8.

<comment><AUTHOR> I know, sorry about that, IE doesn't support custom tags and HackerBlogs use them everywhere.

It is just a personal attempt at my own version of HTML6. Take a look at the source code.

In the future I'll change all custom tags to ugly divs again.

<comment><USER12> I believe you can work around this in IE by using document.createElement() in the head for any custom tag you want to use - see [http://html5doctor.com/how- to-get-html5-working-in-ie-and-fi...](http://html5doctor.com/how-to-get- html5-working-in-ie-and-firefox-2/).

<comment><AUTHOR> Thanks for the pointer, I'll try to fix it and see how it works.

</comment></comment></comment></comment><comment><USER13> There's a very good book by Steve Krug about usability: "Don't make me think".

I have a strong feeling that you haven't read that book, because your make me think so much that I will suggest you work on presentation and colors.

Edit: I figure it could be an IE thing --

<comment><USER14> This comment would be more helpful if you gave him some specific criticisms. What did you have to think about? How could he fix it?

Kilimanjaro, it seemed pretty straightforward to me.

<comment><USER2> happy 1 year</comment></comment></comment>


If you want security, disable hyper-threading, says Linux kernel maintainer - <AUTHOR> https://www.theregister.co.uk/2019/10/29/intel_disable_hyper_threading_linux_kernel_maintainer/ <comment> the-dude Didn't one of the main OpenBSD maintainers suggest this like 10-15 years ago?

Unable to find it.

edit : [https://en.wikipedia.org/wiki/Hyper- threading#Security](https://en.wikipedia.org/wiki/Hyper-threading#Security)

"In May 2005, Colin Percival demonstrated that a malicious thread on a Pentium 4 can use a timing attack to monitor the memory access patterns of another thread with which it shares a cache, allowing the theft of cryptographic information."</comment>


Apple does not keep the 30% commission on a refund - <AUTHOR> https://twitter.com/twolivesleft/status/1288625617873694721 <comment><USER2> The related thread from yesterday: [https://news.ycombinator.com/item?id=23987584](https://news.ycombinator.com/item?id=23987584).

This was a moderation failure too. We try to find out when stories are false and downweight them or at least change their titles. We want HN to be a place where erroneous claims, especially indignation-rousing ones, get fixed, not amplified, and it pains me that we missed such a clear case. I admire that people have been so proactive about correcting it, though. That is rare.

</comment><comment><USER3> I was actually surprised that no one else posted excerpts from the Apple Developer Agreement[0]. There's millions of copies out there.

It clearly states that Apple is _entitled_ to do what was originally tweeted, but, from a lot of anecdotal stories by developers that have actually processed refunds (I am not one. I have never processed a refund), Apple does not actually do this.

A few folks have pointed out that, even though the contract stipulates it, the practice may be considered illegal, or at least open to court challenges; which might be why it isn't enforced.

[0] [https://news.ycombinator.com/item?id=23992510](https://news.ycombinator.com/item?id=23992510)

<comment><USER4> No Apple states they are entitled to not refund credit card fees (which they would not get back) - they don't state they are entitled to not refund the 30% cut

<comment><USER3> I don't read that at all:

 _> In the event that Apple refunds any such price to an End-User, You shall reimburse, or grant Apple a credit for, an amount equal to the price for that Licensed Application. In the event that Apple receives any notice or claim from a payment provider that an End-User has obtained a refund for a Licensed Application, You shall reimburse, or grant Apple a credit for, an amount equal to the price for that Licensed Application. In such cases, Apple will have the right to retain its commission on the sale of that Licensed Application, notwithstanding the refund of the price to the End-User._

 _" an amount equal to the price for that Licensed Application"_ sounds like we're on the hook for the full nut.

 _" In such cases, Apple will have the right to retain its commission on the sale of that Licensed Application, notwithstanding the refund of the price to the End-User."_ Sounds like they get to keep the 30%, no matter what.

Like I said, it may not be enforceable, in the real world, but that's what the agreement I have, says, verbatim.

<comment><USER5> Isn't this about user-initiated chargebacks through the CC provider rather than developer-initiated refunds? Or am I reading this wrong?

> any notice or claim __from a payment provider __that an End-User has > obtained a refund

<comment><USER6> I am not a lawyer, so interpret this with lots of salt. The paragraph describes two scenarios, then says 'In such cases'. I would interpret that to mean that Apple requires that you allow them to retain their right to the commission in both scenarios.

<comment><USER7> Why say "in such cases" if you're not referring to a subset of cases?

</comment></comment></comment></comment></comment></comment><comment><USER8> It's good to see that a chunk of HN (the ones who upvote/downvote, including myself) see that HN is formed by humans and therefore it has its own biases and that fake news aren't an external evil that can't just appear here.

That being said, if we dig a bit this also shows how Apple is being seen as a bit of a villain by many people (again, including myself) nowadays and had no problems believing Apple was doing this because it pretty much aligns with their IMHO abusive practices when it comes to grabbing money from devs.

Apple will keep selling and having some bad PR isn't going to affect sales much I guess but I can't stop thinking that some day some competitor will show up, or some law will change and they'll be forced to lift the app store restrictions and most of the devs will fly. Maybe it's time for Apple to start considering reducing the greediness with the people who make their platform attractive when these kind of news pass all filters, even in communities like this.

<comment><USER9> > some law will change and they'll be forced to lift the app store > restrictions and most of the devs will fly.

Why would devs leave if restrictions are lessened? Devs are there right now, in droves, _despite_ those restrictions.

<comment><USER8> With restrictions I meant if you want to distribute your apps in iOS, you must use the App Store and pay your fee (the yearly one as well). What other option do you have right now? None, and that's why _devs are there right now_.

<comment><USER10> The devs are there because there is no other option where there are sufficient paying customers.

So in order to have that option, there must be sufficient paying customers, but it can be argued that the paying customers are there because of Apple's restrictions.

<comment><USER11> Offer "20% off" deals on the competing store, and Apple will be forced to reduce their cut if they want to stay competitive.

<comment><USER10> What store? I specifically buy the elderly people in my family iOS devices so that they are restricted to things from Apple's App Store.

Unless someone came around and showed they have a better track record than Apple, I wouldn't be interested in changing. But I suspect they would be just as restrictive as Apple is now.

Not worrying about malware and tech support is worth so much in saved time.

<comment><USER11> You may not be interested; do you think the majority would agree?

<comment><USER10> I think the majority wants something that just works and accomplishes the task they want. Unfortunately, malware is rampant on other devices.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER12> More than 1000 upvotes on a piece of false information[1], on a website where people are well educated and informed. HN fell to fake news. I don't mean this in a judgmental way, when I saw this posted I thought "that doesn't sound right, but I guess if it has so many upvotes on HN it must be true".

It's kind of fascinating on many levels, I guess many of us put more trust on the community rather than our gut feeling. We are in the post-truth era indeed.

[1] [https://news.ycombinator.com/item?id=23987584](https://news.ycombinator.com/item?id=23987584)

<comment><USER13> Apple's opacity leads to this kind of thing. The "rebuttal" doesn't have a citation either. How do we know that it itself is not also fake news? Apple _should_ have a nice clear page we can all link to that explains how this works. But nobody seems to have found one.

Edit: no, really, this is important: we're in the middle of the lesson of "social media can amplify things that aren't true and you should check them". Great. So, how _do_ we verify things? What should we be doing? The counter claim link at the top of this thread is also just a random unsourced tweet!

<comment><USER14> It's in the terms:

 _" In such cases,Apple will have the right to retain its commission on the sale of that Licensed Application, notwithstanding the refund of the price to the End-User."_

<comment><USER15> What is in the terms? That part says they can keep the commission if they want to. But the question is do they actually keep it.

<comment><USER16> If I were writing these terms, I'd want to include that clause so that if someone attempts to attack Apple financially by getting a lot of people together to buy apps and then refund them, Apple would have some discretion in terms of keeping enough money to offset the attack. It would be a tricky situation, but at the same time, by including that clause they also make the situation less likely to come up in the first place by making that attack vector less appealing.

There's also some other attack vectors I can think of that this renders less likely, like "let's get my big YouTube fanbase to all buy this one app today, then refund it near the end of the refund window, thus pushing this app to the top of the store at no cost to my YouTube fanbase but at cost to Apple!" This would give Apple the cover to keep enough commission to cover the attack. Given the known shenanigans played on the app store, this seems less like some bizarre far-out possibility and more like something that would be a routine thing done by sketchier app developers if the terms didn't make it a bad proposition like this.

But in a normal day-to-day transaction, the logic works out in favor of refunding it even if they do nominally have the contractual right to refuse to do so.

<comment><USER17> How would either of those situations (which are pretty much the same) cost Apple _financially_? If 10,000 people buy an app for 1$ each, the creator gets 7000$ and Apple gets 3000$. When they all get refunds. The creator refunds the 7000$ and Apple refunds the 3000$...

<comment><USER18> Apple have to pay some amount (let's arbitrarily say 1%) for processing the payments, so in this example they would lose $100.

<comment><USER19> I doubt Apple rate is this high.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER20> I like that the original tweeter is the one loudly yelling that he was wrong. Too often, people are too proud and ashamed of being wrong to do that.

So kudos to that guy for doing the right thing.

<comment><USER3> I agree.

As it turns out, there is a decade-old issue. Apple has a stipulation in their contract that allows them to do it, but they don't actually do it. He misinterpreted some kind of interaction.

<comment><USER21> I think comments like this are equally as harmful as spreading fake news. The history revisionists/apologists.

Here is the tweet: [https://web.archive.org/web/20200729052623/https://twitter.c...](https://web.archive.org/web/20200729052623/https://twitter.com/twolivesleft/status/1288344977169235968)

Text:

> And this is minor in the scheme of things, but when a customer refunds your > paid app, Apple doesn't refund the 30% cut they took from you

> So you end up owing them money

Absolutely none of that tweet is correct. They don't cite the contract /at all/, they say very matter-of-factly "Apple doesn't refund the 30% cut they took from you" which is 100% false.

Edit: a word

<comment><USER3> _> I think comments like this are equally as harmful as spreading fake news. The history revisionists/apologists._

Be nice. That was uncalled-for.

I'm not a history revisionist, nor am I an apologist. In fact, we may have many areas in which we agree. You immediately, and intentionally, decided to make me an enemy, and I have no clue why.

I'll revise the comment a bit. Maybe that will make it clearer.

BTW: I took responsibility for writing an unclear comment, and fixed it.

 _THAT_ is the kind of thing we need to see more of. It absolutely stinks that people think of every forum in the world as some kind of gladiatorial arena.

<comment><USER21> I would respond but you keep editing your comments to say something different so I don't really see the point but here we go.

I'll just say this, I think you have a pretty warped view of things if being called out of saying untrue things is the same a making someone your enemy or brings to mind a "gladiatorial arena".

I don't hate people or think of them as enemies just because they disagree with me or I disagree with them. If I get called out on bad behavior I reflect and adjust, I don't come out swinging and playing the victim card.

I don't think of you as my enemy, I think of you as someone who said something that I find to be a dangerous way of thinking/justifying and I said as much. Intent matters and the "truth" gotten to by invalid means is a problem even if it ends in "truth" (which again, this tweet did not even meet that bar).

<comment><USER3> Actually, you did respond.

I said I agreed with promptly admitting wrong, which was what the OP was all about. I could care less about the tweet. I revised the comment to reflect what I meant more clearly, after reviewing it, and agreeing with you that it could be interpreted ambiguously.

I also added that there is a legitimate issue, in that Apple has a very broad stipulation in their agreement (did you read yours?), that actually gives them the right to do exactly what the original tweet accused. Even though he was wrong about the facts on the ground, he did actually highlight an issue that has been present since the earliest days of the App Store (more than a decade).

And, yes, you are fighting, which is completely unnecessary. I would bet that, if _you_ (not me) hadn't come out of the gate swinging, we might have found a lot of areas in which we could agree.

I'm actually a fairly decent chap. The chances are even that you are, as well. The Internet tends to bring the beast out in us. I am a reformed troll. I could have _really_ come out swinging, but I don't do that, any more. In fact, as you can easily verify, I attach my name and reputation to everything I post.

In any case, we're done here.

Have a great day!

</comment></comment></comment></comment></comment></comment><comment><USER22> This is a good example of where a strong belief in something (in this case Apple greedily taking a huge cut of developer earnings) that something that sounds patently false is believed automatically and instantly.

Happens with people, companies, religion, and politics.

[edit: I believed it too without thinking]

<comment><USER23> And the thing here is that this tweet contained a single fact that could be disproven with a little additional information. Now try to imagine how many false yet popular beliefs there are in areas like politics or economics where you can spend your entire day counter-counter-argumenting in circles.

</comment></comment><comment><USER24> At the time it made no sense as a business practice, and seemed painful enough that I should have heard about it long before this. My immediate reaction was "really? I'll have to see confirmation before I treat this tweet as authoritative".

What is really amusing in hindsight was the number of people willing to pile on and argue that this was in fact totally reasonable of Apple to be doing and that we shouldn't be surprised or upset at all about it.

<comment><USER25> > _What is really amusing in hindsight was the number of people willing to > pile on and argue that this was in fact totally reasonable of Apple to be > doing and that we shouldn 't be surprised or upset at all about it._

Exactly, while I had doubts about this accusation on Apple, I was surprised about how many people were okay with it. These people (defenders of Apple) vote, but they're not even likely to be Billionaires (it's not wrong to be a Billionaire if you play fair). Why do they defend such an awful practice if it actually happened and wasn't fake news?

<comment><USER13> > Why do they defend such an awful practice if it really happened?

(do you mean "didn't really happen"?)

Controversialists work like that. There is no position in defence of power that people won't argue for, and have a little circle of people cheering them on.

<comment><USER25> > _(do you mean "didn't really happen"?)_

I messed up (just edited the comment to correct), what I mean is in a hypothetical scenario where Apple really did this, why would you defend them?

</comment></comment></comment></comment><comment><USER26> I am disappointed in myself that I believed this information without any evidence. I wanted to believe it because it confirmed and amplified my bias. I hope this gets more points than the first post.

<comment><USER27> There was evidence (chart showing negative income), but it was misinterpreted. What is interesting is that Twitter got a lot of corrections,but HN didn't get a bunch of iOS devs saying "No, this doesn't happen on my app" (at least not in the dozens of comments I read).

</comment></comment><comment><USER28> This will serve me,and many others on HN as a lesson on how easy it is to fall for false information. I did read the related post yesterday and there were lots of emotions, mainly negative. Now I don't even know whether they take the money or not, so I'll put a question mark until proven otherwise for time being.

<comment><USER29> But it isn't false information! It's part of the licence agreement, that Apple chooses to sometimes enforce, sometimes not.

<comment><USER30> If you would've read comments in this post thorough, you would've found it most likely has to do with the payment providers and not apple itself, as there's nothing apple can do in that case (other than pay the difference from their own pocket, but they have no legal requirement to do that). Thus it's not random.

<comment><USER29> > _most likely_

... means maybe.

Apple reserves the right to keep its commission and doesn't attach it to payment processing issues. It can do whatever it wants, and we can only guess.

</comment></comment></comment></comment><comment><USER31> I posted earlier how HN is highly susceptible to both groupthink as well as confirmation bias [1]. Check yourself and ask yourself if what is posted is actually true or is rather something you WISH was true, and also if what is posted is something that you would prefer to go with the herd than to try to run against the stampede. But humans are humans.

[1] [https://news.ycombinator.com/item?id=23846631](https://news.ycombinator.com/item?id=23846631)

</comment><comment><USER32> The scariest part of this for me is "I don't know where I got the idea that it worked the way I thought it did". If it was based off of incorrect sources or whatever I'd understand, but how can you make such a bold claim in a public social medium and forget where the idea came from within 1-2 days?

<comment><USER33> Um this is how twitter works. 280 char limit. Before it was 180. The nature of twitter wasn't ever meant to be taken seriously as a source but current media popularized it by being lazy and sourcing from twitter.

People say all sorts of crazy things there if you follow active users on twitter. They are quick at deleting them too.

I mean there are startups to take screenshots of tweets - [https://pikaso.me](https://pikaso.me)

Should tell you enough.

</comment></comment><comment><USER34> Kind of scary how a random person on twitter can say something and that gets turned into a fact.

<comment><USER35> Imagine the effect if multiple sources were to repeat the same false claim.

<comment><USER36> Imagine it if the available sources were few, and they were all repeating the same false claim.

</comment></comment></comment><comment><USER37> I wonder how many of the upvoters of _this post_ similarly didn't bother fact checking the correction. Not commenting on its veracity, however I think the truth is somewhere in between (Apple has the right to hold onto the 30% commission, but hasn't invoked that in practice yet).

I, for one, upvoted both threads on the basis that this is playing out as a peculiar display of groupthink; a microcosmic martyrdom of truth tellers in the wave of internet points.

</comment><comment><USER38> There is no such thing as a trusted source, and there never has been. Before you act on information, always double- and triple-check, if at all possible. Treating Twitter, of all things, as a trusted source seems especially risky.

<comment><USER39> Treating Twitter as a trusted source is like treating the town square as a trusted source. Treating individual people with a proven track record who happen to be on Twitter (or in the town square) as a trusted source is far more reasonable.

</comment></comment><comment><USER40> > Apple does not keep the 30% commission on a refund

That makes sense. I worked for a big mobile games company and refunds happened all the time.

It was a classic that people will buy in-game items and ask, int our case, Facebook for a refund. They will keep the items and get the refund, until we created a tool to manage refunds and that cheat saw its due end.

As to generate in-game items has zero cost, it was not a loss per se. But it was a lose in potential earnings if it becomes common place. If Facebook has make us pay for their % that would have been a disgrace from the beginning.

</comment><comment><USER41> Occam's razor strikes again.

What's more likely: That Apple has been sneaking a 60% cut under thousands of companies' noses for a decade and they're all super chill with this because of...what, charity? Or that a handful of business owners on Twitter are just not great at interpreting figures?

<comment><USER42> Where did 60% come from? I don't think anyone ever said that.

<comment><USER41> That is what would be happening if both 30% of the purchase _and_ 30% of the refund were coming from the dev's pocket.

</comment></comment></comment><comment><USER43> In response to this earlier post for those that missed it: [https://news.ycombinator.com/item?id=23987584](https://news.ycombinator.com/item?id=23987584)

</comment><comment><USER44> I guess HN is susceptible to the same issues plaguing other online communities. I don't know why I thought it would be different here.

</comment><comment> the-dude Are we sure this is not a babylonic mistake?

Original take was 'customer refund', which I interpreted as a 'chargeback'.

A refund and a chargeback are very distinctive things.

</comment><comment><USER45> The rush to clear Apple's name, and the inflated indignation surrounding this mistake is embarrassing. Tesla is the only other brand where I see this behavior. I don't understand the evangelism of brands by people with seemingly no direct connection. The dude was wrong (Edit: turns out technically he wasn't wrong, Apple just "chooses" to not enforce it), get over it, Apple doesn't need your help - they have an army of attorneys who can squash any legitimate threat to their empire.

<comment><USER46> That's an odd take, I think you are looking at it wrong. IMO, this is the hacker news community getting embarrassed. After all this is a community of entrepreneurs, where everyone has an app and many multiple, on the App Store and so we must have known how it works. No one is redeeming Apple here, if anything I am thinking how easy it is to fall into this groupthink hole and not even bother to check because "we" have to rail against someone because of perceived/alleged wrong doing against the whole community.

<comment><USER45> > this is the hacker news community getting embarrassed

Exactly! Both posts are showing how reactionary and ignorant these supposedly brilliant entrepreneurs & engineers can be. At least on this thread, the second highest voted thread actually explains the issue clearly without hyperbole.

</comment></comment></comment><comment><USER47> Apparently it's still in the developer agreement you have to sign in order to be allowed onto the App Store [1]. Apple can't really blame people for spreading misinformation if the only reason this isn't true is that they usually decide not to enforce the clause.

1: [https://news.ycombinator.com/item?id=23992510](https://news.ycombinator.com/item?id=23992510)

<comment><USER48> It's not misinformation if it's part of the developer agreement.

<comment><USER49> It's misinformation if the clause isn't understood by the individual sharing it.

<comment><USER48> That doesn't invalidate my statement. I made it contingent on the fact that it is in the agreement. You should take this up with OP.

</comment></comment></comment></comment><comment><USER50> How did almost no one on HN fact check this? Groupthink at work?

</comment><comment><USER51> It has been like this since day 1 — the developer agreement says Apple has the optional to retain their 30%, but in practice, I have not heard of anyone hitting it.

</comment><comment><USER52> Lmao! Some guy "thought" Apple doesn't refund the commission and HN and Twitter and reddit had complete meltdown!

As some of the comments point out here, people who tried to correct the claim with data from their experience or cite directly or indirectly Apple, they were downvoted to oblivion.

If HN isn't guarded against fake info, I guess no one should be expected to.

</comment><comment><USER53> Another one who fell for the fake news right here.

Part of me wishes there was a better way to model retractions, corrections, and certainty of claims within social media platforms.

I almost feel like by default a post or tweet should be marked as uncertain/not serious, and in order for someone to mark it as certain, they require some form evidence like a link or a picture.

Then people browsing on the platform should by default only see posts made with certainty unless they manually select to view uncertain or unserious posts.

This might also stop the community backlash when someone says something stupid and people take them too seriously and start a flame war over it.

For those browsing in serious mode, if one user has their evidence discredited too often then they lose privileges and rights on the serious platform.

</comment><comment><USER54> So does Apple keep the 30% or not? It's too much information for my brain to process.

<comment><USER55> They reserve the right to keep it but in practice they do not.

<comment><USER45> This is even worse IMO.

</comment></comment></comment><comment><USER56> It's almost like there was some incentive for someone to spread false information about a company's practices on the eve of a congressional testimony about the company's practices.

</comment><comment><USER31> As a side note, in my experience Paypal does keep their transaction fees even when processing a refund. How does this behavior differ from what people were incorrectly accusing Apple of doing?

<comment><USER42> Three reasons:

1\. Apple has a monopoly on sales of iOS apps. If PayPal does something you don't like, you can leave them for their competitor and still keep providing the same products and services to your customers. If Apple does something you don't like, you need to either put up with it or abandon your iOS customers.

2\. PayPal's fee is an order of magnitude less than Apple's fee.

3\. PayPal usually has actual costs when someone buys and refunds something, since most consumers don't keep a balance in their PayPal account. Apple usually doesn't, since a lot more consumers do keep a balance in their iTunes account (from, e.g., gift cards).

</comment></comment><comment><USER57> People did mention it but then you get all 'citation needed' and get downvoted or plainly flat ignored. So much so the outrage is heard more than the fact.

</comment><comment><USER58> this was believable to me specifically because platforms like audible/kindle actually do this for book sellers. same with payment processors

</comment><comment><USER59> A good lesson to all to fact-check what you read. Especially if your source of news is some random guy on Twitter.

</comment><comment><USER60> When I saw the news yesterday I did think it was fishy because I have never successfully gotten a refund for a broken app store purchase from Apple before. I assumed returns weren't ever given so how could there possibly be a refund commission policy?

</comment><comment><USER61> Glad to be corrected! That would have been a bonkers policy.

Someone quoted an Apple contract that appeared to indicate this was a real Apple's policy, which I also found sourced on TechCrunch: [https://techcrunch.com/2009/03/25/apples-iphone-app- refund-p...](https://techcrunch.com/2009/03/25/apples-iphone-app-refund- policies-could-bankrupt-developers/)

 _> In the event that Apple refunds any such price to an end-user, You shall reimburse, or grant Apple a credit for, an amount equal to the price for that Licensed Application. Apple will have the right to retain its commission on the sale of that Licensed Application, notwithstanding the refund of the price to the end._

But I'm unable to find that on Apple's current site, so hopefully it's been removed. TechCrunch's link to the referenced document is on "docstoc.com" and no longer exists.

</comment><comment><USER62> I am still not happy with the 30% cut though. It is really rather high.

</comment><comment><USER63> I am now ashamed that I upvoted the previous HN submission. I wish I could take back that upvote, but unfortunately too much time has passed since then.

From now on I will be more careful about what I upvote.

</comment><comment><USER64> > I don't know where I got the idea that it worked the way I thought it did

Hold on...so where did he get it? Surely it wasn't a figment of his imagination?

</comment><comment><USER65> Aside from all this I would think a commission on a charge that was then refunded would be illegal in a lot of jurisdictions.

</comment><comment><USER66> The other lesson here is before you blast someone on Twitter, double-check your math.

</comment><comment><USER67> Whenever I try to correct falsehoods here, I get down-voted into oblivion. HN should take a good long look at itself.

</comment><comment><USER68> Love to see fake news upvoted on HN. I figured it was most likely nothing more than Apple hate.

<comment><USER69> Love to see an imperfect, community moderated site calmly admit and accept retractions from people, which is a higher standard than some of the most well known "news"rooms in the country.

</comment></comment><comment><USER70> Ok, now this is funny.

</comment><comment><USER71> Thanks, twitter.

</comment><comment><USER72> _> More than 1000 upvotes on a piece of false information_

Not only upvoting the story but _also downvoting_ posters to minus-12 who tried to counteract it with correct information:

[https://news.ycombinator.com/threads?id=hn_check](https://news.ycombinator.com/threads?id=hn_check)

[ footnote: his profile was -12 at the time I wrote the comment: [https://news.ycombinator.com/user?id=hn_check](https://news.ycombinator.com/user?id=hn_check) ]

[ another edit:]

Sorry for confusion. I wasn't trying to say that _one_ comment got downvoted to -12. His 2 top-level comments ( _" and this submission is just farcically wrong"_ and _" This isn't correct at all."_) ... were at various levels of grey so those 2 comments contributed -4 or -5 or more to the -12. I do agree his tone (especially the [dead] comments) contributed to negative scores but it can simultaneously be true that downvoters thought he was incorrect.

This was how his downvotes looked early this morning: [https://imgur.com/a/GuTffzP](https://imgur.com/a/GuTffzP)

The top-level comments have since been upvoted so they are no longer greyed out.

<comment><USER73> This is scary. And should scare everyone.

We need to remove downvoting temporarily for next 6 months. See how things pan out.

Cancel culture. Dissent and attack on free speech. Smearing of truth. People are afraid to speak up. Chilling effect.

@dang - this is urgently needed. It's raising alarm bells like no other to me.

<comment><USER13> Counterpoint: downvoting is how Hacker News has maintained a comparatively high quality focused discussion while having only one full time moderator. It's not without its disadvantages - certain things will get instaflagged off the front page, especially "sexism in tech" stories. But it's like a firewall. If you don't have one, you get pwned eventually.

Occasionally you get "Boston Bomber" moments, and something true gets downvoted. That is on the poster to figure out why and how to present it in a way that will be accepted.

(I have 60k karma, so I know how to play ranked competitive HN, but even I still get downvoted occasionally if I'm lazy about sourcing or needlessly confrontational)

(edit: first downvote received in less than thirty seconds. Walked into that one, I suppose. Now leaving the edit window at +3. Sorry, +8. You're not really supposed to threadsit your own comments like this, but since we're talking about the voting system I thought I'd mention it)

<comment><USER74> "quality focused discussion"

If you go against the grain of HN on Elon Musk, Tesla, India or the US (and many other topics) then your comment, like this one, is tanking. Which also shows as many regulars from 5 years ago have left, I seldom see someones comments I recognize.

So I do object your argument.

Comments are good to get some opinions on a topic if you dont know about the topic of the linked post. I still read topics therefor.

<comment><USER75> > I seldom see someones comments I recognize.

I was not around for the early days of HN, and I recognize certain posters by their usernames. Here's a few off the top of my head (I am able to give a short description of each, but that's more work than I want to put into this comment). Also note I may misspell since this is from memory: Bytecode-dev, DoreenMichelle, ChrisMarshallNyc, Arathorn. This tends to happen when the person focuses on one topic in their posts, like bytecode-dev and python (and I hope at some point, myself and funding FLOSS, but maybe I comment too widely for that). There's more people; the point is not necessarily that I can regurgitate their names, but that I'd recognize them if I saw them (for example, I'm blanking right now on Drew from SourceHut's username, but I'd absolutely recognize it on sight.

<comment><USER13> Every now and again I wonder whether something like "reddit enhancement suite" would be useful for HN. It probably already exists. The ability to tag usernames with your personal opinion of them and reminders of their place in the community.

</comment></comment></comment></comment></comment></comment><comment><USER76> This is what I suspected the entire time lol.

</comment><comment><USER77> It's misleading either way.

The fact that Apple reserves the right to keep the commission is _very old_ news:

[https://www.imore.com/apple-charging-developers-100-app- refu...](https://www.imore.com/apple-charging-developers-100-app-refunds)

I have heard anecdotes that, at least in some instances, Apple _did_ keep the commission:

[https://developer.apple.com/forums/thread/50181](https://developer.apple.com/forums/thread/50181)

That might of course be an assumption, not based on proper accounting.</comment>


A Java CSV File Reader - <AUTHOR> http://beginwithjava.blogspot.com/2011/05/java-csv-file-reader.html

<comment><USER2> There is more to CSV that splitting a line on commas. [http://en.wikipedia.org/wiki/Comma- separated_values#Basic_ru...](http://en.wikipedia.org/wiki/Comma- separated_values#Basic_rules)

You need to be able to handle values that contain commas, quotes, leading spaces and line breaks.</comment>


Redefining the problem: A trait of great engineers - <AUTHOR> http://blog.opensesame.st/post/44468754048/re-define-the-problem

<comment><USER2> It is perhaps worth pointing out that sometimes, a good way to redefine a problem is to "widen" it, that is, to consider another problem of which the original one is merely a special case. That's been called "the power of abstraction," and it's pretty much what accounts for the amazing success of mathematics. And it seems to work in a broader, less scientific sense as well: for the longest time, I couldn't find a todo-list on the web that I didn't hate. Along came the Trello guys and created a collaboration tool with task lists. And bingo, for the special case of a single user, they (perhaps involuntarily, I don't know) created the most awesome todo-list website.

</comment><comment><USER3> > Great engineers don't solve problems - they redefine them. In other words, > great engineers deftly navigate false premises. This is an invaluable asset > and is far more rare than a productive engineer. It changes the playing > field entirely. If you're not constrained by the problem, the solution can > be far more valuable.

This is actually true of great leaders in general; great engineers just happen to be a specific sort of leader.</comment>


Has Drupal adoption stalled because it's so "enterprisey"? - <AUTHOR> http://drupal.sh/has-drupal-adoption-stalled-enterprise <comment><USER2> In addition to the ecosystem not catching up, the API changes in Drupal 8 meant that anyone who wanted to use it had to learn it all over again. And Drupal is much harder to learn to develop with than Wordpress.

Meanwhile, the PHP framework ecosystem finally caught up with its CMS ecosystem and with other web scripting languages.

Drupal used to be the quickest way to throw together a complex CMS using PHP, but it has scaling issue because of the way it abuses relational databases.

Nowadays if you're willing to learn enough to use it, you're learning large chunks of Symfony anyway. You might as well finish learning Symfony and build your own web app with a sane DB schema. Or you could put that effort into picking up a rapid development framework like Laravel and do the same.

</comment><comment><USER3> Drupal lost devs because Wordpress is easier to work with and has a larger eco system of themes and plugins.</comment>


New Planes That May Change Travel - <AUTHOR> https://www.cntraveler.com/story/new-planes-that-will-change-the-way-you-travel <comment><USER2> These are not newer planes but iterations of existing models. Granted that airline industry is slower in churning out newer planes than say automobile for obvious reasons, but you don't say Nissan is launching a newer car called Altima TTZ.

However, for the sake of the argument if any iterations of these existing planes is worth citing as a "newer" plane then IMO it is A350-1000ULR which is going to operate the longest flights ever from Australia to New York/Johannesburg/London/Brazil [https://www.ausbt.com.au/airbus-mulls-ultra- long-range-a350-...](https://www.ausbt.com.au/airbus-mulls-ultra-long- range-a350-1000ulr-for-non-stop-qantas-flights)

<comment><USER3> The Bombardier C series / Airbus 220 is new. Bombardier only made smaller rear engine jets earlier. There's a really nice video of the advanced carbon fiber wing, made in Belfast. [https://www.youtube.com/watch?v=4aNoA3krV6g](https://www.youtube.com/watch?v=4aNoA3krV6g)

</comment></comment><comment><USER4> The largest piece of the puzzle is air travel has progressively gotten worse over the last few decades since the deregulation of the airline industry, it really doesn't matter than new planes have more space or are more fuel efficient. Airline companies will still pack more people in like sardines and charge for more and more for baggage since their stockholders want it.

<comment><USER5> > The largest piece of the puzzle is air travel has progressively gotten worse > over the last few decades since the deregulation

I challenge this (I have been flying since 1967 and have multiple millions of frequent flyer miles).

I will agree that the typical flight quality of an economy passenger today is worse than it was in the 1970s. But consider:

1 - many more people are able to fly today than could so in the days of regulation.

2 - The market, not the shareholders, has chosen the feature/price point they want: ultra-ultra-low-cost airlines (Ryan/Spirit) don't dominate the market; a plurality of flyers are willing to pay a bit more to get more than _that_ , while attempts at launching higher levels of default service have suffered. So it isn't that people always choose the cheapest (or all we'd have is Spirit). At the same time you can pay more for the full-service experience if you want (business, called first in the US).

3 - The whole experience is safer and more comfortable than it used to be. An original 747 was spacious, but prone to accidents, more stops because there was no long range flights (Sydney-London is 24 hours with one stop now; in the late 70s it was 36 hours with four refueling stops). And the business and international first are a lot more comfortable; business today costs about what coach did in the 70s.

My first flight was on a VC-20 (I have a BOAC junior log book -- signed by the captain of each flight! -- of every flight I took between 1967 and 1975) and I flew 747 in 72 and frankly I'd not want to fly that way again. Oh yeah, planes had smoking sections into the late 1990s (and later in Russia, Korea, parts of Africa, and probably other places I didn't fly).

What _has_ gotten worse is the histrionic rubbish _before_ you board. What a waste of human life the TSA is.

<comment><USER6> I disagree with your contention that the 747 was unreliable, in its first decade of operation it only had 7 hull loss accidents. A comparable number to the DC-10 or A300 - interestingly enough, much more than the L-1011.

I do agree with you completely about the security theater aspects of the TSA

[https://en.wikipedia.org/wiki/Boeing_747_hull_losses](https://en.wikipedia.org/wiki/Boeing_747_hull_losses)

<comment><USER5> Yes, that was a careless mis editing on my part. Thank you for highlighting it.

What I meant to say was that yes, you had more room in a 747, but overall passenger flight safety these days is amazingly high in an absolute sense and a massive improvement over flight safety of the 60s and 70s.

</comment></comment></comment></comment><comment><USER7> > The buzz: Domestic flights that will get a lot comfier in coach

I have been hearing that for a long time with every new airplane that gets introduced. The truth is that coach will always asymptotically suck.

<comment><USER8> While having a guaranteed wider seat is nice, I've never found the width of coach seats to be all that terrible -- it's the lack of leg room, and the airlines continue to have sole discretion on how many rows of seats they'll jam in to these new planes.

<comment><USER9> Seat tilters. That's the biggest discomfort for me. The person in the seat ahead tilting back. If there was a seating section that didn't tilt, I'd take it. I'd even pay a little extra for it.

<comment><USER10> Bulkhead seats. Seatguru is your friend.

<comment><USER11> And when they're already all sold?

Or when, like happened to me, you get involuntarily relocated from the exit row seat you paid extra for? (Without compensation, since it was done by the flight crew during boarding and not in advance. Thanks, Singapore Airlines!)

<comment><USER10> Sometimes it's unavoidable. In your anecdote's scenario, I would perform a credit card chargeback.

</comment></comment></comment></comment></comment></comment><comment><USER12> It isn't mentioned in the article, but I hope the new commuter jets don't sacrifice speed for economy on longer flights... spending an extra 30-40min in the air for the same route is a good reason to choose a 737 instead. You can filter for it on most of the flight aggregators.

<comment><USER13> Can you elaborate on this? Where can I filter for this? I absolutely hate flying, so even saving 30 minutes would be great, if the costs aren't out of control.

<comment><USER12> Both Google and Kayak... and I think most others will let you filter flight legs by length although they usually include layovers, which may or may not be match your weighting.

</comment></comment></comment><comment><USER14> Nothing about Legroom. At 6'5", I'm learning why Dad wanted to drive everywhere. Leave when you want. Take whatever luggage you want. Eat food when you want. No TSA Patdown. No bait n switch airfare purchase meatgrinder.

<comment><USER15> Anything less than 6+ hours or so, it's just as efficient to drive, depending on how big of a circus your airport is. More than that, planes start to be much quicker in transit time. Doesn't really solve the legroom part though.

</comment></comment><comment><USER16> Am I the only one that doesnt really care about quality? I want cheaper flights and thats it.

<comment><USER17> The very price sensitive customers like you are very numerous, but it's the frequent price-insensitive business travelers that make up much more of the industry's profits. So they care much more about the 5 million frequent business travelers, who do care about these things, than they do about the 500 million occasional travelers, half of whom have little to no profitability impact on the airline.

<comment><USER18> I highly doubt it. And do you have anything ti back that up? Because 5 million versus 500 that seems large difference.

Afaik airlines constantly lose money and the only time they make up for the whole year are xmas and national holidays such as thankgiving and independence day. In fact even when you buy xmas time ticket in 2030, it will be accordingly overpriced.

<comment><USER19> Here is a relevant and interesting video about airline classes and pricing: [https://www.youtube.com/watch?v=BzB5xtGGsTc](https://www.youtube.com/watch?v=BzB5xtGGsTc)

</comment></comment></comment></comment><comment><USER20> I liked how enthusiastic this article was that the airlines would outfit their planes with 2x3 seating and wider seats instead of figuring out some way to cram 3x3 seating in there.

<comment><USER6> The aircraft the A220 is replace is about the Size of an MD-90/95 - which I suspect is what its meant to replace, which was also 2x3. 17 inch wide seats are the norm in the industry.

<comment><USER20> Yes, but I never trust airlines not to try to squeeze in even smaller seats when given even a whiff of a chance. And then of course the overhead bins will be insufficient because they were only sized for 5 per row instead of 6...

Pretty much every commuter flight already has an announcement beforehand that overhead bin space will be extra tight and gate checking is available if you don't mind waiting 15 minutes for your bag when you get to your destination.

</comment></comment></comment><comment><USER21> Boeing 787 is a magnificent machine. Pleasure to fly: from bigger windows, to higher humidity, to fuel efficiency, to innovative materials, to arching beautiful wings!

<comment><USER22> How much more does it cost for the bigger window and the innovative material seat?

<comment><USER23> I don't know that the windows add much cost directly - they're just a bonus side-effect from the carbon fiber construction. The innovative materials are for cost _savings_ \- carbon fiber instead of metal means less worry about metal fatigue, which means you don't have to take the whole plane apart as frequently to look for cracks. (Lighter too, which reduces fuel consumption.)

</comment></comment></comment><comment><USER24> > Boom - It'll fly you from Tokyo to San Francisco in less than six hours.

Yes, but that's one of the only routes it will fly. With the Concorde, we discovered that flying supersonic jets around population centers is a big deal-breaker because of the supersonic boom.

Given how _few_ of these routes you can actually fly, I expect Boom will come to the same realization that the airline industry did 20+ years ago; you can't make money on supersonic.

<comment><USER25> US west coast <-> East Asia, and US east coast <-> Western Europe (especially London/Paris) already covers a sizeable fraction of business travel, doesn't it?

Those are basically the four major global economic centers. And among those four, the only link that this service can't provide is Europe <-> East Asia.

<comment><USER26> > And among those four, the only link that this service can't provide is > Europe <-> East Asia.

Really? Most of those routes are either trans-arctic or trans-Siberian.

</comment></comment></comment><comment><USER27> I highly doubt it. I don't see anything different here.

Same old song.

These airplanes run on jet fuel, and require a pair of human pilots to operate. This means that these planes have a high operational cost.

Meaning that the airline companies will eventually cram everyone into the smallest space they can. Everyone will be miserable in economy. But if you upgrade for just $100, then you can get another inch of legroom in economy- plus!

For the Boeing 787 to be bragging about better fuel efficiency.. Well.. so what? That is really irrelevant to me, because I am paying the same amount for the ticket, or more. And they still cram everyone into the maximum amount of misery possible in economy class.

And for the planes that are bragging about being able to fly 20 hours.. Can you imagine the horror of flying internationally in economy? And trying to get some sleep during the flight?

I can. Welcome to our new future of flying. Nothing but misery ahead. Unless of course, you want to splurge a little more on First Class tickets.

</comment><comment><USER28> I'm hoping that VR goggles will change travel ...

<comment><USER29> I'm hoping they give all classes of seats a bare minimum of 35" of leg room/seat pitch. That would be a _huge_ change to air travel.</comment></comment>


Show HN: Postcards from space – latest Sentinel-2 data in your browser - <AUTHOR> http://www.sentinel-hub.com/apps/postcards/ <comment><AUTHOR> I wanted to inform you about a new service that we have established - satellite imagery service based on Sentinel-2 data. It offers 10 meter resolution multi-spectral data on a weekly-biweekly basis (depending on the location), worldwide.

We've built a technology demonstration app to showcase this:

[http://www.sentinel-hub.com/apps/postcards/](http://www.sentinel- hub.com/apps/postcards/)

It gives a full resolution insight into Sentinel-2 data over standard web- browser from any place on Earth for any time satellite acquired the data, in several visualisation options. In a matter of seconds.

A short intro about the technology:

[https://www.youtube.com/watch?v=jOG52oHdtbg](https://www.youtube.com/watch?v=jOG52oHdtbg)

[http://www.sentinel-hub.com/](http://www.sentinel-hub.com/)

For experts, dealing with remote sensing, another app might be of interest:

[http://www.sentinel-hub.com/apps/image-finder](http://www.sentinel- hub.com/apps/image-finder)

where you can browse full archive of Sentinel-2 data on Amazon Public Dataset.

Have fun and let us know what you think!

Best, Matej</comment>


10 Chinese satellites deployed to search for missing plane - <AUTHOR> http://www.scmp.com/news/china/article/1445698/10-chinese-satellites-deployed-search-missing-plane

<comment><AUTHOR> If you see a paywall:

 _" China's defence ministry will redeploy 10 satellites to join the hunt for the Malaysia Airlines jet that disappeared on Saturday with 239 people on board after three days of fruitless searching.

...

Hong Kong's Civil Aviation Department said it had received a report from the crew of a Cathay Pacific plane flying from Hong Kong to Kuala Lumpur at about 3pm that debris was spotted near Vung Tau, off southeast Vietnam.

...

But the location of the debris does not match the path expected to have been taken by Malaysia Airlines flight MH370, which should have flown over Ho Chi Minh City. The location supplied to the Civil Aviation Department was more than 125 kilometres southeast of the original flight path."_

Also in a separate story:

 _" Malaysia Airlines was convicted two years ago for boarding a passenger against the wishes of a foreign government by falsifying passport identity records, it has emerged, and was also prosecuted for a similar incident in 2007"_</comment>


Boiling point - <AUTHOR> http://www.theengineer.co.uk/Articles/310051/Boiling+point.htm <comment><USER3> "But for a few quirks of fate - international depressions and world wars - <USER2> would probably be the main power source for getting us around."

No. The containment requirements for steam, plus recycling the water, vastly outweigh the same for the internal combustion engine.

Flight requires internal combustion, because the power-to-weight of steam is just to low, even though, yes, the raw power of steam engines is generally much higher than internal combustion.

</comment><comment><USER4> It's about the car that broke the steam-powered land speed record.

@ckunte please put a proper title and description in your submissions.</comment>


Did Angry Birds eat the iPad mags market? - <AUTHOR> http://blogs.ft.com/fttechhub/2010/12/did-angry-birds-eat-the-ipad-mags-market/ <comment><USER2> simple enough WIRED om the ipad sucked, thats why the sales dropped.</comment>


Show HN: A tool to see the orgchart of any company - <AUTHOR> https://buildorgchart.herokuapp.com <comment><AUTHOR> Hi everyone, I wanted to share with you my organization charting/ visualization project. I started working on this for an organizational research class, but I though that it could potentially be useful in other scenarios (e.g. consulting or sales) so I developed it further.

Right now the script takes into account mainly the person's job title and the location. Job titles are matched against a library of macro positions, to understand the functional role. Location is normalized and then used to identify offices, countries and regions and group accordingly. These data are then fed into a random forest algo that sketches out a best guess of the lines of reporting.

Hope you guys will find it interesting/ useful and if you have any feedback I'd love to hear!

</comment><comment><USER2> Would love to see it in action by after pressing getting started nothing happens.

Using Firefox on Android

<comment><AUTHOR> Oh that's weird, I'll definitely check! I only tested it on Chrome from pc & mac and is working well. Note: I suggest you give it a go from a laptop, the visualization is not yet optimized for smartphone</comment></comment>


What's new in Rails 4.1 - <AUTHOR> http://coherence.io/blog/2013/12/17/whats-new-in-rails-4-1.html?hn=true

<comment><AUTHOR> The feature I find the most exciting from this write up is the Actionpack Variants.

I work on responsive web application all the time, and my biggest pain point is tablet fitting.

9 times out of 10 I have to manually write the tablet areas and hide the other content in tablet width. Bandwidth wasted!

With this I can create my tablet views easily. :D</comment>


I Traveled the World Hunting for Mutant Bugs (2014) - <AUTHOR> http://nautil.us/issue/73/play/why-i-traveled-the-world-hunting-for-mutant-bugs-rp <comment><USER2> Discussed a bit at the time: [https://news.ycombinator.com/item?id=8234784](https://news.ycombinator.com/item?id=8234784)

</comment><comment><USER3> Sounds like the foreword for Godzilla 1998

</comment><comment><USER4> Too bad he didn't take photos instead. I think we all clicked on the article in order to see some actual images.</comment>


Jury rules for Mark Cuban in insider case - <AUTHOR> http://money.cnn.com/2013/10/16/investing/cuban-verdict/

<comment><USER2> Frontpage article from Miami Herald: [https://news.ycombinator.com/item?id=6562132](https://news.ycombinator.com/item?id=6562132)</comment>


Focus and Drive, Episode 2 [video] - <AUTHOR> https://m.youtube.com/watch?feature=youtu.be&v=n9zwBWv6mN8 <comment><USER2> It started off good... but then at around 8:30+ they started bashing Java which was tolerable until it started to sound like 'Java is dead.' etc. Some of the most interesting applications that solved hard problems such as high availability and fail-safety are written in Java and power the systems used by oil companies, logistics (UPS, Fedex), government (CIA)- you know, mission critical shit that requires a bit more than some node modules and glue code.

</comment><comment><USER3> This could be a great show if there able to get interesting guests. Seinfeld & Deadmau5 both have podcasts like this and driving around gives the show some interesting visuals. The audio needs to be higher quality.

<comment><USER4> Thanks. Going to figure out tweaks for the audio. Still learning.

</comment></comment><comment><USER5> Strange to see famous bloggers (Jeff Atwood) "IRL".</comment>


Best Customer Complaint Letter Ever - <AUTHOR> http://www.greenpointnews.com/news/3354/an-open-letter-from-eugene-mirman-to-time-warner

<comment><USER2> I recently moved from NYC to SF. While I'm sure there isn't much love for Comcast here, either, I had a much better experience with them than I ever did with Time Warner. I called Comcast the day I moved in and told them I had my own router. They told me to connect it and it worked...I had internet access! After dealing with TWC for 10 years, this seemed like a miracle. It's sad how low my expectations had gotten. TWC would insist on sending a tech to your apartment (I won't get into the appointment time windows they propose and deliver on) to connect two cables before they turned on your internet. Anyways, this letter brought back some bad memories.

<comment><USER3> I can pretty well assure you that comcast customers deal with the same type of BS as time warner customers deal with having dealt with both. What surprises me is how different the level of service can be for the same provider in different regions. My experience with comcast in Minneapolis makes me want to frame my receipt from when I finally got rid of their service but I couldn't find anything bad to say about the service I received from comcast while I lived in Salt Lake City, not just the people but the reliability of my cable and internet as well as the superior software for the digital cable boxes and DVRs.

<comment><USER4> I wonder if it has anything to do with who they bought their infrastructure from when they moved into a market. For example, in my area Comcast took over from AT&T, and broadband immediately went from Not Available to Hell Yeah.

</comment></comment></comment><comment><USER5> Come on. Do your homework, this is the best customer complaint letter ever: <http://www.derbygripe.co.uk/ntl.htm>

I mean, it's legendary. As a former NTL customer, I can say that it's quite plausible too.

It's no co-incidence that they both revolve around telcos doing installs. It's also worth noting that NTL does not exist any more. It has been subsumed into the Virgin group and the NTL name is not used any more. What part this viral piece of writing played is unknown, but it must have done something.

</comment><comment><USER6> _This is a paid advertisement_

What do you suppose this is an advertisement for?

<comment><USER4> Time Warner.

</comment></comment><comment><USER7> This one isn't quite a complaint, but it's my favorite corporate customer service exchange. The logical gymnastics are brilliant and hilarious. Enjoy: <http://www.27bslash6.com/blockbuster.html>

Update: This one might be even better: <http://www.27bslash6.com/overdue.html>

</comment><comment><USER8> I liked the Ayn Rand reference. She's one of my favourite philosophers.

</comment><comment><USER9> What's wrong with short-form improv? I happen to like it!

</comment><comment><USER10> Reminds me of that legendary post on Craigslist, the one where the guy is trying to get rid of cinder blocks that are on his property.

Can anyone locate where that is? I think a screenshot exists of it.</comment>


Find a name for your startup with The Thousand-Sided Dice - <AUTHOR> http://ksided-dice.com

<comment><USER2> Link does not load

<comment><AUTHOR> Interesting. I just tried it with a couple of different proxies and it worked for me. Do you get an error message?</comment></comment>


3 Ways to Build a Brand for Your Personal Blog - <AUTHOR> https://medium.com/@RadixRegistry/3-ways-to-build-a-brand-for-your-personal-blog-50bb5d999e61 <comment><USER2> I Also want to Do my Personal Blog thanks for the suggestion</comment>


Celebrating Dart's birthday with the first release of the Dart SDK - <AUTHOR> http://google-opensource.blogspot.com/2012/10/celebrating-darts-birthday-with-first.html <comment><USER2> Has anyone built something that illustrates Dart's features or made a neat web app with it? Can it handle graceful degradation from running in a browser which natively supports Dart to a browser which requires JS compilation?

<comment><USER3> > Has anyone built something that illustrates Dart's features

Take a look at: <http://synonym.dartlang.org/>

> or made a neat web app with it?

We're getting there. People are starting to build frameworks and libraries, and there are a bunch of sample apps floating around. The language itself is still changing pretty quickly, so it's most amenable to early adopters. As things get more stable, I think we'll start to see more apps.

> Can it handle graceful degradation from running in a browser which natively > supports Dart to a browser which requires JS compilation?

Yes. There's a canonical stub .js file that you add a script tag for on your page. That will detect whether or not the browser supports Dart and pull in either the native Dart code or the compiled-to-JS one as appropriate.

With this, you can write an app that any browser can hit and it will do the right thing.

<comment><USER4> AJAX commands are still shown as:

        var xhr = new XMLHttpRequest.getTEMPNAME(

Hasn't this been changed per <http://code.google.com/p/dart/issues/detail?id=2584> ?

</comment></comment></comment><comment><USER5> Dartisans (video) episode covering the release: <https://developers.google.com/live/shows/7702017-1001/>

</comment><comment><USER6> We're using AngularJS on a large project, and although we haven't looked deeply at Dart yet, I still have a ton of questions in regard to their future compatibility, potential overlaps, roadmaps, etc. I've seen some message group posts about this, but there was nothing definitive and the core groups don't seem to collaborate at all (please correct me if I'm wrong).

<comment><USER5> You'll probably want to see Dart's Web Components[1] work. I suggest you direct any questions over to the mailing list[2].

[1] <https://github.com/dart-lang/dart-web-components>

[2] <https://groups.google.com/a/dartlang.org/forum/#!forum/misc>

</comment></comment><comment><USER7> SDK looks cool to play with; tools are definitely where its at with this.

Dart (currently) doesn't seem to have any compelling use cases.

If people make tools with in build refactoring and other nice features that make _productivity_ a compelling use case, maybe Dart has a chance to grow~

Still, given the tools that already exist for working on JS, there's still a long way to go before this will be enough to drag javascript developers over to dart...

</comment><comment><USER8> A more sensibly Lisp-y Javascript with a closer eye to performance. I like it!

</comment><comment><USER9> Please save us from JavaScript, google.

<comment><USER10> I agree with the sentiment. However, I hesitate to embrace Dart, after Google killed off a huge number of APIs earlier this year. Go seems to have much more traction at Google so I think it is safe, but Dart still has an experimental feel to it. I'd like to hear a long-term commitment from Google to Dart before I really jump in.

<comment><USER11> From what I see, Go is not really meant for web development. I think Google's real bet on web and general app development will be Dart, as Go looks more like a C++ replacement. Also from the project page, I see like 80 people are committing to Dart so that sounds pretty promising ( <https://code.google.com/p/dart/people/list> ).

<comment><USER12> Go is certainly meant for the _server-side_ of web development, but I guess the phrase web-dev is often intended to mean client-side only.

</comment></comment></comment></comment><comment><USER13> I don't get it why they make it so difficult to get the source code.

TypeScript:

        typescript.org
        click "Get the source code"
        click "Download"

Dart:

        dartlang.org
        click "Download now"
        click "Check out" the source code
        click PreparingYourMachine
        wget http://src.chromium.org/svn/trunk/src/build/install-build-deps.sh
        bash install-build-deps.sh
        install 32-bit dev libraries
        svn co http://src.chromium.org/svn/trunk/tools/depot_tools
        export PATH=$PATH:`pwd`//depot_tools
        install jdk 1.6
        gclient config http://dart.googlecode.com/svn/branches/bleeding_edge/deps/all.deps
        gclient sync

Seriously just to get the source you have to run two downloaded programs, any linux besides Ubuntu requires extra work, and even still it comes with some pre-built 32-bit binaries which apparently are compiled as part of another project. It's madness.

They say it's so complicatd because Dart is part of Chromium, but Firefox has a direct hg link -plus- hg bundles (repository snapshot).

<comment><USER14> That's not how you get the source, that's how you prepare for building the whole project, including the VM, compiler, etc. If you just want the source code, just

svn checkout <http://dart.googlecode.com/svn/trunk>

That isn't terribly easy to find, though, it's true (you either have to have used google code before and know it's on the "checkout source" page or dig through those "get and build" instructions for just the "get" part).

The rest is just dependencies (and daunting at first, but pretty simple after you do any chromium work). You have to deal with the same thing if you check out Firefox and you want to build it (gclient here becomes bootstrap.py there).

<comment><USER13> Thanks for the help. I see now you can get the URL by using the source browser then clicking 'checkout' to get the svn checkout URL.

I just wanted to check out the source, but setting up an Ubuntu VM to isolate gclient and that other nonsense was way too much work.</comment></comment></comment>


Ask HN: How does SEO work on the darknet? - <AUTHOR> <comment><USER2> I don't think it ever got past Yahoo style kinda directory ca. 1995 to having a decent search engine</comment>


Over 500k Zoom accounts sold on hacker forums, the dark web - <AUTHOR> https://www.bleepingcomputer.com/news/security/over-500-000-zoom-accounts-sold-on-hacker-forums-the-dark-web/ <comment><USER2> "These credentials are gathered through credential stuffing attacks where threat actors attempt to login to Zoom using accounts leaked in older data breaches. The successful logins are compiled into lists that are sold to other hackers."

This feels like ridiculous piling on to Zoom. This comes down to the same old password reuse issue. You could almost certainly replace any other service provider with Zoom in that article and not reduce its accuracy. Pounds for pennies, other services have hundreds of thousands of accounts being sold courtesy of credential stuffing.

<comment><USER3> Can service providers not realize that someone is trying millions of different accounts with patterns of passwords and throttle or block them?

<comment><USER4> Cred stuffing can often be done with 5 or less "known" passwords used by the victim. When the attackers have enough IPs (via proxies or cloud providers - remember that most cloud providers give out multiple ipv6 /64s no questions asked), It'll end up looking like any other login attempt from a consumer VPN where the user forgot their password and is trying 3 or 4 different ones.

<comment><USER3> I would think you alarm when login failure rate spikes. Realize what is going on, list the probably affected accounts, and lock those accounts until they change their passwords. Doesn't seem like an impossible to mitigate problem.

</comment></comment></comment></comment><comment><USER5> So they paid $1000 for 530k accounts. What's the use case of a stolen zoom account? To impersonate an institution this doesn't seem quite enough, so is it just lulz?

<comment><USER6> If those accounts belong to an org with SSO enabled and mediocre security, that's a win for the crooks.

<comment><USER7> Huh? It's not like Zoom offers an SSO solution. The value of the accounts is two-fold:

1) Looking for Zoom premium accounts, there is actually a pretty good trade in stolen accounts on the dark web. Folks will pay a dollar for example for one of these accounts.

2) This is the more likely one—looking for people who use one shared password across multiple valuable logins.

<comment><USER8> SSO is offered at the "Business" plan level. So I guess the question would be how many of the stolen accounts were for users at a lower plan level but were also controlled by espionage-worthy companies.

<comment><USER9> You can authenticate with Zoom using your existing SSO solution, not the other way around. When using SSO the Zoom account wouldn't have a password at all.

<comment><USER10> Exactly. I'm surprised there are accounts from large companies that must have some sort of SSO with MFA solution. Are they not using it with Zoom? That's a no brainer

</comment></comment></comment></comment></comment></comment><comment><USER11> This is particularly concerning for those in China. Keep in mind over 1,000 Chinese hospitals now use Zoom, as detailed in the Feb 26th blog post by CEO Eric Yuan[1].

If anything, I suspect this has less to do with hacking and more with insiders abusing their access to the system. Chinese hackers are very often extremely competent day time programmers, and have been known to sell their internal access to the highest bidder[2].

[1] - [https://blog.zoom.us/wordpress/2020/02/26/zoom-commitment- us...](https://blog.zoom.us/wordpress/2020/02/26/zoom-commitment-user-support- business-continuity-during-coronavirus-outbreak/)

[2] - [https://intrusiontruth.wordpress.com/2019/07/25/encore- apt17...](https://intrusiontruth.wordpress.com/2019/07/25/encore-apt17-hacked- chinese-targets-and-offered-the-data-for-sale/)

</comment><comment><USER12> Link to the first linked thread -

[https://www.nulled.to/topic/1049984-x352-zoom-accounts- with-...](https://www.nulled.to/topic/1049984-x352-zoom-accounts-with-capture- meeting-idurlhostype/)

</comment><comment><USER13> Damn, Zoom can't catch a break.

</comment><comment><USER14> Accounts were exposed in previous hacks, the accounts are now being exploited if the user didn't change the pw credentials and used the same email address.

Nothing in this suggests this is Zoom's fault (except that they might be able to check haveibeenpwned and warn users)

</comment><comment><USER15> The amount of FUD appearing everywhere around zoom ensures that google, Facebook, Microsoft, etc. are very very annoyed by their success

<comment><USER16> Genuinely curious, How does this particular report amount to FUD?

<comment><USER17> It's accounts that were found by testing user/passwords that were found in other hacks to see if people had used same password on zoom. It's nothing zoom did wrong. And, it's something that happens to basically every company.

<comment><USER18> Arguably in 2020 it _is_ something Zoom did wrong in allowing people to re-use known passwords.

"Reject Pwned Passwords" is a very cheap security improvement during sign-up processes. Of course the problem for Zoom is that they've focused very hard on reducing "Bounce" where people decide they'd rather not sign up, which has led to a lot of the other complaints about Zoom we're also reading.

If you run a service that has an email + password type sign-in, the top TWO items I'd tell you are must haves for that service today - as in if you aren't live they need to be requirements for go-live and if you're already live they should be top of your pile are:

1\. Sign-in-with-X services that out-source authentication entirely to somebody else, it doesn't much matter if it's Facebook, Google, Apple, almost anything is better than creating yet another service with yet more credentials. These services are relatively low friction. Zoom does offer this, and if you must have Zoom (as many of us must in this period) then this is the least worst option.

2\. Blocking known passwords with something like PwnedPasswords. If you must build your own account authentication either out of hubris or with some genuine rationale for why it's necessary, use PwnedPasswords or a similar service to reject these passwords. Don't have stupid "policies" that sounded good to some idiot who still thinks regular expressions are a pretty neat idea, just reject these known bad passwords.

There are lots of more expensive things I think companies _should_ do if they take security seriously, like implementing WebAuthn (ie FIDO security keys) but the above two are low hanging fruit. If you haven't done them it _is_ something you did wrong.

</comment></comment></comment></comment><comment><USER19> Zoom is the Windows XP of video conferencing and the most secure approach to video is now to get on a different platform.

<comment><USER20> Competitors to Zoom, for example, WebEx, have even more vulnerabilities than Zoom. Count the CVEs on cve.mitre.org. The small players haven't been poked as hard.

<comment><USER21> Not disputing that WebEx is worse, but CVE counting should never be a metric for security.

</comment></comment></comment><comment><USER22> Jeez! I hate being forced to use this stupid thing but i hope they can fix their issues asap.

<comment><USER23> Care to explain how this is "their" issue?

<comment> yjftsjthsd-h They didn't cause it but could have stopped it (via HIBP or such) which I grant isn't very damning).</comment></comment></comment>