Cosmos Browser – Connect to the Internet via SMS, no data or wifi required - <AUTHOR> https://github.com/ColdSauce/CosmosBrowserAndroid <comment><USER2> Guys, really, that is an awesome idea, especially when it comes to several countries in the world that limit the access to data. This data doesn't necessarily require multimedia, sometimes its all about access to basic information like dates for demonstrations, or other political topics and things like that. This could be really hand for hundreds of thousands of people who are just not informed and kept silent by their governments. Think about that when implementing. There is a not-so-small audience out there.

Do not get discouraged by all those people who are telling you that its too expensive. Those guys are sitting in behind a high-speed access and don't seem to look beyond the horizon, that sometimes its not about getting 2GB across with SMS (really? ... I mean... REALLY?!), its about getting basic access to information. Not every country is as awesome as the US or Europe in this world. Not everyone is free. And not everyone uses the internet the way we seem to got used to it.

Keep up the great work, its an awesome idea. For sailors, for people without access to internet, for quite a bit of an audience we like so much to forget. Keeping it open and turning down VC firms is even better.

GREAT JOB!

<comment><USER3> Combined with twitter, it can be really powerful for broadcasts.

</comment></comment><comment><USER4> They're using Twilio. Each SMS they send costs them $0.0075.

However, simply stripping the junk out of web pages for mobile delivery has real promise. Just put all third-party content on "load on user request only", like mail attachments.

<comment><USER5> Stripping down webpages for mobile is an old idea -- google used to do it by default when you clicked a link from the search page on your phone.

<comment><USER6> Opera and Opera Mobile had (have?) it as an option too. It was pretty effective and included resizing and re-encoding/compressing JPEGs IIRC.

</comment></comment></comment><comment><USER7> Just for context, these guys turned down significant VC money recently in favor of bootstrapping/remaining open source.

Kudos!

<comment><USER8> can you qualify significant? 100k USD ? 1m USD? Just looking for a round number here.

<comment><USER9> undisclosed. :)

</comment></comment></comment><comment><USER10> I had a browser (WAP) on my Nokia 7110 that supported browsing via a SMS bearer; 1999. I tried it once and got billed up the wazoo, SMS was expensive back in those days.

<comment><USER11> There was also WIG. I was writing WAP sites in '99, incurring pretty large bills while developing and testing. The company had a very close relationship with the mobile company so fortunately we just got them written off.

</comment></comment><comment><USER12> I don't see this could EVER be economical. Even wholesale SMS (not Twilio/Plivo/Nexmo/Etc) can still cost $0.001 / SMS. There is simply no way they can operate the proxy/gateway profitably.

<comment><USER13> at least in the UK, it's fairly easy to get "unlimited" texts (for some values of "unlimited", of course)

US pricing for texts seems much more extortionate, for some reason..

<comment><USER14> Unlimited SMS is common in the US too: But that's not really "unlimited" like you'd want to run a service of this scale. 3 messages/second is way too small. You could only host a single client per relay that way. The right way to do this is to not involve an SMS plan, and connect to a proper SMS gateway, which won't be "unlimited" at all.

</comment></comment></comment><comment><USER15> A big problem to solve is that SMS is notoriously bad at delivery. You may have SMS's dropped for weird reasons, and delivery reports aren't exactly reliable.

<comment><USER16> Isn't this notionally true of IP as well?

<comment><USER17> Yes but delivery is guaranteed by TCP, which is the layer above IP. In this scenario, SMS is "above" TCP in the stack, so unless they add ACKs to their system (which would be pretty prohibitive when every text costs money), dropped SMSs would break their system.

<comment><USER18> Instead of an ACK text, maybe an MD5 hash could be sent as part of the message. If the MD5 mismatches with the concatenated text message stream then you know you have a dropped or corrupted packet.

Unfortunately that does introduce additional complications like knowing which packet failed (maybe there's a better method for checksuming for this type of situation?), but even in the worst case scenario, it only adds a small overhead to infrequently resend the entire stream than to double up each stream with ACK responses.

<comment><USER19> You wouldn't want to use MD5 specifically because it would take up 32 characters of your message, but a simpler checksum might work.

<comment><USER18> MD5 was more a proof of concept than a design specification. However 32 characters is only 1/5 of an SMS so it's not beyond the realms of a practical (albeit lazy) fix.

Ideally though, you'd be right that something more concise would be preferable.

</comment></comment></comment></comment></comment></comment><comment><USER20> One market you might not have considered: sailors. Out there on the water its very slow and expensive to be online.

Any cuttings in data transfer have a huge return in less costs and faster replies.

The few options out there are focused on email and expensive. To get an idea: sailmail.com offers email-only SSB (single side band) for $250 / year.

<comment><USER21> Are there any advantages of using SailMail versus WinLink over HF? I can't say I'm significantly familiar with either system, but at first glance they appear to offer similar functionality, with of course the latter requiring an Amateur Radio license.

<comment><USER20> The main difference are the costs. WinLink is free but is only accessible with a Amateur Radio license.

</comment></comment></comment><comment><USER22> So this seems stupid.

SMS is the most expensive data service on the planet. It costs more per byte to send SMS then it does to send data to Jupiter (factoring in the space ship you had to launch there to receive it).

WhatsApp's _entire business model_ is based on the fact that SMS is just stupidly expensive.

<comment><USER23> My cellphone plan gives me unlimited SMS but only 2 gbs of data. If unlimited really means unlimited, then my data comes to me for free (assuming I was going to keep my sms package regardless, which I am).

<comment><USER24> Unlimited never means unlimited. It means the seller of the service _thinks_ there's an effective limit to what most customers can consume and he thinks he can provide more than that for a flat price.

This generally works out well until people figure out creati e ways to consume levels of service beyond the effective limit -- then the service provider is oversold, and it's either underdeliver or invest in living up to new demand (probably financed with a price increase).

<comment><USER6> See also "salad stacking".

[https://www.yandex.com/images/search?text=salad%20stacking](https://www.yandex.com/images/search?text=salad%20stacking)

</comment></comment></comment></comment><comment><USER25> Very insteresting, but...

 _The backend takes the url, gets the HTML source of the website, minifies it, gets rid of the css, javascript, and images, GZIP compresses it, encodes it in Base64, and sends the data as a series of SMS 's._

This is yet another interesting idea that will get screwed up in practice because of massive overreliance on JavaScript in modern web development. This is why developers should do progressive enhancement. There are _a lot_ of thing that are possible with declarative markup that are not possible or not safely feasible with imperative code, which generates things on the fly.

<comment><USER26> This is not necessarily a problem, see for example [http://phantomjs.org/](http://phantomjs.org/)

Google also shows javascript-only content in search results now.

<comment><USER25> Running arbitrary JavaScript on your server will likely cause performance, security and compatibility problems. It's not practical at large scale, and it's not something that would "fix" all the use-cases anyway.

Also, very few companies and no individuals will have the same technical capabilities as Google with it's horde of developers, years of experience in the domain, billions of dollars and ability to control everyone's visitor stream. They shouldn't be the only company that can effectively innovate in this field.

</comment></comment></comment><comment><USER27> This is awesome!

Here in Brazil internet on mobile is expensive and limited, and the SMS is easily found free and unlimited. This project can potentially improve mobile Internet here.

Remember me the Opera Mobile case that was largely used in Africa where 3G was too much expensive. I remember to saw in some news that Opera brought digital inclusion to many African countries with their browser that basically shrink the requested pages at server side before sending to the phone.

I don`t know about the speed and reliability, but at least, it would be a option.

</comment><comment><USER28> May I ask why you're encoding as Base64? Does this not increase the payload size significantly?

<comment><USER29> Probably because of the restricted character set available in SMS messages?

[http://en.wikipedia.org/wiki/GSM_03.38](http://en.wikipedia.org/wiki/GSM_03.38)

<comment><USER30> Right, but with the GSM 7-bit alphabet they could easily expand their index table to 127 entries rather than Base64's 64, netting them much greater efficiency.

</comment></comment></comment><comment><USER31> > gets rid of the css, javascript, and images

Hell, this might even be faster than loading stuff over WiFi.

</comment><comment><USER32> I guess this only works if you have a cell phone plan with unlimited SMS. Otherwise you're looking at a phone bill of thousands of dollars!

<comment><USER33> In what countries do carriers charge for receiving messages? I know there are a few in Canada, but what else is there?

<comment><USER34> It's standard practice in the US if you don't have a texting plan, or if you exceed your limit. Sending and receiving both count equally.

<comment><USER35> On most plans offered in the US nowadays texting is included. All of the T-Mobile, AT&T, Verizon, Straight Talk, Republic, etc plans have unlimited texting included.

<comment><USER34> That's pretty recent, though, and a lot of people are still on older plans. Still, it's good they're finally gaining some sanity there.

</comment></comment></comment></comment></comment><comment><USER36> One app the HN crowd may not be so aware of is UC Browser.

UC Browser aggressively optimises for page size by cutting out javascript and sending out only 10 kb segments at a time.

I owned an old Nokia feature phone and used to browse the internet all the time almost as if I had a smartphone with a good internet connection.

On slow 2G connections here in India UC Browser can be a god send.

But there are privacy risks.

<comment><USER7> This one is similar in that it strips out all JavaScript, CSS, and attributes, essentially stripping down pages into simple documents.

</comment></comment><comment><USER37> Question: Why is this called a "browser"?

Is it a web browser? If so, then I don't see the point. Why not simply write some kind of driver that does IP over SMS; then _any_ app that uses the net could connect that way.

(And if it isn't a web browser, then why "browser"?)

<comment><USER38> We were limited to 36 hours for the hackathon we made this at. It is an actual browser. We will continue developing it to make it fully functional.

<comment><USER37> Well, I'm sure this was a nice achievement, and no offense intended, but that doesn't make sense. You were limited to 36 hours, and therefore, instead of simply writing a driver, you wrote a driver _and_ and entire web browser sitting on top of it?

<comment><USER39> Probably just the familiarity with the tools. They knew how to write an Android app, but not a driver.

<comment><USER37> Yes, that makes sense.

But we might take it as a negative comment on the modularity or ease of configurability of the environment supported by Android (or, more generally, by Linux).

</comment></comment></comment></comment></comment><comment><USER40> Interesting approach. I wonder if this HTTP-specific approach is better or worse than coming up with some form of generalized TCP-over-SMS stack (with accompanying server-side router software, of course).

Reminds me, though, of Georgia Weidman's Smartphone Pentest Framework[1] which provides tools to hack a target smartphone and from there create a data connection via SMS via which you can then access a firewalled corporate network using SMS over the cell network as your tunnel in. I've seen it demoed, and it's frankly incredible.

[1] [https://github.com/georgiaw/Smartphone-Pentest- Framework](https://github.com/georgiaw/Smartphone-Pentest-Framework)

<comment><USER41> SCTP might be more interesting because it was originally created for telephone switching with fixed packet sizes.

</comment></comment><comment><USER42> Coming up with new ways of compressing data to travel down legacy or fundamentally anti-functional data channels (i.e. low bandwidth, low quality of data, high latency, preprocessing that destroys the majority of the experiencial data) is always a fun hack, but is never a marketable strategy for a few reasons.

\- It bets on technology going backwards rather than forwards (i.e. will have cheap android phones with cheap data plans before you can scale it)

\- It doesn't provide much more than novelty self promotion. "Hey i made a webpage deliver via SMS"

\- Its usually more expensive and time-consuming to produce what almost always becomes an inherently inferior product.

<comment><USER43> Now, let's take those 3 points and consider a 3rd world country with interwebz-censorship or very poor infrastructure and no forseeable future where it'll improve to anywhere near what most first-world countries have. Cellphone coverage is the easiest thing to setup in those kinds of environments.

<comment><USER44> Do you have any examples of such countries where at the same time SMS will still work and be cheap enough to be viable?

Even most countries in sub-Saharan Africa has at least GPRS - most of them have 3G. Some of them are deploying LTE. Certainly there will be areas where for some time still there will still be limited data access, but the question is how many of those areas actually has functioning cell coverage.

</comment></comment></comment><comment><USER20> You could sell this in a prepaid kind of way ? 30 webpages for USD 1 or something. So I would first have to buy credit and then each requested page is deducted from my credit.

Assuming the user has to other internet access, you could offer access to the login / payment / info pages for free. However, you do need some secure sms payment option. I believe all current sms payment options are operator dependent. A huge business in Africa if I recall correctly. An independent version might be another opportunity ;-)

</comment><comment><USER45> In germany unlimited sms has only been a thing since ip based messengers like WhatsApp took over messaging and nobody is using SMS anymore, before that SMS were quite expensive after you hit the budget of your contract (typically about 50-100 SMS). Now, unlimited SMS is the norm and things like this browser get interesting. But even if it would be a great working alternative, it will only work until carriers adapt. I really want unlimited data...currently i get 750MB with a contract that costs EUR 50.

</comment><comment><USER46> I'm not sure how badly I want to find out just how unlimited "unlimited texting" is, especially at 0 extra cost a month. Of course it's included in the price somewhere, but I can't turn it off to pay less. Suddenly receiving thousands of text messages a minute after hardly using sms for years doesn't sound like a great idea...

Calling my number and using the good old dial-up method sounds much more efficient actually. Isn't the bitrate around 128kbps in normal calls?

<comment><USER47> In most parts of the world, POTS is 64 kbit/s, over which you can reliably run a 56 kbit/s modem. Cell phone audio uses less bandwidth, but I can imagine that you could get 8 kbit/s or more reliably, compared to the SMS data rate (7 bits/char * 160 chars/msg * 3 msg/sec = 3.4 kbit/s).

<comment><USER44> GSM data used to be 9600 bps back in the day when you'd connect a separate GSM modem. A full data rate raw GSM channel is less than 13kbps, and you'll lose some to signalling.

</comment></comment></comment><comment><USER48> I wonder if they could do some intelligent parsing of the content and just return a plain text version of what the user requests. It wouldn't work for everything, but for things where there are articles with a defined "content" it shouldn't be too hard.

In fact, isn't that what the "read it later" type apps do? I'll bet there is a free js library that already does the detection or you.

</comment><comment><USER49> Now port this to J2ME and make a lot of people happy.

</comment><comment><USER50> we did similar thing in Intuit India, check out [https://play.google.com/store/apps/details?id=com.intuit.txt...](https://play.google.com/store/apps/details?id=com.intuit.txtweb.android&hl=en)

We have a platform that enables access of internet services over sms, i did the android app which enables accessing all the content offline as well.

</comment><comment><USER51> Awesome app. I was thinking about something like this recently for a niche.

I was going to ask how you direct the SMS to the app, but taking a quick look at the src, it seems the app reads the sms inbox, looking for the specific phone number?

I guess this means that:

\- the user sees alerts for the incoming sms?

\- the user needs to delete (does the app/could the app do that?)

Great stuff, really interesting. Thanks for sharing it.

</comment><comment><USER52> I'd do the jquery function .text() on a page, spaces and new lines with a max sequential occurence of 1 and would send that through in markdown (to get some layout).

The browser contains same basic stylesheets and the user can change this (h1,h2,p,...)

Keep the link functionality with # (for single page apps) somehow, for links {{the text}{the link}} could be used.

Strip everything else.

</comment><comment><USER53> Why not do it using audio modem software over a phone call ... might be able to reach higher speeds - approaching 56kbps??

<comment><USER54> The cost of sending data over phone calls would be probably much much higher than sending SMS

<comment><USER53> Agreed it normally would be more expensive. Although I'm on a plan that gives me a few hundred minutes of talk time per month that I don't come anywhere near to using.

</comment></comment></comment><comment><USER55> Has there a been an attempt to use the phone's audio connection with a (software?) modem to replicate dial-up?

</comment><comment><USER56> In terms of saving on data, I think Opera Mini [0] is a good compromise. They compress the hell out of the page and images (there's even an option to strip images away), but they don't mess with the layout.

[0]: [http://www.opera.com/mobile](http://www.opera.com/mobile)

</comment><comment><USER57> I think this is an interesting proof of concept; it seems like the exact opposite of WhatsApp, which is based on the concept that data is cheaper than SMS.

I know that SMS plans are often "unlimited" in the US, which is why (at least from what I've seen) WhatsApp is far more popular in Europe.

</comment><comment><USER58> SMS isn't going to get good bandwidth, given the path it uses over the mobile network.

But I've thought about building HTTP-over-WhatsApp. Mobile providers here offer prepaid contracts where you don't pay for WhatsApp access, regardless of your balance or traffic remaining.

<comment><USER59> Something similar has been done using Facebook chat (looks like it's Linux- only currently) - [https://github.com/matiasinsaurralde/facebook- tunnel](https://github.com/matiasinsaurralde/facebook-tunnel)

</comment></comment><comment><USER60> Sounds like something RMS would like ;-) [https://stallman.org/stallman- computing.html](https://stallman.org/stallman-computing.html) (Old page ctrl-f "I am careful in how I use the internet")

</comment><comment><USER61> It reminds me of Google SMS: [http://theinnovativeeducator.blogspot.com/2009/03/using- goog...](http://theinnovativeeducator.blogspot.com/2009/03/using-google-as- educational-tool-right.html)

</comment><comment><USER62> Would this allow users to circumvent internet censorship? It seems like that as long as the main server was outside of the censored zone, SMS traffic would be able to get information in under the radar.

<comment><USER5> Maybe, but I would think you'd be much better off with a proper VPN or proxy.

</comment></comment><comment><USER63> Love it. A few q's: all traffic on your servers is plain open? "The phone recieves this stream at 3 messages per second", how about upstream? How much data (kb) fits on each message?

<comment><USER64> SMS is 140 bytes (160 7-bit characters), but if they're using base64, then they're only getting 120 bytes through.

</comment></comment><comment><USER65> Could you achieve a more high throughput version over voice? I wonder, after compression what the data rate ends up being. I'm reading gzip can get 2:1-4:1 with text. So about a kb/s?

<comment><USER66> I may be wrong but aren't we going backwards here... data over voice=dialup right? 56kb/s ideal? Still possibly useful but this just reminds me of the wep browser days on my old nokia

<comment><USER44> 56kbps _over landlines_. That works because the landline network, when it is trunked, is compressed into 56kbps or 64kbps channels using methods the 56kbps modems were explicitly designed to take maximal advantage of.

Over a cell phone connection you will get much less. GSM data modems gets to bypass the voice codec, and are still limited to 9600 bps. An acoustic modem over a GSM connection will get less than that, if it will connect at all: A full data rate GSM code is compressing the audio down to about 12.2kbps using codecs geared towards reproducing voice as well as possible, which is going to be brutal to a regular modem and far more wasteful than GSM data.

</comment></comment></comment><comment><USER67> Reminded me of this thread about Smozzy from 3 years ago: [https://news.ycombinator.com/item?id=2976764](https://news.ycombinator.com/item?id=2976764)

</comment><comment><USER68> Just thinking about some of the comments I've written into my JS and how many text messages it would take to deliver them.

Text messages are free to deliver these days right?

<comment><USER69> Well the second paragraph on the site specifically says:

>The backend takes the url, gets the HTML source of the website, minifies it, gets rid of the css, javascript, and images[...]

<comment><USER68> That's me told.

</comment></comment></comment><comment><USER70> What about using MMS?

<comment><USER71> MMS goes over data on smart phones, right?

<comment><USER72> It has always gone over data, even on dumbphones. Sometimes it uses a separate APN though, and can be billed differently.

</comment></comment></comment><comment><USER73> This would be really awesome as emergency internet access if twitter/facebook/google/etc did or were optimized for it.

<comment><USER74> Emergency internet for twitter/fb? :)

<comment><USER75> It's becoming common for Twitter to used for updates and coordination in disaster zones. And I guess if I wanted to let my friends know I was safe in such a situation, and didn't want to text them all, Facebook would be a good choice.

</comment></comment></comment><comment><USER76> I had considered doing something similar (to avoid roaming charges). I'm very happy someone else did it for me!

</comment><comment><USER77> Wow, this is like the mobile era's acoustic coupler :D what's not to like about something that weird?!

</comment><comment><USER78> Even at good compression, 420 chars/sec is a little frustrating...

Still, major admiration from me for getting that to work!

</comment><comment><USER79> Was this developed during MHacks?

<comment><USER80> Yes lol. I was at MHacks when this was debuted. Were you there as well?

</comment></comment><comment><USER81> Really awesome hack and can't wait to see what you guys do to improve it!

</comment><comment><USER82> Try zip-txt.com for a similar idea ...

</comment><comment><USER83> lynx --dump

Would be an optimal way of encoding the return.

</comment><comment><USER84> Is this designed with rural parts of africa in mind?

<comment><USER71> That's one application.

</comment></comment><comment><USER85> it's the return of slipknot

</comment><comment><USER86> I've actually been working on a side project related to this since about 2006.

Currently I have a working email-based proxy server, with Browse (HTML to email), Translate, Base64 Download, and Base64 upload.

I send the URL in the email's subject line, and Google App Engine fetches the page and replies to the sender. Base64 uploading is sent via POST to a PHP script on an OpenShift web server.

Email to SMS is also possible via gmail2sms (their blogspot is in Russian, but it's legit, I promise). That uses Google App Engine to copy emails to Google Calendar, which sends SMS event notifications for free. You need to authenticate your number first though.

I'm still missing some features though. Originally my purpose was to use SIP (e.g. Jajah, Voipcheap: Betamax services) to dual-dial a payphone and another phone number for a 5 minute free trial call. I almost got that working in early 2013, but ended up being banned by most Betamax services.

The other is how to initiate communications. I found a hack that allows me to send email for free while on prepaid 3G roaming with zero balance. There was another hack before that allowed me to receive email as well, but the website's format changed and it's no longer working. Also, most people just want me to have a "normal" local phone number instead of using my Google Voice SMS-to-email.

I've learned a lot about web technology through this ongoing project, though. Now I can code PHP and Python, browse using Elinks, script using Expect, and more.

On a meta-level though: is it worth it? Internet access is basically used for just a few purposes: \- Information recall (Wikipedia) \- Maps (Google Maps) \- Communication (Email, Facebook, Twitter, Skype, etc) \- News

The first two can be completely offline using Wiki2Touch (7.5GB text only Wikipedia) and Galileo (1 GB map of Taiwan). It's only communication and news that change often, so I need to access them.

I can get news through FM radio (does anyone still use that? I'm pleased to have it on my Sony MW600 Bluetooth remote).

Facebook and Twitter have email APIs. Skype doesn't. WeChat, WhatsApp, KakaoTalk, QQ, LINE, and all those other chat apps are terrible for their lack of standard APIs. Why can't we all just use instant messaging that's compatible with email or Jabber? For the same reason, these apps aren't available on my Raspberry Pi.

The Cosmos Browser's SMS gateway doesn't provide communication links, just HTTP GETs of static pages. Pages that I can save offline beforehand.

Congratulations to the developers for some impressive coding, but I can't yet find a killer app for this. And we should all switch to simple email instead of those pesky chat apps.

Peter

</comment><comment><USER87> screenshots. thanks.

</comment><comment><USER88> We're definitely on the way to practical implementations of RFC 1149.

[http://tools.ietf.org/html/rfc1149](http://tools.ietf.org/html/rfc1149)

</comment><comment><USER89> mhacks!

</comment><comment><USER89> Mhacks!</comment>


YC Is a Network Effect Business (2014) - <AUTHOR> http://blog.eladgil.com/2014/09/yc-is-network-effect-business.html <comment><USER2> All startups are network effect business. The unfortunate side effect of this is that brilliant startups in third world countries wither and die in spite of having accomplished more technical progress

Some of the yc companies are technically inferior to their competitors but they are more successful due to the network effect.

Eg we use both yc flexport and their competitor freightos. Freightos is much easier,has API, is automated and is real time with much more choices. We ended up integrating with freightos</comment>


Ask HN: How is Google's ping time so good? - <AUTHOR>

I was surprised at how much better ping times to google.com are compared to other high traffic sites (facebook, twitter, yahoo, etc.) from Bangalore, India.
round-trip min/avg/max/stddev google.com: 8.990/10.943/16.533/1.501 ms,
yahoo.com: 262.387/331.857/465.871/47.595 ms,
facebook.com: 239.865/299.477/420.529/37.281 ms,
twitter.com: 298.604/349.843/474.227/38.724 ms
I did a traceroute to see what's happening. The path to google seems to be: Bangalore(India) --> Chennai(India) --> Mumbai(India) --> Mountain View(US) --> Atlanta(US) --> New York(US)
And the path to facebook seems to be: Bangalore(India) --> Mumbai(India) --> Marseille(France) --> Paris(France) --> Hong Kong --> New York(US) --> Tokyo(Japan) --> Milpitas(US) --> Singapore --> Ashburn(US) --> Dulles(US) --> Forest City(US) --> Dublin(Ireland) --> Forest City(US)
What's with the world tour for facebook? Is it that google has a dedicated link that allows it to establish a direct route and the others don't? What do the routes from other countries to google/facebook look like? <comment><AUTHOR> Traceroute results:

$ traceroute google.com traceroute: Warning: google.com has multiple addresses; using 188.8.131.52 traceroute to google.com (126.96.36.199), 64 hops max, 52 byte packets 1\. 192.168.0.1 (192.168.0.1) 1.533 ms 1.153 ms 1.013 ms -- 2\. 10.255.0.1 (10.255.0.1) 1.717 ms 2.914 ms 1.784 ms -- 3\. 83.20-broadband.acttv.in (184.108.40.206) 2.449 ms 2.801 ms 2.746 ms -- 4\. 83.26-broadband.acttv.in (22.214.171.124) 3.813 ms 4.653 ms 5.501 ms -- 5\. 83.26-broadband.acttv.in (220.127.116.11) 2.532 ms 2.613 ms 1.976 ms -- 6\. 83.20-broadband.acttv.in (220.127.116.11) 2.301 ms 2.880 ms 1.645 ms -- 7\. 83.20-broadband.acttv.in (188.8.131.52) 2.098 ms 2.694 ms 2.213 ms -- 8\. 18.104.22.168.static-bangalore.vsnl.net.in (184.108.40.206) 3.568 ms 5.841 ms 4.543 ms -- 9\. 172.31.19.245 (172.31.19.245) 9.177 ms 23.144 ms 10.812 ms -- 10\. * * * -- 11\. 22.214.171.124.static-chennai.vsnl.net.in (184.108.40.206) 11.077 ms 9.071 ms 31.422 ms -- 12\. 126.96.36.199 (126.96.36.199) 10.181 ms 10.293 ms 11.180 ms -- 13\. 184.108.40.206 (220.127.116.11) 23.763 ms 11.805 ms 9.806 ms -- 14\. 184.108.40.206 (188.8.131.52) 11.000 ms 10.502 ms 10.207 ms -- 15\. maa03s16-in-f0.1e100.net (126.96.36.199) 10.094 ms 12.126 ms 9.764 ms

$ traceroute facebook.com traceroute to facebook.com (18.104.22.168), 64 hops max, 52 byte packets 1\. 192.168.0.1 (192.168.0.1) 3.454 ms 0.944 ms 0.979 ms -- 2\. 10.255.0.1 (10.255.0.1) 1.968 ms 2.600 ms 1.629 ms -- 3\. 83.20-broadband.acttv.in (18.104.22.168) 2.190 ms 1.998 ms 2.361 ms -- 4\. 83.26-broadband.acttv.in (220.127.116.11) 7.346 ms 5.842 ms 19.984 ms -- 5\. 83.26-broadband.acttv.in (22.214.171.124) 4.139 ms 2.908 ms 2.478 ms -- 6\. 83.20-broadband.acttv.in (22.214.171.124) 1.722 ms 1.625 ms 1.871 ms -- 7\. 83.20-broadband.acttv.in (18.104.22.168) 3.061 ms 3.283 ms 2.019 ms -- 8\. 188.8.131.52.static-bangalore.vsnl.net.in (18.104.22.168) 15.204 ms 9.908 ms 6.517 ms -- 9\. 172.29.250.33 (172.29.250.33) 21.912 ms 21.407 ms * -- 10\. 126.96.36.199 (188.8.131.52) 25.536 ms 21.772 ms 21.697 ms -- 11\. 188.8.131.52 (220.127.116.11) 31.452 ms 34.547 ms 38.371 ms -- 12\. * * if-9-5.tcore1.wyn-marseille.as6453.net (188.8.131.52) 134.437 ms -- 13\. if-8-1600.tcore1.pye-paris.as6453.net (22.214.171.124) 140.244 ms 139.780 ms 139.931 ms -- 14\. if-2-2.tcore1.pvu-paris.as6453.net (18.104.22.168) 132.315 ms 139.273 ms 136.092 ms -- 15\. ae-7.r04.parsfr01.fr.bb.gin.ntt.net (188.8.131.52) 136.365 ms 139.886 ms 135.689 ms -- 16\. ae-5.r02.parsfr02.fr.bb.gin.ntt.net (126.96.36.199) 242.899 ms 331.461 ms 307.212 ms -- 17\. ae-5.r22.amstnl02.nl.bb.gin.ntt.net (184.108.40.206) 149.954 ms 151.609 ms 150.101 ms -- 18\. ae-0.r23.amstnl02.nl.bb.gin.ntt.net (188.8.131.52) 145.721 ms 145.091 ms 147.451 ms -- 19\. * * * -- 20\. ae-2.r06.asbnva02.us.bb.gin.ntt.net (18.104.22.168) 226.761 ms 262.790 ms -- ae-2.r05.asbnva02.us.bb.gin.ntt.net (22.214.171.124) 270.623 ms -- 21\. ae-3.facebook.asbnva02.us.bb.gin.ntt.net (188.8.131.52) 263.718 ms ae-4.facebook.asbnva02.us.bb.gin.ntt.net (126.96.36.199) 317.167 ms 244.475 ms -- 22\. be2.bb02.iad3.tfbnw.net (184.108.40.206) 374.290 ms 305.458 ms 244.194 ms -- 23\. ae12.bb03.frc3.tfbnw.net (188.8.131.52) 268.062 ms ae17.bb03.frc3.tfbnw.net (22.214.171.124) 307.678 ms 307.757 ms -- 24\. ae2.dr09.frc3.tfbnw.net (220.127.116.11) 270.561 ms ae1.dr09.frc3.tfbnw.net (220.127.116.11) 245.850 ms 241.323 ms -- 25\. * * * -- 26\. * * * -- 27\. * * * -- 28\. edge-star-shv-12-frc3.facebook.com (184.108.40.206) 240.828 ms 281.591 ms 307.277 ms

</comment><comment><USER2> I'm not positive, but last time I tried, when I ping www.google.com, I end up hitting a machine on my ISP's class B network, which likely means that the traffic never their own network. I'm assuming this is some kind of transparent proxy that serves static content (images, CSS, JS, etc) locally for "free" and sends all of the dynamic requests to Google.

I don't have a calculator in front of me, but even taking the maximum latency of 16ms, I suspect that your proposed route is a longer distance than light could have travelled.

Edit: 186 miles/millisecond according to google

Edit 2: I love this story [http://www.ibiblio.org/harris/500milemail.html](http://www.ibiblio.org/harris/500milemail.html)

</comment><comment><USER3> Google run a global reverse proxy style caching service "Google Global Cache", this is where they provide servers at no charge to ISP's and direct bandwidth heavy traffic to these machines for the ISP's IP ranges, typically when this first came out they were just hosting the Youtube and local Maps traffic locally.

However about a year ago they actually started to service the google.com domain from these machines, therefore that will explain the better ping response, and if you do a WHOIS on the IP range or look at the source ASN you will probably find it's your ISP and not the Google network.

Akamai and Netflix offer some very similar services to ISP's if your interested in reading a bit more about it, specifically for Akamai they host a lot of the Facebook images and Apple updates/images traffic from these machines in your ISP network.

</comment><comment><USER4> I might not be as precise as I've wanted, but I've taken a class where my professor mentioned that Google has their own physical infrastructure, thus achieving such low latencies for requests in general.

I'm aware that this info is not as precise as one would want, so I'd love to read comments on this!

<comment><USER5> Google has many more colocation sites across the world. The closer their gear to you, both physically and logically (peering fabrics/agreements), the lower the latency between you and them.

</comment></comment><comment><USER6> Yes, it's pretty much that simple. Google has terabits of dedicated bandwidth capacity and datacenters located all over the world. Fewer hops and a shorter physical distance to the server = lower latency.

</comment><comment><USER7> For Facebook, ping "static.ak.fbcdn.net"; it's their Akamai CDN, and it's probably much better than the main hostname.</comment>


HTTPS (SPDY) is faster than HTTP - <AUTHOR> http://www.httpvshttps.com/

<comment><USER2> This website is basically a fancier version of [https://http2.golang.org/gophertiles](https://http2.golang.org/gophertiles)

While cool, both websites are making an unfair comparison to the way that HTTP/1.1 is normally deployed for such sites, as neither demo uses hostname sharding.

</comment><comment><USER3> I noticed that for https in chrome the images load (mostly) in order, whereas for http they're loaded in random order. However in firefox both cases load in order.

Why does chrome load resources in random order in http?

</comment><comment><USER4> [https://news.ycombinator.com/item?id=8682883](https://news.ycombinator.com/item?id=8682883)

<comment><AUTHOR> As the one who submitted this link... I'm curious why HN didn't simply point me to the original post? Sorry for double-posting :-\

<comment><USER4> Had you used an identical URL, it would have. Beyond that, we leave the dupe detector fairly weak so that good stories have multiple chances to get attention.

Better duplicate detection is one thing we hope to work on fairly soon.

</comment></comment></comment><comment><USER5> Firefox HTTP: 3.239 s Chrome HTTP: 11.209 s It cheated...

<comment><USER3> In chrome I get http: 3.2-3.9s, https: 1.8-2.6s. Try it a couple more times, maybe it was a fluke.

Edit: And for firefox: http: 2.6-3.8, https: 2.9-3.8.

Edit2: Changed times to ranges.</comment></comment>


Ask HN: Question about commision on ideas bought to the business. - <AUTHOR>

I work for a dev company and i spend most of my time doing dev for other clients, I came up with the idea of a new service/web application and i offered it to the business, I just want a cut from the profit generated by the service. The development time will probably be split 30% in between jobs 70% personnal time. My boss doesn't want to give me a percentage or anything at this stage, he wants to discuss reward once the service is up and running if at all. Am I unreasonnable to expect this to be sorted out before hand? and how much will you expect your percentage to be in this situation? <comment><USER2> Does your boss have the authority to even sign a contract? The problem is you've intertwined your work. They can just say you were doing as part of your salary and they didn't OK you working on it in your free time so you don't get paid for it. My guess is you'll probably just get a couple grand bonus that won't even add up to minimum wage for the extra time you put in and that's only if it works out.

</comment><comment><AUTHOR> The boss is the ceo, so yes and I haven't started the project yet and am trying negotiate. This service is viewed as a separate to my work. I was going to work on it myself but tried to use it as leverage for a pay adjustment which didn't really happen which is why i am now after a percentage.

</comment><comment><USER3> I'd expect 100%.

Why involve the boss? Why not just release it on your own? If your boss has good leads to send you, you can have him sign up to your affiliate program.</comment>


Tell HN : 3 years ago, I recorded christmas songs - <AUTHOR> http://dagniel.bandcamp.com/album/dagniel-joue-nowel-2006

<comment><AUTHOR> I began with "JingoBelle" I thought I could do a beautiful version on the piano, but things didn't turn out well, listen to the end of the song...</comment>


Welcome To The Unicorn Club: Learning From Billion-Dollar Startups - <AUTHOR> http://techcrunch.com/2013/11/02/welcome-to-the-unicorn-club/ <comment><USER2> People starting their own startups are not likely to get anything useful out of this article. There is little to "learn", as the link-bait title suggests, from a statistical analysis of billion-dollar companies.

There were, however, a few somewhat interesting takeaways amid the difficult- to-read mess:

The average founding age is 34.

80% of founders have started a company before.

Only 2 out of 39 have any female cofounders.

The billion+ startups are pretty evenly split into free, freemium, paid, and enterprise only pay structures.

Someone correct me if I'm wrong, but everyone I recognize on the list is a software-only company.

<comment><USER3> >Someone correct me if I'm wrong, but everyone I recognize on the list is a software-only company.

Palo Alto Networks is a high security network infrastructure maker: [https://www.paloaltonetworks.com/products/platforms/firewall...](https://www.paloaltonetworks.com/products/platforms/firewalls/pa-5000/overview.html)

</comment></comment><comment><USER4> 39 is a tiny sample, to be quite honest, especially since the selection doesn't include erstwhile competitors who failed.

I've found studies of _failures_ to be more illuminating. There are far more of them and you can draw more reliable conclusions as a result.

Consider for example _Billion Dollar Lessons_ by Carroll and Mui. They are able to demonstrate, from a large, methodologically-selected sample, that most of the B-school grand strategies of the 1980s were disastrous.

<comment><USER5> Exactly. The problem with this sample is the same as In Search of Excellence - you can see what the good companies do, but what makes them unique? You can correct for it somewhat by adding comparison companies that failed, but the real thing to look for is very similar companies that had divergent choices at the same point in time, with _everything being equal up until then_. This is why VC and management is an art, not a science. :-)

<comment><USER4> > _This is why VC and management is an art, not a science. :-)_

Granted, but that said, Tetlock showed that in at least one very messy problem domain (international geopolitics), embarrassingly simplistic linear models crush expert judgement in terms of predictive power.

The problem is that the world is still sufficiently unpredictable that you can't use this insight to turn a buck, since events get "better" or "worse" with about the same frequency.

I reviewed Tetlock's book here: [http://chester.id.au/2012/07/29/review- expert-political-judg...](http://chester.id.au/2012/07/29/review-expert- political-judgement/)

And I heartily recommend it to anyone.

<comment><USER6> _embarrassingly simplistic linear models crush expert judgement in terms of predictive power._

This is true in the vas majority of cases (andecdoctaly). But the inflection points are the subject of this essay. The analogue in _internatinaly geopolitics_ , would be 9/11 and the ruthless pursuit of anti-civillian warfare. Which nobody predicted, and which <gamed> the theory of linearity[1] to maximize its damage.

[1] eg, the "expert" advice: 'go along with the hijackers', this has been empirically shown to be the safest/smartest course of action, etc

<comment><USER4> You'd find that book interesting. One of Tetlock's (many) findings is that almost everyone overpredicts outlier events. That is, we expect large deviations to occur far more often than they usually do. This is especially true of the "Hedgehogs", but "Foxes" do it also.

<comment><USER6> This is interesting, but their are two possible ways to read this: (1) Overdiagonoses; (2) Actual Bias. They are quite different in character.

An actual bias would be (for example) poor people taking unfair bets. We know they will dis-regard odds and buy lottery tickets that are negative NPV.

An overdiagnoses migh be something else altogether. If i know dis- proportionate rewards accrue to being "first" or early, I will overdiagnose. This is a variant of strategic precedence (to infer seniority, status, or special priveledge). This goes buy other monikers, like offensive "land grab" or the more defensive "lick the cookie" tactic.

In any event, the con is just a trick to manipulate someone who has linearly locked on a path (biased or not). However you feed them the bait, your goal is to get them to believe they do not need to revise their priors.

</comment></comment></comment></comment></comment></comment><comment><USER7> Ok, I don't read TechCrunch that often, but leading a story with a giant unicorn picture that literally takes up the entire screen on my 13" MacBook Air, such that all of the meaningful content is not even on the screen is really terrible design. I wish that design trend would go away like yesterday.

</comment><comment><USER8> "Few companies are the result of a successful pivot."

I balance this statement against the notion of many incubators, whom I know/understand to focus heavily on the founding team more so than the idea. While the statement isn't damning in that respect, it does suggest that there's quite a bit more to success than just the people involved.

Incubators aren't necessarily trying to fund the next billion-dollar idea, but I'm not sure the statement doesn't apply to all companies, regardless of exit valuation.

<comment><USER9> Couldn't Twitter be considered a pivot from Odeo?

<comment><USER8> I'm not familiar enough with the history of Twitter and Odeo to say one way or the other.

</comment></comment></comment><comment><USER10> So a few things:

It seems obvious that some types of companies (like entreprise) that have been started in 2010 are not going to be valued at >$1b yet. It takes time.

This information would probably be more valuable if you cut it up by area (consumer v entreprise etc) and did comparables inside those areas.

"Started since 2003 and valued at $1b or over by public OR private markets"

To me, those are completely separate ways of valuing a company - one is realized (in that anyone who owns shares outright can sell them for the value stated) and the other is purely speculative.

It doesn't matter that Fab is "worth $1b" especially as it heads towards the toilet bowl over the last 10 months.

Again, companies valued at >$1b on private is an interesting group to look at, but trying to compare it to public doesn't strike me as very useful.

The one thing this article does is tell me that it's hard to hit $1b realized or unrealized. But I don't think anyone thought otherwise, no?

</comment><comment><USER11> It's missing several companies I can think of off the top of my head, including the one I work at.

<comment><USER12> Such as...? Enumerating would be more helpful.</comment></comment>


Show HN: Django SQL Explorer - <AUTHOR> https://github.com/epantry/django-sql-explorer

<comment><USER2> This looks great numlocked! Excited to give it a whirl.

I spend a lot of time writing intranet CRUD apps and these kinds of tools can be really useful to give your users access to the raw data so they can export to csv & do their own analysis in Excel (or whatever their tool of choice).

Thanks a bunch for open sourcing it!

<comment><AUTHOR> Glad you'll find it useful! One thing I've found really nice is the having the SQL and the query results right next to each other means that data is somewhat self-documenting. Even for consumers of the data who aren't fluent in SQL, most of the time they can pick out what fields and filters are being applied which cuts down on the back and forth of "wait, what is that field _exactly_ " that you get when emailing CSV files back and forth.

</comment></comment><comment><USER3> This is pretty cool. It's kind of funny how after all the admin interfaces and fancy forms, people always end up wanting to just write their own custom SQL.

On the security front, the SQL blacklist definitely has to go. It's a false sense of security (ex: string concat + dynamic execution gets around it). The suggestion to use a read only user is a good one but even better is to use a read only database (ex: a Postgres replication slave).

Have you checked out JackDB? ([http://www.jackdb.com/](http://www.jackdb.com/) _full disclosure: I 'm the founder_) It's a full featured database client that runs entirely in your browser.

<comment><USER4> +1 to read only, fortunately databases are very good at enforcing this thing, unfortunately the users of databases generally less so.

RE: circumventing the blacklist, I think immediately of accessing a function with postgresql aka select my_destructive_function();

<comment><AUTHOR> Yep, no disagreement there :)

The blacklist has no chance of defending against malicious users. Luckily (at the moment) we are using this purely internally and the blacklist is really just preventing people from shooting themselves in the foot. We're moving to a read-only user role shortly, and the suggestion to go with a read-only db is a great one.

</comment></comment></comment><comment><USER5> Are you able to login as different database users?

I would love to try using this with Schemaverse ([http://schemaverse.com](http://schemaverse.com)) but most frameworks I have seen have trouble with multiple database roles/connections.

<comment><AUTHOR> Yep - you sure can. I haven't released it to PyPi yet, but it's committed to master and tested. You just have to override this setting:

        EXPLORER_CONNECTION_NAME

And give it the name of the django connection you want to use. We are in the process of moving from Heroku Postgresql (which only supports a single DB user) to Amazon RDS Postgres specifically for this capability. It will ensure that users of SQL Explorer have read-only access (something that is currently enforced by a SQL blacklist - a risky approach)

<comment><USER5> Neat, thanks for the info! I will have to give this a try then.

Luckily, I don't need to care about read-only or blacklisted queries, the entire application is already built into the database layer.

<comment><AUTHOR> Gotcha - in that case you'll want to turn off the blacklisting feature which you can do by overriding a setting. It's all documented in the readme :)

Unfortunately there is NOT currently a way via configuration to allow the general public to access queries - it's locked down the Django admins by default. But it's just a matter of removing some view decorators to change that. Maybe something for me to add in a future version...

Anyway, let me know if you need any help.

</comment></comment></comment></comment><comment><USER6> Looks interesting, been thinking of implementing one for our product (jvm based). I might consider a port, though not sure how much effort it would take.

Thanks!

<comment><AUTHOR> Thanks! For what it's worth, this is heavily based on Stack Exchange's Data Explorer (in terms of functionality - not implementation). I'd estimate it took me 60 hours to build the Django version, to the point you see in github.

</comment></comment><comment><AUTHOR> Hey there HN - over the last few weeks I wrote this Django app to help share data across our start-up (ePantry.com). It's our first significant open source contribution, and I hope some folks find it useful. I'd love to hear your feedback.

<comment><AUTHOR> And I should mention this is _heavily_ inspired by Stack Exchange's Data Explorer (which is credited in the readme file). We used an implementation of Data Explorer at my previous company (shout out to HN user moserware who came up with that idea) and it was a fantastic way to quickly share data and answer questions. We would wonder how a particular site metric was performing, and an engineer could quickly post a link to a query in hipchat - and we could talk about real data quickly instead of speculation.

<comment><USER4> will be taking it for a spin!

Another tool, different, but also great for sharing, you may enjoy: [http://htsql.org/](http://htsql.org/)

<comment><AUTHOR> I took a look at this before I undertook building SQL explorer, but it looked like overkill and I didn't want to learn a new query language and introduce a learning curve to every employee who might write queries. But it does look fairly full featured. Have you used it? Is it low-friction enough that people _want_ to use it?

<comment><USER4> I have used it.

Adoption was good especially for simple queries, people were less focused on the language, and more focused on exploring/modifying examples.

For people who are already familiar with SQL and as you said, less interested in the query language, it may be almost immediately frustrating.

I can absolutely see circumstances where it would be overkill, I have never tried to use it as a performance critical tool, just as more an easy thing to slap on to ease access, two aspects that I have found useful on more than one occasion:

1\. HTRAF toolkit is convenient for very basic visualization (depending upon the audience this can be very useful to have at hand quickly)

2\. multiple output formats (json in particular) has been helpful in terms of quickly hacking together prototypes in the past

</comment></comment></comment></comment></comment><comment><USER7> Wow this is going to save me so much time!!!!!!</comment>


Final – A credit card built for the 21st century - <AUTHOR> https://getfinal.com/ <comment><USER2> Here's a list of the most common ways credit cards leak, from security journalist Brian Krebs:

-Hacked main street merchant, restaurant...

-Processor breach...

-Hacked point-of-sale service company/vendor...

-Hacked E-commerce Merchant...

-ATM or Gas Pump Skimmer...

-Crooked employee...(Most frequently committed by restaurant workers)...

-Lost/Stolen card...

-Malware on Consumer PC...

-Physical record theft [from] Merchant, government agency...

[https://krebsonsecurity.com/2015/01/how-was-your-credit- card...](https://krebsonsecurity.com/2015/01/how-was-your-credit-card-stolen/)

So of Krebs' top nine sources of leaks, Final addresses at most three. No thanks!

UPDATE: Re the downvotes, Maybe someone should tag posts about YC companies so we know when it's unacceptable to engage our critical faculties.

<comment><USER3> Why are we even taking time to critique startups like this when 9 out of 9 of these problems are already solved with cryptocurrencies that have been around for 10 years? I struggle to see why this is even a product at all?

<comment><USER4> Unfortunately mainstream consumers still love credit cards, and think "Bitcoin" is some sort of criminal activity.

<comment><USER5> Unfortunately, if you look at real usage patterns, they are not completely wrong either. At least from the POV of a mainstream non-technical person not visiting obscure meetups but reading newspapers.

</comment></comment></comment></comment><comment><USER6> I had early access to this but passed on it after I read more about it, specifically:

Annual Fee: $0 intro for the first year, $49 per year thereafter

And

Earn 1% cash back on all purchases

So you have to spend $5000 on this card just to break even and then I'm still only getting 1% back. As someone who has never really had an issues with my CC which averages me 2% back and is free and I can't start to justify this. I use Simple Bank and love the UI (mobile/web) and this UI looks nice but with Simple I didn't have to leave money on the table to switch over to it (or at least not how I use it).

<comment><USER7> Yeah, I'm not willing to use a card with an annual fee. I already have a card with none, and 1% cash back. I'd consider using a card with less cash back if I liked the services enough, but I'd never pay a fee for a card.

That said, I _do_ really want disposable card numbers; I've missed that service ever since Amex discontinued their version.

<comment><USER8> This is helpful feedback, thank you.

</comment></comment></comment><comment><USER9> This is called a [https://en.wikipedia.org/wiki/Controlled_payment_number](https://en.wikipedia.org/wiki/Controlled_payment_number) and Bank of America (among others) has had it since the 20th century (16 years ago[1]).

[1][http://www.prnewswire.com/news-releases/mbna-introduces- the-...](http://www.prnewswire.com/news-releases/mbna-introduces-the-mbna- shopsafesm-service-to-protect-online-shoppers-against-credit-card- theft-74993102.html)

<comment><USER10> Great. Where can I sign up for this service, outside of Final? Bank of America is not an option (see: 2008).

<comment><USER11> Is Citi an option? :)

</comment></comment></comment><comment><USER12> Been using this card for a few months.

Re folks saying it's been done before, it makes me think of the William Gibson quote "The future's already here, it's just not evenly distributed."

Even if it has been done before (I have no idea) -- if something makes a new tech _available_ to many more people, it's effectively new to them.

In terms of using the card, my wife and I have found it useful. It feels empowering to give the card to a service/person and know you remain in control. Yes, all cards let you do chargebacks, or recover from fraudulent charges, but I don't want to have to fight to recover my money.

I love the feeling of using a number and knowing no other charges can come - that number can never be used again.

This card is empowering.

<comment><USER13> > Even if it has been done before (I have no idea)

I had this idea myself, I Googled it and found nothing. Visa has 3D Secure (which is really just a text-delivered OTP), but implementing the standard is completely optional. I've only come across it on a handful of websites.

Pity it's US only for now.

<comment><USER14> I think the more relevant functionality is called in France "e-carte bleue" : [https://fr.wikipedia.org/wiki/Paiement_sur_Internet#La_e- car...](https://fr.wikipedia.org/wiki/Paiement_sur_Internet#La_e- carte_bancaire) (Sorry, only in French).

You generate a fake card number, this number is linked with an expiration date AND a maximal amount that can be charged.

<comment><USER15> The quality of the service varies between banks though, I remember my previous bank who forced me to go over a sketchy-looking website and use a Flash applet to generate the card...

AFAIK it's not possible to create a card with a monthly chargeable maximum amount, only to set the total amount for the card's lifetime, which limits the interest of the use for recurring payments.

</comment></comment></comment></comment><comment><USER16> > Tired of your monthly yoga pants subscription? Or a two-week "free" trial > that lasted four months? Just deactivate that card number. It's that easy.

This is a pretty useful feature. But does it run afoul of some mysterious rules that allow recurring charges to continue[1], when you have a tradtional card cancelled and reissued under a new number?

From[2]:

> Thanks to some under-the-radar rules that work out in favor of vendors who > charge recurring card fees, most credit card carriers allow a "recurring > indicator" to be included in vendor/customer credit card transactions. In > layman's terms, that means there are data bytes in your credit card payment > DNA that allows companies to bypass credit card expiration dates and keep > charging you anyway, even if your card has expired.

> Worse, there are loopholes in credit card regulations that enable vendors to > get new credit card information if the old card was closed due to fraud, or > even if you switched cards for a better rate. In either case, the recurring > charges continue.

[1] [https://uncrunched.com/2012/08/01/recurring-credit-card- char...](https://uncrunched.com/2012/08/01/recurring-credit-card-charges- horror/)

[2] [http://www.nasdaq.com/personal-finance/pull-the-plug-on- recu...](http://www.nasdaq.com/personal-finance/pull-the-plug-on-recurring- charges.aspx)

<comment><USER17> Stripe handles this nicely. [1] As a merchant, it's handy. As a consumer, it's a bit spooky.

[https://stripe.com/blog/smarter-saved-cards](https://stripe.com/blog/smarter- saved-cards)

<comment><USER18> I'm a merchant of semi-high priced recurring memberships ($100-250/mo) and I wish our payment processor had this feature. We routinely have upwards of $4k a month in failed charges for some combination of {expired, cancelled, deleted from the system without the underlying membership being cancelled}.

<comment><USER10> Curious, what prevents you from switching to stripe? No idea how $4k/month fits in with your revenue or the opportunity costs in doing so, but $4k/month seems enough to justify spending a week to redo the integration.

<comment><USER18> Most importantly Stripe is quite a bit more expensive the payment processors I've used in the past. Less importantly but still a show stopper is that all the full-featured pieces of management software for this industry (fitness facilities) are tied to a very small number of payment processors. Some of the large ones have one processor and you literally cannot accept credit cards without using them. They're still cheaper than Stripe so it's not that big of a deal but the UX leaves quite a bit to be desired.

</comment></comment></comment></comment></comment><comment><USER19> I don't think I need temporary numbers to protect me from fraud. The fraud protection with my current credit card has been working fine so far. Another reason not use this card is that I don't want to miss out on reward points. I don't see how this business model is going to survive.

<comment><USER20> Rewards are hoops CC card companies make you jump though to get some of your money back. Money you pay when vendors increase their prices to cover CC card fees.

<comment><USER21> You pay the fees if you use this card, or indeed buy anything at all. So you'll want to get those rewards.

<comment><USER22> And you pay a fee to cover those rewards.

<comment><USER23> That's not really at the behest of the credit card company, as I understand it.

</comment></comment></comment></comment></comment><comment><USER24> It's not the card built for 21st century, it's just a slightly better 20th century card. 21st is not anymore US-centric, therefore anything in 21st century should be world-wide; focusing on US only shows how you are going to lose bit opportunities.

<comment><USER25> Setting up a financial operation globally simply isn't a matter of spinning up some AWS instances and hiring a firm to do internationalization of your site.

<comment><USER24> Of course it is difficult. But claiming that you created the "credit card for the new century" is a pretty bold statement. Especially if you aren't ;-)

On the other hand I understand that saying "We slightly improved a 40-years old tool that is being replaced by totally different ideas and we are releasing it in what 10 years ago was the main market in the world, but today is only a part of the bigger picture and will be even less in the near future" sounds slightly less sexy.

</comment></comment></comment><comment><USER26> [https://developer.visa.com/products/vts](https://developer.visa.com/products/vts) If anyone feels like making their own version.

</comment><comment><USER27> Can anyone chime in on how this compares to [https://privacy.com](https://privacy.com) or [https://www.entropay.com](https://www.entropay.com)?

<comment><USER28> I have a hard time with Privacy on more than a few vendors. This is usually because their system doesn't account for the authorization and charge being from two different company names. In NYC, for example, all cabs and related cab apps will charge like this.

<comment><USER29> Hey there! I work at Privacy.com.

This is something we've been working to improve over the past few months. If this happens again can you shoot us a note email@example.com with the details?

</comment></comment></comment><comment><USER30> Hm, I've been doing this for years. My bank lets me create virtual MasterCard credit cards that can either be one-time use only (they "auto destroy" after one payment is authorized) or can be set to expire after a certain month or a certain amount of money is spent.

They're linked to a physical card and/or bank account that you never disclose, and you get an SMS notification for every transaction.

Not sure what's the novelty here?

</comment><comment><USER31> Not sure if I missed it, but I dont understand this:

The founders of the company couldn't use their cards because of Target breach. And they started Final based on that experience.

How is Final solving this problem for breaches involving in store transactions like that of Target? imo, the Final card would still need to be deactivated right?

If I understood their value proposition correctly, Final has the best UX for virtual card numbers unlike those provided by BoA and Citi, where the UX to generate and use them sucks, and to be used for online transactions.

w.r.t in store transactions, it continues to be the same. (correct me if I'm wrong)

<comment><USER8> For us, it was about control. We felt powerless when our issuing banks canceled our cards w/o warning. You're correct in that Final uses EMV to solve for in-store fraud just like rest of industry (which reduces by 80-90%). But if I lose my card or on slight chance someone manages to skim at POS that is magstripe, I can just turn that card off, and all other recurring payments and merchants are unaffected, just need a new plastic.

<comment><USER11> Basically like Discover's Freeze Account or Citi Quick Lock... :/

</comment></comment></comment><comment><USER32> Virtual card numbers are not a new thing. For example, some Citibank cards allow you to create separate virtual numbers for different merchants. However, it looks like Final makes the process much easier.

<comment><USER33> Even Bank of America offers that, although it's really tough to find and requires Flash. They call it ShopSafe.[1]

[1] [https://www.bankofamerica.com/privacy/accounts- cards/shopsaf...](https://www.bankofamerica.com/privacy/accounts- cards/shopsafe.go)

<comment><USER9> That flash interface has not changed in 16 years, except that a few years ago they added a requirement to enter the three digit code from the back if card.

So that's pretty impressive that they can still support and maintain code that old.

<comment><USER34> 16 years is impressive? What would you call a 33 year old multi million line codebase still being babysat in production today?

<comment><USER9> It's not the age. It's that they didn't touch it for a decade, and then still had the ability to make changes to it when they needed to.

<comment><USER34> How do you know they didn't touch it for a decade?

<comment><USER9> Because I've used it that long, and it did not change in the slightest except for the change I mentioned.

<comment><USER34> Just because the user interface or functionality didn't change doesn't imply the internals didn't change to keep it maintained and running though, right?

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER35> Why should end users care about hacked cards? Sure its painful to swap out all your cards but its only inconvenience, no real money lost. Its the issuers that lose money.

So if you are selling a card to the end users, individual cards for each transaction (which others do already) cannot be your first point. Its not convenient at all to go through an app to generate a new number every time. Sure there will be people using it but not sure it sells with the bulk of the users.

<comment><USER36> Inconvenience and stress. I had my card "stolen" twice, and the bank was kind of a pain to deal with. Mostly their incompetence, rather than a refusal to help, but that didn't help. I don't bank with them any more, but it actually wasn't even over those incidents.

So while I wasn't out any money, I was definitely out my time and had to deal with excess stress, so I _do_ care if it gets stolen in the future.

</comment></comment><comment><USER37> Am I missing something - I mean it's annoying having to update recurring payments with a new card# but it doesn't happen that often and the issuer has the liability, so what do I care?

<comment><USER38> This literally just happened to me today, and it was a bit of a pain, but it only took half an hour with last month's statement and a web browser to update all my regular payments.

The one thing I would recommend is having a secondary card with a different provider kept as a backup, just to deal with the couple of days between cancellation and receiving the new card. Even better is if it's a different card type (Visa if you have a MC or whatever) for that once in a blue moon situation when a merchant doesn't accept that card. Finally, if you do this, put some regular, low value monthly payment on the backup card so it doesn't get cancelled for inactivity. Netflix is good.

</comment></comment><comment><USER39> If there's an annual fee, most customers expect either excellent rewards or top-tier customer service (e.g. amex). Hard to justify $50/yr for neither of these.

<comment><USER40> M, one of the founders of Final here.

We agree there's nothing better than exceptional customer service and experience. We've built Final from the ground up as a new credit card issuer so that we can continue to enhance the technology, service, and experience. We need to make money somehow, and we think an annual fee is the best way to align with our customers.

We've spent 3 years to get to this point. We're now live and actively inviting people from our waitlist to apply for a card.

We talk to our customers often and ask them what they think about us. We will continue building and making it better. Here's what we've heard:

"The few people I've showed your service to so far have said "this is what we should have had all along" and I agree."

"Final just solved my XM radio problem. I've been trying to cancel XM for a year. Each month I dispute their charges, Amex credits my money back.. but Amex would never just BAN them from charging me. Generated new final number, added to XM, then froze account. Boom."

"Final is one of the best banking products I've ever used. You guys could have sat back on your haunches and only delivered the cool feature of generating cards, but the well-designed phone app, the card, and your great customer service make every other card I have in my wallet pale in comparison. I reach for the final card to make daily payments not because of rewards points, but because I see the receipt immediately and I'm able to instantly dispute the charge if necessary. I don't know if there's such thing as 'credit card anxiety', but something about that gives me so much peace-of-mind. Thank you for creating a great product!"

And our favorite: "You guys f __king killed the UX experience. The site is a pleasure to use. "

<comment><USER41> My feedback: The virtual card numbers and the ease of generating them are tempting. But I'm already protected from fraud by my existing Citi DoubleCash (2% cash back, no annual fee). I'm not going to lose 1% cash back and the fee to get a Final card.

<comment><USER42> Btw: Citi Double offers virtual numbers too but its a bit hidden on the website and requires flash.

</comment></comment></comment></comment><comment><USER43> Does anybody know how using multiple virtual card numbers impacts your credit score (if it does)?

<comment><USER44> It doesn't. It's one account that has essentially has multiple account numbers. It's the activity of the underlying account that matters, not which account number you as an end user use to access the account.

</comment></comment><comment><USER45> I have stopped using any of my cards that don't work with Apple Pay. Apple Pay solves the problem of a static card number being stored god knows where for how long in who knows what flat file or databases. One time card numbers ftw.

</comment><comment><USER46> Does anyone know how Final / other companies are able to create virtual CC numbers? Is there an API or something?

<comment><USER47> We do it from the core infrastructure we run ourselves. Built the full stack to have flexibility and innovate in industry where 90+% of CC transactions still run on mainframes & COBOL

<comment><USER48> New and shining can have disadvantages, too. Was your code audited for security?

<comment><USER47> Yes, many times over, but always looking for holes, and actually that infrastructure is separate from the pieces that are exposed to public web.

Traditionally, we do it this way too, these piece of the payments ecosystem are all whitelisted IPs for access and MPLC circuits for connections.

</comment></comment></comment></comment><comment><USER49> My largest complaint is every time some company's crap security gives up my credit card and PII data, the card companies protect the stupid in not telling me who it was. I find this abhorrent, as if I knew, I'd simply never deal with them again.

The concept of Final is pretty awesome, as in theory this now allows me to identify who they were when I have to change out a particular number for a vendor. I then know they were a crap company, and likely would just never use them again. Finally.

I use BofA as the convenience at least here in Phoenix is great, but their disposable card numbers is no good for repeat transactions, which I do frequently. It is also highly inconvenient that it only exists for Credit Cards, and not my Debit that I use just as frequently. Final's solution fixes this (except my debit card) imho, definite perks I wish BofA had today.

With any luck, the banks will see what they are doing and at least copy them now that someone has shown them the methodology. This should be an industry standard solution in lieu of major PII breaches every 3 months these days.

</comment><comment><USER50> I have been using something like this for years (a French service from my banking group called Virtualis). I have no idea why it's not more frequent.

The main thing to be careful about is not to use this to pay for things where you will be required to provide physical proof of card ownership later. For instance, some French railroad tickets can be withdrawn from machines where you must insert the card that has been used to purchase them.

</comment><comment><USER51> Pretty cool. I've always wondered why the credit card industry never did something like this. Can you view the full number you used for a company? Like I know at least 2 businesses off the top of my head that asks for full credit card numbers for support, and then another one only wants the last four.

Which I really feel that's insecure to even ask for the full number other than when you first order.

</comment><comment><USER52> Do they really go for the iphone only route in 2016 or am I missing a link somewhere?

<comment><USER47> Working on native Android full steam now, but yep started with iPhone for now. Web is full responsive and have a ton of Android users using it and happy w/ experience. But point taken.

</comment></comment><comment><USER53> No mention of [https://revolut.com](https://revolut.com) yet?

<comment><USER54> Revolut no longer wants American customers, so likely not much mention on HN.

(It's impossible to reload a Revolut account from a US one now.)

<comment><USER55> Probably due to FACTA. Not many banks in Europe want to deal with this. So most of them refuse American citizens as customer.

As revolut uses a traditional bank their bank probably doesn't want to deal with it.

</comment></comment></comment><comment><USER56> Does anyone know if this company has any relation to Coin (recently sold to Fitbit)? I ask because they use literally the same actor in their video (and the style is identical to boot) [0].

Did a quick google search to see if maybe they had the same co-founders but no dice.

[0] [https://www.youtube.com/watch?v=w9Sx34swEG0](https://www.youtube.com/watch?v=w9Sx34swEG0)

EDIT: Apparently the actor runs a production company that makes commercials for start ups and he stars in many of them[1]. It is actually quite surreal.

[1] [http://sandwichvideo.com/](http://sandwichvideo.com/)

<comment><USER31> SV has made many such videos for popular startups. Whats unique about it is that the production company also takes some equity in exchange of reduced production costs, there by sharing the risk/reward of the startup client.

</comment></comment><comment><USER57> This wouldn't work in the UK because you can almost never pay a "subscription" with a credit card - it would usually be a direct debit, or they might accept a debit card.

So I was going to comment along the lines of "surely it's actually a debit card, and I'm not sure I trust a company with such inaccurate copy with my money" \- but comments here seem to suggest it's correct.

Anything can be put on a CC in the USA then? Do you also have DD? Why would you use DD if you can use your CC for such things?

The Wikipedia section on DD in the UK is very much longer than that for the USA. Funny, I never doubted that it was universal.

<comment><USER58> Why would you use a debit card, which directly takes money out of your banking account, when you can use a credit card which increases a number owed against you? The former can cause lots of money in overdrawn bank accounts, while the latter will only cause the transaction to be declined. Also debit causes you to have to pay the fee, while credit forces that on the merchant.

Almost everything in the US is done with a credit card (through VISA et al networks). Most people's debit cards go through the same networks. If by DD you mean direct debit through the banks, that's called ACH here and is pretty awful with respect to fraud since you have to give your bank account number, and transactions take several days to go through.

<comment><USER59> Wait, what? It's the exact opposite of what you described! If you don't have money in your account, a debit card will just get declined. No fee to pay, no penalty, nothing - transaction just gets declined and that's it. Debit cards are also free to use in most places, while using a Credit Card has a 2-4% extra fee. Debit cards are free to issue, while Credit Cards usually have a yearly fee.

Is it just completely the other way around in the US?

<comment><USER60> Which bank are you with? Most UK banks will gladly allow transactions on debit cards to go through, resulting in your account being hit with overdraft fees, the size of which vary depending on whether the overdraft was pre-agreed, exceeded, or entirely unarranged.

Unfortunately, the prevailing attitude in most UK banks that I've seen is one to look to profit from transactions rather than protect their clients. Unarranged overdrafts are fantastic money makers in that regard.

<comment><USER57> Sure, if you have an overdraft.

But parent commenter's point was that if you do this with a credit card you could be completely unable to pay - if, for example, you have a single bank account with:

        (balance + overdraft) < minimum payment for credit card

This can't happen with a debit card, since it will decline the payment, in the same way it would if you tried to use it to pay off a credit card bill of the same amount per above.

</comment></comment></comment></comment></comment><comment><USER61> Portugal has had this service for years.

[https://www.mbnet.pt/](https://www.mbnet.pt/) [https://www.mbway.pt/](https://www.mbway.pt/)

</comment><comment><USER5> I think my dream scenario here is some big bank or other large financial company (like Fidelity) buying this for the technology and combining with their credit card line.

Not that I wish or think the founders can't make on their own, but CC market is rather commoditized, and I don't think they can compete on technology alone here. 1% + 49/year annual fee is not a superior offer. But a bank that can do 2%+no annual fee attached to it could do wonders with it I think. No financial pro, so maybe I am completely wrong :) but I'd switch to such offer right now.

</comment><comment><USER62> It seems like they're rolling out the equivalent of Application Specific Passwords that Google has for sites that don't work with TFA.

How much info are you displaying on the various merchants that are billing via the individual card numbers? My credit card bill tends to have a transaction identifier, the name of the merchant & a reference number (along with transaction date & post date). Would be great to have merchant's address and additional information on it and flag if it's recurrent.

</comment><comment><USER63> I've gotten early access and have been trying it out. So far it's been incredibly easy to use (one time cards is awesome for ordering food or trying out new merchants/startups) and I enjoy the notifications. I just received the plastic card so it may end up being my primary card replacing a Chase Freedom card I have had forever (also 1% cashback). As for the comments about annual fees, if this becomes your primary card I think it will more than pay for itself over a year.

</comment><comment><USER64> > We are PCI-DSS v3.1 compliant and apply PCI standards when dealing any > cardholder information

I don't think this was some kind of wordplay attempt around _dealing_ a deck of _cards_. Hopefully they're just "dealing with" the information instead. Typos in statements proclaiming how safe and secure they are...

The concept seems fine, I think some of this is already possible with other card issuers. I doubt I would pay a $49 annual fee for the service when there are free cards available.

<comment><USER65> Yes, I immediately thought of Citi's Virtual Account Numbers.

Citi also offers a card with no annual fee and 2% cash back, so if you use Final you're effectively paying $49 plus 1% of your spending each year for a trivial increase in piece of mind that you didn't need to begin with (because you're not liable for fraud).

</comment></comment><comment><USER66> have been using this for a couple months and absolutely the love the experience

aside from the obvious security benefit, the UX makes me never want to use another credit card. being able to see all of my merchant relationships in one place makes it easy to keep track of payments, paying my balance is effortless, the push notifications are seamless.

when final says they're making a credit card for the 21st century, one part of that is security, but a huge part of it is UX + customer support, too.

</comment><comment><USER67> Having to pay a annual fee, a credit check and get an invite to use it? Might as well just use my AMEX or my debit card. My bank is more crazy over transactions than anything.

Walk into a Wal-Mart, as soon as I put the card in my phone rings (it's my bank) and card is denied.

AMEX likes to text and email me of things needing my confirmation.

If all else Privacy.com does the job just fine of generating new cards, burners, and etc.

</comment><comment><USER68> Another one?

<comment><USER69> This was probably the first one of these you saw, because their original concept website came out I believe 2 years ago. They haven't launched (still) although a few others have. They've now added some things and it looks interesting, but has been a long time coming.

<comment><USER70> They did launch! I've had the card for a month or so. Tho I haven't found as many opportunities to use it as I had hoped

<comment><USER69> Oh that's great! I guess they haven't launched to everyone.

</comment></comment></comment></comment><comment><USER71> "The credit card was broken. We fixed it.

The next time you hear about a big credit card breach, you can relax."

I don't actually agree with either of these statements. I think what is broken are practices of credit reporting agencies, theres really only the "Big 3" in the US = Transunion, Equifax and Experian." They are in control of your credit profile and not you the consumer/citizen/person. They are constantly selling your data. When you get a credit card offer in the mail it is because a third party bought a risk profile from one of these big three credit reporting agencies.

Their security practices and policies are also questionable. A recent example - last year Experian was breached and millions of customers data was stolen. Experian informed people weeks later via snail mail. Apparently they didn't think this was time-sensitive issue. They offered two years of free credit monitoring after which time they would start billing you for the service - talk about an inappropriate marketing opportunity.

This is so horribly broken on so many levels. You can not opt out of these agencies owning your credit profile.

Also I have had fraudulent activity on my credit card accounts before with two major credit cards and both times they have proactively informed me that there was suspicious activity and to contact them. I contacted them and they issued a new card and told me to not worry about the charges. This was the last I heard of it. Yes you need to go update your credit card number with people online but in my case only half a dozen places would have that and generally merchant will email you if there is a problem with the card such as you forgot to update them with the new one.

I am curious if anyone has tried this new card though, it looks interesting.

</comment><comment><USER72> Maybe it's just me, but when I see a new product with iOS or Android only apps, I get turned off.

<comment><USER73> I do as well. If it's proprietary then I don't want to run it on my phone. No thanks.

</comment></comment><comment><USER74> If you load this page on an iPhone 7 in landscape mode, it shakes like crazy and is unreadable.

<comment><USER47> Thanks will look into it. Some old janky JS we have from what is still our original marketing site at its core. This codebase is separate from all actual customer data/sensitive things, so it could use some JS best practice cleanup clearly (even though this might be a responsive CSS thing)

</comment></comment><comment><USER75> As another commenter has posted - bofa & citi also let customers generate 'virtual' cc numbers. So Final is only useful for customers of other banks, or is there any advantage for bofa/citi customers as well?

</comment><comment><USER76> I too will pass. My old MBNA now BofA that generates virtual credit cards numbers without a fee. CitiBank also has cards with this feature. There's no compelling feature that would make me pay $49/yr as annual fee.

</comment><comment><USER77> People in this thread are just obscuring the details of this announcement, which is that this is wonderful and that I will be looking to acquire one of these cards.

Work well done.

<comment><USER71> A discussion is taking place in response to content and subject of this post. I would hardly call that "obscuring the details of this announcement."

</comment></comment><comment><USER78> Dang. I was hoping it would be virtual cards combined with something like Coin[1]

[1][https://onlycoin.com](https://onlycoin.com)

<comment><USER47> In all honesty, the juice isn't worth the squeeze. When you put a battery into that form factor battery life is a big issue and keeping in sync with your phone really harms it. Add recharging and you have other tradeoffs, so EMV gets us 95%+ of the way there and we're happy not having to solve really hard esoteric challenges related to things like the Bluetooth stack for BLE use.

</comment></comment><comment><USER3> Give me the ability to pre-load this thing with a given amount of bitcoin linked to a switchable account and we would be all set.

</comment><comment><USER79> That guy... and his videos! Pretty cool no? He stars in all his own vids. How do they choose what startup to make them for?

<comment><USER80> They explain it pretty well here [http://sandwichvideo.com/how-it- works/](http://sandwichvideo.com/how-it-works/)

</comment></comment><comment><USER81> Using this card for a while... Simply great

</comment><comment><USER82> Did final pivot from a physical card like Coin to a virtual card creator like privacy.com?

<comment><USER66> No--

Coin is a container for multiple existing card. Final is a new physical (credit) card which comes with an unlimited number of virtual sub-accounts.

Privacy is similar to coin in that it's just a wrapper over your existing payment methods.

</comment></comment><comment><USER83> > "18.0% Annual Percentage Rate (Variable)"

Is this normal? It seems like a LOT to me

<comment><USER84> Why does this matter? If it does, you're doing it incredibly wrong. The annual fee and pathetic rewards percentage are much more odious.

<comment><USER83> I am Spanish and I got lost in translation, from the rest of the comments and a quick search this is when _borrowing_ money; I thought it was a different kind of fee (:

Edit: I misunderstood it since "Annual Percentage Rate" seems like just a group of English words together when it actually has a special meaning in economy

<comment><USER84> It's the interest rate you pay if you do not pay off your credit card in full every month, but you should always pay off your credit card in full every month, so it doesn't actually matter.

</comment></comment></comment></comment><comment><USER85> this seems like a great idea, i just wonder how it will scale... wont you max out the allowable CC numbers in your BIN?

<comment><USER85> or on throwaway(single use) cards, do they just reissue the same CC# but with different exp and cvv?

</comment></comment><comment><USER86> If this is based on a FICO score, then please spare us the hype. You are not doing anything different. Just convolution of processing, that's all.

</comment><comment><USER87> Is it Visa Debit?

<comment><USER88> Visa credit.</comment></comment>


Ask HN: Why does my site stall before pulling in CSS? - <AUTHOR>

http://d.pr/i/10dCz<p>Here's a screenshot of my network tabs from dev tools. After the main document file is served, how can I debug why there is about a 100ms delay before CSS is pulled? <comment><AUTHOR> Not sure if this is normal, but compared against google.com and they also have a 100ms delay.

[http://d.pr/i/vvtc](http://d.pr/i/vvtc)</comment>


Show HN: COINDATAX – Cryptocurrency analytics with no hassle - <AUTHOR> https://coindatax.com/ <comment><AUTHOR> Hey everyone, I'm the co-founder of COINDATAX, a cryptocurrency analytics for investors interested in making sense of the market.

We started this project because we wanted a better tool than Google sheets for our crypto investments, so we integrated a powerful open source analytics tool with different data sources and we are now looking for more beta testers and first users :)

Please let us know what you think about it</comment>