Ask YC: Subscription Billing For On-Demand Startup - <AUTHOR>

You're a web app like beanstalk app, lighthouse, 37 signals,etc.  You charge per month.  How do you handle billing? What service do you use? <comment><USER2> We use Authorize.net's ARB platform.

But this question has come up before at HN and other places. Here are the collection of links on subscription. Pretty everything you need to know!

# <http://www.sitepoint.com/forums/showthread.php?t=453028> # <http://news.ycombinator.com/item?id=115723> (Recommended) # [http://www.37signals.com/svn/posts/753-ask-37signals-how- do-...](http://www.37signals.com/svn/posts/753-ask-37signals-how-do-you- process-credit-cards) (Recommended) # [http://discuss.joelonsoftware.com/default.asp?biz.5.550062.1...](http://discuss.joelonsoftware.com/default.asp?biz.5.550062.14) # <http://news.ycombinator.com/item?id=48040> # <http://news.ycombinator.com/item?id=47960> # <http://news.ycombinator.com/item?id=12010> # <http://news.ycombinator.com/item?id=47958> # <http://news.ycombinator.com/item?id=33322> (Recommended) # <http://news.ycombinator.com/item?id=49787> # <http://news.ycombinator.com/item?id=12082> # [http://groups.google.com/group/activemerchant/msg/635e1fec35...](http://groups.google.com/group/activemerchant/msg/635e1fec3535785c) # [http://blog.robwebb2k.com/2007/10/19/braintree-payment- solut...](http://blog.robwebb2k.com/2007/10/19/braintree-payment-solutions/-) Braintree Reccomendation- (Recommended) # <http://www.webmasterworld.com/ecommerce/3496741.htm> # [http://www.merchant- account-services.org/blog/building-a-rec...](http://www.merchant-account- services.org/blog/building-a-recurring-billing-system/) # [http://www.merchant-account-services.org/article/payment- gat...](http://www.merchant-account-services.org/article/payment-gateways- reviewed)

</comment><comment><USER3> i signed up for paypal's website payments pro but eventually switched to braintree for my corduroy (<http://corduroysite.com/>) application.

the problem with paypal's solution is that you either require your customer to create a paypal account which is a hassle and looks a bit unprofessional, or you store the credit card information yourself to do recurring billing. if you store credit cards yourself, in order to be PCI compliant you have to store them on a separate machine on a separate network from your web servers. if you're starting out small, that can be a big pain. paypal does offer recurring billing to an extent but you don't have much control over the process.

braintree offers "securevault" which lets you store the credit card info at their site and they return you a token for each customer. when you need to do recurring billing, you just submit the request to their server and pass a token instead of a credit card number and they take care of the rest.

<comment><USER4> I believe paypal doesnt require customers to have a paypal account. Just entering the credit card should be fine (i.e without registration). But my usage with paypal is just as a customer though

<comment><USER3> correct. if you make your customer use a paypal account, you won't have to deal with the storage of the information which makes the whole process easier on your end (but harder for your customers).

</comment></comment></comment><comment><USER5> <http://www.braintreepaymentsolutions.com/>

<comment><USER6> I've read why they don't, but I really wish they included some sort of pricing information (even for an example industry/volume) on their site. Even if they're great, it makes it difficult for me to judge if it's even worth our time to investigate further. Anyone who's used them want to share feedback as to how they compare rate-wise with other providers?

</comment></comment><comment><USER7> <http://railskits.com/saas/>

Good option if you're a rails app.

<comment><USER8> On the Braintree site, which is the payment processor used by this railskit, it shows that they may not always choose to work with you if you do less than 100K a month. Has anyone had any experience with getting approved?

[https://www.braintreepaymentsolutions.com/get-started- now/fo...](https://www.braintreepaymentsolutions.com/get-started-now/form/2/)

<comment><USER7> RescueTime uses BrainTree and they took us on without a single paying customer. This has since changed, but we are still quite a bit less than 100k per month.

</comment></comment></comment><comment><USER9> We use paypal's payflow pro. I'm very much looking forward to when google checkout adds subscriptions as well.

<comment><USER10> I've been using GC for about 18 mths and we've had more than 20x the chargebacks that we've had on PayPal - just FYI.

<comment><USER11> What's GC? Google Checkout?

<comment><USER12> Sounds more like Garbage Collection in this case. ;)

</comment></comment></comment></comment><comment><USER13> Has anyone tried <http://www.zuora.com/> : Zuora Aims To Be Salesforce for Online Billing

They have some big names and they sound like a startup to look out for.

</comment><comment><USER14> Almost anything _but_ PayPal. I have both heard and experienced too many horror stories involving that company to ever trust them with money on which my livelihood depends.

<comment><AUTHOR> ive been through one before, but it still comes out the simplest.

<comment><USER14> Maybe it's just me, but simplicity is below reliability and "will not freeze my accounts for no reason" on the list of important qualities of a payment processor.

37signals doesn't even _accept_ PayPal, which I think is one smart move.

</comment></comment></comment><comment><USER15> I have used and recommend TrustCommerce. And they have a feature specifically designed for recurring payments which can be implemented in your software (some solutions require you to log into their control panel to make a payment recurring). Lots of APIs for every language too.

<http://www.trustcommerce.com/citadel.php>

</comment><comment><USER16> Merchant account.

The downside is you pretty much need to meet the huge requirements by the credit card companies to do it on your own servers. Which is why you need to find a merchant account provider that offers a way to store the data on their servers that meet those requirements. CDGCommerce is one, it gets very good reviews on all the webmaster forums and they have good rates.

<comment><USER17> OK, what's the upside?

<comment><USER16> its cheaper than paypal, and you actually look professional. "Please pay us via paypal/google checkout" just sounds so amateurish.

</comment></comment></comment><comment><USER18> PayPal ftw.

</comment><comment><USER19> I've had a good impression using PayPal so far for subscriptions and one-time buys at <a href="<http://zodlogic.webfactional.com/?pc=hackernews080523>">ZodLogic Games.

Easy to learn, simple to integrate and test. No horror stories but my needs are simple and traffic small.

</comment><comment><USER20> Amazon also has a biling service (flexible payments service): [http://www.amazon.com/Flexible-Payments-Service- AWS/b/ref=sc...](http://www.amazon.com/Flexible-Payments-Service- AWS/b/ref=sc_fe_l_3?ie=UTF8&node=342430011&no=3440661&me=A36L942TSJ2AJA)

I don't know if you can charge each month however.

<comment><USER21> Like PayPal, FPS requires an account with another party (an Amazon account in this case) making it unsuitable for many, including us. We can't introduce another step into the process.

<comment><USER20> That's true.

But I also see and advantage herein. You don't have to save the credit number and other sensitive details, so they can't be stolen on your servers.

</comment></comment></comment><comment><USER22> Both PayFlow (now owned by PayPal) and Authorize.net make subscription billing easily programmed. Authorize probably makes it a little easier because they have more code samples, but it's really just an API call for whichever.

</comment><comment><USER23> I've used PayPal for several years without significant complaint. However, definitely pay heed to the horror stories; they are often true. PayPal's one of those services that's "excellent till it ain't."

</comment><comment><USER24> We use Pay Pal and Cybersource (<http://cybersource.com/>). They are both pretty much equally easy to implement and cost about the same.

</comment><comment><USER25> If there is anything you don't like about these services and their APIs, please let Tipjoy know: <http://tipjoy.com/feedback/>

<comment><AUTHOR> hey ivan, we should chat. jason [at] publictivity dot com

</comment></comment><comment> patrickg-zill Note: there is also desktop software like ICVerify that will keep track of CC numbers and run them on a regular basis for you; I believe that it can also handle subscriptions.

</comment><comment><USER26> a.) This costs money and b.) I haven't actually used it. But I bookmarked it a few weeks ago because it looked interesting. Seems to be a Rails implementation of the BrainTree payment gateway.

Worth a look, particularly if you're using Rails as a framework (which I guess you might be since you cite Rails apps as examples).

<http://railskits.com/saas/>

</comment><comment><USER27> You should ideally support: MasterCard, Visa, Discover, AmEx, and PayPal

</comment><comment><AUTHOR> services we've looked at:

-zuora -aria

they want 5-10k in implementation, 1k per month minimum, and 2-4% of your sales (keep in mind, that is ON TOP of processing fees)

</comment><comment><USER28> PayPal++</comment>


Ask HN: Why don't SF companies hire remote workers? - <AUTHOR>

Call me naive but I see tech talent shortage posts all the time. I realize SF also has ridiculous salaries compared to other parts of the world due to housing costs.
I've worked for 2 years remotely for Microsoft from Vancouver. Flights to SF only take an hour from here so meeting face to face once in a while is not a big deal. The timezone matches as well. No relo costs, no visa bullshit.
I'm just wondering whether companies would hire workers like me, or what is stopping them from having such employees?
Are there any studies on whether remote workers are less productive? <comment><USER2> Some companies do. But there are some benefits and relationships you can only get from having regular face-to-face interactions. These benefits aren't adamantly necessary and some companies are willing to trade them off for access to a wider labor pool, but face to face communication is a big enough part of American business culture that it's still the norm.

SF in particular is kind of a monoculture which could also help explain why those companies hire from within SF and the US.

You might be willing to take a flight every week and work from home, but as labor you also could be in the minority. I like having an office to go to every day to get out of my house, and to see people, and I don't like travel. (Unless it's for fun.) Some people are fine with this arrangement, but again if most labor finds it suboptimal that's also why it's not a big part of our culture.

If a company is going to make the extra effort to have remote labor they're likely to hire from overseas to take advantage of lower rates. That might explain why you have less luck finding remote work from Vancouver.

</comment><comment><USER3> Most SF startups live in an ecosystem where they are completely changing direction multiple times a month, sometimes multiple times a day. Remote workers don't work in such a situation, because the communication costs to bring them up to speed on the new direction dwarf the time they actually get to spend working. Can you imagine how hellish your life would be if you spent 2-3 days (or worse, 2-3 months) deeply concentrating on a problem only to hear that your work will be thrown out and given to an on-site team because market conditions have changed and it's no longer appropriate for your company's current understanding of user needs? Can you imagine how much you'd distrust management after the first couple times of this?

</comment><comment><USER4> I am researching remote work and posting the companies that hire remote workers here:

[http://www.warplife.com/jobs/computer/telecommute/](http://www.warplife.com/jobs/computer/telecommute/)

My list presently includes four San Francisco companies.

I have a lot more to be added to that list. I'll be doing that soon.

Most of the work consists of finding these companies, so I alternative between researching the companies, then later post them on my site all at once.</comment>


Java project Hydra, a network framework built upon Netty - <AUTHOR> Hello everyone,
I just would like to share this project with the community. I mainly am looking for some people to give me feedback or review and test the project. So feedback is really welcome (: Thank you in advance!
The project: https://github.com/DataSecs/Hydra
Cheers! <comment><USER2> post on r/java too

<comment><AUTHOR> Thank you very much for the advice. I will do that ^.^</comment></comment>


Headset unlocks phone unlocks laptop: Dread Pirate Roberts didn't stand a chance - <AUTHOR> My Bose QC35II headphones are set as a Trusted Device and so automatically unlock my android over bluetooth when I'm in range, and my phone is a trusted device to my Google Chromebook Pixel. Dread Pirate Roberts wouldn't have stood a chance.
To maintain security you really need a backup phone on you at all times that you can use to log out your other devices that isn't part of this chain. You additionally need someone else that you trust who has permission to do this, but that's just yet another attack vector.
Truth is, if someone wants to get at you they can and you can't stop them without being incredibly paranoid. So Bluetooth-based chain of trust, here we go. <comment><USER2> By enabling Trusted Device unlocking you're giving yourself convenience at the cost of an increased attack surface. To maintain security you really need to consider the threat model of these 'convenience' features and stop using them.

</comment><comment><USER3> Glad I don't need a cell phone. I still use an MP3 player, and encrypted storage on my Linux notebooks. I never understood having all my personal data on a hand held tracking device, just crazy, from a security standpoint.

</comment><comment><USER4> I don't get the Dread Pirate Roberts joke. Is there some Princess Bride bit I'm forgetting about trusting or unlocking things?

<comment><USER5> [https://hn.algolia.com/?query=silk%20road](https://hn.algolia.com/?query=silk%20road)

Sild Road admin Ross Ulbricht aka "Dread Pirate Roberts" arrested with laptop left running, unlocked.

[https://news.ycombinator.com/item?id=9545085](https://news.ycombinator.com/item?id=9545085)

 _What unfolded next was a piece of improvisational theater. At 3:14 pm, DPR was typing away, writing to Cirrus. Just then, a middle-aged woman and man came toward Ross, ambling along in the kind of semihomeless shuffle you might often see in a San Francisco library. "Fuck you!" the woman yelled when they were directly behind Ross' chair. As if they were a deranged couple about to fight, the man grabbed the woman by the collar and raised his fist.

Ross turned around for just a second, during which a hand reached across the table and grasped Ross' Samsung. The petite, unassuming young Asian woman sitting across from Ross this whole time was, to everyone's surprise, also an FBI agent. Ross lunged for his machine, a hair too late, as she turned like a quarterback for a quick handoff to Kiernan, who appeared out of nowhere—as instructed—to get the laptop. It took less than 10 seconds. From afar, Tarbell was astonished by the elegant choreography of the whole thing. It looked like the police procedural version of a tight jazz quartet._

<comment><AUTHOR> Indeed :)

</comment></comment></comment><comment><USER6> What's the background on this? Did I miss something in the news?

<comment><USER3> It's pretty clear that he's pointing out a security problem with "trusted" devices. He just wasn't very articulate about it.

<comment><AUTHOR> I was fairly articulate, but you needed to be "in the know" to grok the writing :)</comment></comment></comment>


Show HN: Airball - Dribbble feed viewer built with Backbone.js - <AUTHOR> http://airball.in

<comment><AUTHOR> AirBall is an elegant and classy Dribbble feed viewer that is available as a web and a desktop application. Airball lets you view popular shots, shots by everyone, shots by debutants and shots by any player.

The desktop application (Mac and Windows) also lets you save shots locally for later reference.

Here is the download link - <http://airball.in/download></comment>


Ask HN: Why is no one talking about kernel assisted IPC bus? - <AUTHOR> I've been looking at kd-bus and its later evolution bus1. Seems like both projects are stalled. Why are kernel developers not supportive of a proper messaging system through kernel itself? Or rather what is stopping them from accepting patches to it?
bus1 -> https://bus1.org/
Can someone help me understand? <comment><USER2> Help me understand why Bus1 is a good idea? I'm not an expert, but it seems to me like D-bus accomplishes similar goals without any new mechanisms in the kernel.

<comment><AUTHOR> Having bus functionality enabled in kernel is beneficial for several reasons. It strips out lots of unnecessary bells and whistles and just hold some skeleton for send/receive/advertise. Most POSIX IPCs don't have an advertisement mechanism that enables discovery without some external persuasion.

D-Bus does this but has often been criticised for being overtly complex. OpenWRT came with a simpler solution, but then quickly defined a data protocol which suffers severely in I/O - it needs JSON for everything.

BUS1 doesn't specify a protocol for actual data itself so I can send/recv C struct which my process groups know about it.

Also, leaving bus logic in kernel would mean I can write a minimalistic library wrapping the syscalls for my specialised use, yet keep the applications readily portable should plans change.</comment></comment>


Alphabet Finishes Reorganization with New XXVI Company - <AUTHOR> https://www.bloomberg.com/news/articles/2017-09-01/alphabet-wraps-up-reorganization-with-a-new-company-called-xxvi <comment><USER2> This seems like it is Google preparing itself for a future where it will almost certainly be hit with the antitrust hammer here in the US. Google has been getting increasing pressure from the EU [1]. It, at least in the public's eye, has been showing more monopolistic behavior and getting more attention, like discussed here [2]. There has been talk of Amazon and Facebook facing similar antitrust issues in the future too, but those seem to be quieter.

The future is uncertain, but this will sure be interesting.

1: [http://money.cnn.com/2017/06/27/technology/business/google-e...](http://money.cnn.com/2017/06/27/technology/business/google- eu-antitrust-fine/index.html) 2: [https://www.nytimes.com/2017/08/30/us/politics/eric- schmidt-...](https://www.nytimes.com/2017/08/30/us/politics/eric-schmidt- google-new-america.html?mcubz=0)

<comment><USER3> Google used to be this unique company that again and again would launch exciting new services or products. Often it was services that helped them sell ads, but it was services that users found very helpful.

Gmail, Google Translate, Google Map, Google Earth, Chrome, Android. These were all unique in their own way when they came out and found hundreds of millions (mostly free or low paying) users.

But what is the one thing or service that you use from Google which was launched in the last 5 years and are widely used? Nothing.

What is the one thing that they charge for, except advertising, and that scores of people care to pay for? Nothing.

Sure, there have been ongoing improvements of their services and lots of tools, languages and frameworks released for developers. They have been testing self driving cars and there have been rumours about what they do in their lab. There have been laptops, glasses and loudspeakers, but none of them have really been successful or close to be considered market leaders.

Apparently, it's really difficult for one of the richest companies in history with tens of thousands of the most talented engineers, to market just one new product every few year. Was there ever in history so much money gathered so easily by such an amazing force of engineers?

Even within software services that you would think a global company with the largest user base ever, and millions of paying webshops, could dominate; Why is Google not a leader in payment technology? Why are they not dominating hosting services? Why are they not dominating cloud storage? Why don't we buy content such as books, news, movies or songs on Google? Shared economy? Social networks? Why are they not dominating anything else but a few software services that help them sell their core product, the ads?

Google can make such huge amounts of much money selling ads, that everything else is dwarfed in comparison. How could you ever get the attention of management for a project that could potentially - if everything goes well for 5-10 years - make 5 billion in revenue, when Google makes more than that in a month right now?

Not despite of their money but because of their money, Google cannot innovate. Take 1,000 Google engineers elsewhere and they could do amazing things. Have them in Google, and the world would barely notice if they all called in sick for the next 10 years.

Maybe Google's restructuring will help on this. I doubt it, unless the umbilical cord to all the advertisement money is cut completely. Size matters. Google has gotten way too big.

<comment><USER4> I have to disagree with this characterization. I don't work for Google but it is apparent that a lot of work goes into their products. You don't necessarily need to launch a new product to show impact. Improving existing ones is plenty great too, even if these improvements aren't as apparent as product launches. For example, we take for granted that the Google assistant can understand most things we say to it. By this time next year it would have gained a bunch of new capabilities that we would also take for granted, except more people would likely be using it and they'd be happier with it than they are today.

On one hand you acknowledge that they are constantly improving existing software, launching new hardware, new frameworks, new tools and on the other you criticise them for "not launching even one product". It's strange because I've actually heard the opposite criticism of Google on HN, that they launch too many products and don't focus enough on existing ones.

<comment><USER5> Many Google products are getting worse. The Maps UI isn't as good as 5 years ago. Search doesn't find things as well as it used to. And competitors are catching up. The developer libraries and languages they have released are all 2nd rate.

The grandparent is right - they basically haven't been able to capitalise on their incredibly strong position, except by becoming better as selling ads.

<comment><USER6> The UI might be worse, but everything else about Maps is better. It knows where front doors are, you can get directions through buildings if you're walking, it's far more traffic-aware, you can schedule when you want to arrive somewhere and it's public transit is smart enough to adjust for available busses, it works in areas of the world like Kiev with Latin or Cyrillic spelling, it has photos of the insides of most places, you can send the directions to your phone and it opens in the maps app there.

My only major complaint about maps is that it isn't friendly to people with limited data. Tapping on a restaurant in Thailand where I might have 50 megs of data for the whole month loads around 1-3 megs of images when all I want to do is see what time it opens. There are minor UI annoyances but overall Maps is a much, much better product than 5 years ago.

</comment></comment></comment></comment></comment><comment><USER7> I feel like Google's naming is clashing with Amazon's:

\- Amazon's "smile" points from A to Z.

\- Google's parent is Alphabet.

\- A2Z Development Center Inc is Amazon's holding company for a number of subsidiaries.

\- Google's holding company is XXVI -- there are 26 letters in the English alphabet.

\- Lab126 is Amazon's digital product development arm. 126 meaning letters 1 through 26.

Surely the leaders of some of the largest tech companies can come up with better names -- or is naming truly one of the hardest problems in computer science?

<comment><USER8> Naming is the hardest problem of all possible universes, in all possible universes.

<comment><USER9> Q: what are the two greatest challenges to software engineering?

A: cache invalidation, naming things and off by one errors.

</comment></comment></comment><comment><AUTHOR> Techmeme Summary: _Alphabet creates XXVI Holdings Inc. through which it will separate "Other Bets" from Google and become direct owner of subsidiaries like Waymo and Verily_

</comment><comment><USER10> Why did they change things _again_ or is this simply a 2-year process that is only now completing?

<comment><USER11> The article explains it, but it's not 100% clear why the extra step was needed.. "Google co-founder Larry Page announced Alphabet two years ago to foster new businesses that operate independently from Google. Technically, however, those units, called the "Other Bets," were still subsidiaries of Google." With this new change, XXVI Holdings will hold the equity for all child companies, rather than Google still being the owner.

<comment><USER12> Until now the only Alphabet subsidiary was Google Inc. The other bets were still Google Inc subsidiaries. This move brings them up a level and separates them from Google.

<comment><USER13> Looks like a pretty clean refactoring to me!

<comment><USER5> I don't see why they don't just put all their subsidiaries under Alphabet. What is the purpose of Alphabet if not a holding company?

<comment><USER14> It's in the article.

Alphabet owns google and the other bets.

If one of the LLC under Alphabet get sued it doesn't effect the other LLC (bets or Google).

<comment><USER5> That doesn't explain anything.

</comment></comment></comment></comment></comment></comment></comment><comment><USER15> Why is this necessary? I thought Alphabet was meant to eventually achieve this, what makes the extra company necessary?

</comment><comment><USER16> The following sentence sounds like they plan to achieve a less transparent situation "The switch is partly related to Google's transformation from a listed public company into a business owned by a holding company" therefore they buy back their stocks.

<comment><USER12> It's not any less transparent. Afaict, Alphabet Inc is the listed holding company of Google LLC and XXVI Holdings. XXVI holds the Other Bets subsidiaries that used to be Google Inc subsidiaries. Google the entity no longer has any non-Google subsidiaries so they're simplifying and streamlining Google operations by changing it into an LLC.

<comment><USER16> LLC cannot issue stock, right? If you buy back all stocks then you don't need to provide detailed public reports except to major stockholders?

<comment><USER12> Alphabet is the only owner of Google Inc stock. They're retiring it all and converting the Google subsidiary to an LLC. That in no way removes their reporting requirements, because Alphabet is a publicly traded company.

<comment><USER17> The reporting requirements will be reduced, though. Alphabet reports consolidated results and you don't get the same level of detail for each subsidiary as you would for an independet company.

</comment></comment></comment></comment></comment><comment><USER18> Does this feel like a "friday news dump" to anyone else?

<comment><USER19> No, it seems pretty mundane to me.

<comment><USER5> A major restructuring of one of the largest companies ever is not mundane.

</comment></comment></comment><comment><USER20> Nice revenue reporting re-structuring! Very curious to see where this goes, that was a lot of work to blurry line items.

</comment><comment> at-fates-hands This is probably all you need to know from this article:

 _Now, it's owned by Alphabet, so it effectively has only one investor and no public disclosure obligations._

</comment><comment><USER21> If I'm an Alphabet shareholder, did I just lose my stake in Waymo et al? It seems they are now no longer subsidiaries of Alphabet?

That would be a big deal.

<comment><USER22> They are still subsidiaries of Alphabet. Previously the structure was like this:

        Alphabet
            |
         Google
            |
        Other Bets

Now it will be:

             Alphabet
                 |
          ———————————————
          |             |
        Google         XXVI Hldg.
                            |
                       Other Bets

<comment><USER23> Wrong.

 _" The new entity, called XXVI Holdings Inc., will own the equity of each Alphabet company, including Google."_

<comment><USER22> Thank you for the correction. This is indeed the case.

Are the "Other Bets" still subsidiaries to Google or are they owned directly by XXVI?

</comment></comment></comment></comment><comment><USER24> Re-org: the universal sign of management theater or hiding the cash before the cops come.

<comment><USER25> LLC's will hardly protect your cash from law enforcement action vs the previous set up.

I believe it's just updating the business structure right down to the low level corporate/legal structure to reflect their multiple silo'd "bets" business strategy. It doesn't seem so nefarious if everything else is already functioning that way in practice.

</comment></comment><comment><USER26> Google is clearly betting on non-search-engine enterprises for years to come

</comment><comment><USER27> Great way to reduce liability

</comment><comment><USER28> > "Google is also changing from a corporation to a limited liability company, > or LLC."

> "The change helps keep potential challenges in one business from spreading > to another, according to Dana Hobart, a litigator with the Buchalter law > firm in Los Angeles."

Effectively, I take it this means Google isn't responsible if a self-driving car goes on a Skynet-esque murder spree, nor can their self-driving car property be sold off by the government to pay all of Google's antitrust fines coming down the pipe?

<comment><USER29> Nope. The "liability" in the name refers to personal liability, and it's 'limited' in relation to the greater personal liability present in a partnership or sole proprietorship. An LLC's liability structure is exactly the same as that of a corporation; the main differences between the two are how taxation is handled

<comment><USER28> I am confused because that's what the article seems to say. The other segment on this is:

> "By separating them, it allows the parent company to limit the exposure of > the various obligations of the LLCs," Hobart said. "For example, if one of > the LLCs has its own debt, only that LLC will end up being responsible for > payment of that debt."

Is it that the act of making them separate companies under a holding company that grants them this, rather than the change to an LLC specifically?

</comment></comment></comment><comment><USER30> Funny, I was betting on the new name to be "SkyNet".

</comment><comment><USER31> Since the latest censorship debacle, I have begun to resent Google on principle. They certainly had everyone fooled with their "Don't be evil" theme. No such thing.

What is needed now is an update to our laws that will prohibit carriers/hosts of information from censoring content that does not violate the First Amendment, the way GAB is doing it. GAB's efforts are worthy of an applause, however, they are a lone wolf, a reaction to the usurpers at Google, Twitter, Facebook, Apple, etc.

Speaking in disagreement with whomever on the internet isn't the same as speaking in disagreement in someone's house where you can most certainly kick the person out, or speaking in disagreement with your employer, James Damore style and getting fired for upsetting the groupthink.

The wireless spectrum should be sold with these guarantees of freedom of speech attached and new laws needs to be passed that will NEVER again allow Google, Facebook, Twitter, Apple or whomever, regardless of size, to usurp America's most precious freedom.

<comment><USER9> GAB = google/alphabet

<comment><USER32> Gab is a free speech/alt right twitter clone.

<comment><USER9> exactly</comment></comment></comment></comment>


Please Stop Writing So Much Code - <AUTHOR> https://dvt.name/2020/07/20/please-stop-writing-so-much-code/ <comment><USER2> It all stems from the same issue: Somewhere up the chain of command, someone promised someone a hard or soft completion date on some feature, and now they want other people to work together with them to meet that commitment, do or die, or maybe do or I annoy you with questions on Slack and make you feel like your financial support, for most people their comfortable existence, is under threat, and the feature needs to be finished by the deadline.

Such is the nature of hierarchical software development (and hierarchical structure in general), whether you call it waterfall or agile, it's the same.

If you do not want to work like this, then you have to find an alternative for yourself, and it probably will not be a "career path", but something individual, that you carve out just for yourself, based on your unique and individual talents.

It's not easy, but it's fun and interesting. And you get to focus on quality, and feel like you are doing good work, and some kind of fulfillment instead of despair and emptiness and like everything you work on will be called "legacy" in 1-12 months and retired and replaced with the next "new" project within 36.</comment>


Ask HN: What tools do you find work best managing remote teams? - <AUTHOR> When working with remote teams I find that tools and processes, as well as constant communication, is very helpful in the development lifecycle.  Are there any tools you have found to be invaluable in your management of remote development teams?  Why did you choose those tools? <comment><USER2> We use github for our code repository and code reviews, sentry.io for error reporting, asana to track our weekly objectives, slack to communicate, google hangouts for team meetings, google docs for sharing proposals, spreadsheets, various documents, and figma to share design assets.

This has worked well for us so far for about a year. No complaints really.

<comment><AUTHOR> Have you tried bugsnag as well? sentry.io looks very cool!</comment></comment>


Coronavirus now in Oregon - <AUTHOR> https://www.oregonlive.com/news/2020/02/coronavirus-appears-in-oregon.html <comment><USER2> I live in Oregon, work in Washington County. One of my coworkers has been WFH all week with flu like symptoms. Another one was out today. I'm officially spooked.

<comment><AUTHOR> I live in Oregon as well (in Clackamas county) and work in downtown Portland. One of my coworkers has been out all week with flu like symptoms and they live in Washington county.

I am doing my very best not to panic at this point in time. My biggest concern is that I am asthmatic, but I also bounce back from colds and the flu relatively quickly, so I'm hoping even if I do get it I'll recover somewhat easily...

</comment></comment><comment><USER3> For 3 unrelated people that are separated by a large distance to have it, the number of infected must be at least a few dozen.

Any sort of mathematical models that predict this sort of thing?

<comment><USER4> Most likely a lot of people have the mexican beer virus, but very few have severe enough symptoms to go to the hospital to get tested. I mean, do you go to the hospital every single time you cough or sneeze?</comment></comment>


Apple Quietly Pulls Claims of Virus Immunity - <AUTHOR> http://www.pcworld.com/article/258183/apple_quietly_pulls_claims_of_virus_immunity.html <comment><USER2> "Let's hope more Apple Mac owners are also learning to take important security steps -- such as installing antivirus protection."

This is the worst possible step to take.

When I switch someone over to Mac I take the opportunity to recalibrate how they see their computer as secure. I teach them to be more aware of what they are doing and how potential viruses could infect them. I find this is 100x more effective than installing antivirus software which is shit most of the time and instills a fake sense of security.

I had a family member who would always click "OK" whenever a window popped up in Windows or would blindly enter in their password because they figured Windows was just annoying them. When they got their Mac I taught them that whenever OS X opened up a window asking for their password or asked them if they really wanted to open up a file, they should freak the hell out and be 100% sure of why that box appeared. I actually got a couple of phone calls from them asking if certain popups were OK. Sure this was annoying at first but after a week or two they started to understand why these things were happening.

The great benefit of changing their way of thinking and making security a priority was that when Flashback hit I told them that disabling plugins was one of the best ways to prevent from being infected and they immediately accepted this.

Macs are not 100% secure. No one should be under any delusions of this. But teaching people why they are not secure is the solution. Not hiding behind POS antivirus software.

<comment><USER3> All the noise the media is doing around this case is to actually drive a demand for antivirus software for Mac. You don't see _any_ article mentioning installing software from trusted sources (like Mac App Store), digital signing, configuring firewall, keeping software up to date, etc. Their whole point is to compare the Mac platform to the Windows one, so they can conclude that installing antivirus software is the obvious choice.

<comment><USER4> Thanks for recognizing one of the biggest downfalls of it. They could be opening the Apple platforms for massive "protect yourself" scare sales.

</comment></comment></comment><comment><USER5> _According to Sophos U.S. senior technology consultant Graham Cluley, this is a sign that Apple is starting to take security seriously. "I view the changes in the messages pushed out by their marketing department as some important baby-steps," he wrote in a blog entry._

The idea that the removal of technical falsehoods from Apple marketing copy represents a watershed moment in their attitude toward the security of their customers' computers is based upon a bar set remarkably low.

<comment><USER6> I keep trying to find a way to set it lower but I can't. Maybe someone can help me.

<comment><USER7> You can't set a bar for Apple because they just say nothing at all. Interpreting Apple is akin to reading tea leaves.

It's not a low bar, it's just that Apple never says anything.

<comment><USER8> That means the bar is glued to the floor. OS vendors should be looking to help their users have a more secure experience, not finally getting around to stop lying about security through obscurity as a positive feature because they're no longer obscure enough.

<comment><USER9> > not finally getting around to stop lying about security through obscurity as > a positive feature because they're no longer obscure enough.

That isn't what happened. It used to be true, now it's not so they changed it. Security through obscurity was a positive feature, there is little denying it.

Just because it wasn't going to last doesn't make it positive and just because you think it's not something they should be touting doesn't make it a lie.

> OS vendors should be looking to help their users have a more secure > experience

For the record, Apple has been working on OS X anti-malware since 2009 when Snow Leopard was released. It was a pretty cursory effort yes, but considering Microsoft hadn't even released MSE yet at that point it's still not bad.

Marketing and engineering are two different departments. Just because someone is writing dumb copy about security in the marketing department doesn't even begin to indicate how engineers are tackling security issues in practice.

In other words, Apple is both helping users to have a more secure experience (what do you think Gatekeeper is for?) and rolling back their boastful copy now that it's no longer true.

How is that a bad thing?

<comment><USER8> > That isn't what happened. It used to be true

Stop drinking the kool aid. It was never true. OS X was exploit central for years. It was only the BSD base that stopped it from being exploitable from the network. All the client side stuff Apple added for years was RCE-you-like.

Also a fundamental thing about security is the acceptance that security by obscurity is not a defensive measure. Genuine security doesn't rely on it. Smoke and mirrors might scare the wolves for a while but won't keep them away for long.

> For the record, Apple has been working on OS X anti-malware since 2009 when > the sixth major release of OS X was released.

That's right, 5 major releases of the OS with no anti-malware effort, and it only became necessary for them to do it when it started to become an issue because people were getting owned.

> It was a pretty cursory effort yes, but considering Microsoft hadn't even > released MSE yet at that point it's still not bad.

Don't even bother comparing it to Microsoft. The source operating system FreeBSD has been doing this for years before OSX even existed. Microsoft was doing security way before MSE. MSE was held back because it had the potential to damage industry partner relationships. If Apple releases an AV no-one cares. If MS releases a good enough AV product the AV industry jumps up and down because MS just stole their lunch.

> In other words, Apple is both helping users to have a more secure experience > (what do you think Gatekeeper is for?)

Apple is not helping users to have a more secure experience. It's helping users to have a more controlled experience - the controller being apple. Gatekeeper is not a security measure, it's a tool designed to lock users into the Mac App Store. Do you really think that an App in the Mac App Store has no way of being malicious? Have you not seen what can be done by an app in iOS?

<comment><USER9> > Stop drinking the kool aid. It was never true.

It was always true, and it was a tangible benefit. Your arguments rely on it being considered "genuine" security or an effective defensive measure. It's not. That doesn't make it false, or not a benefit to end users.

> and it only became necessary for them to do it when it started to become an > issue because people were getting owned.

What were people getting "owned" (ffs, I thought this was HN?) by in Snow Leopard. Care to provide a real world example, because I know you're full of shit. There was no well known dangerous trojan/malware/virus for SL that had any notable number of infections. The anti-malware in SL was a preventative measure.

> Don't even bother comparing it to Microsoft.

Watch me. I don't care about the reasons behind it, the long and short of it is Apple introduced an anti-malware system in OS X before it was a big issue and Microsoft pushed it until 2012, long after they've had countless brutally utilized exploits.

> If MS releases a good enough AV product the AV industry jumps up and down > because MS just stole their lunch.

So MS sold out their customers to please their partners? Yeah keep trying to spin that one. And I'M the one drinking the kool-aid.

> Apple is not helping users to have a more secure experience.

Yes they are. FFS, you don't even understand what Gatekeeper is. FYI, it's not just the Mac App Store. Do some research before you continue to run your mouth.

> Do you really think that an App in the Mac App Store has no way of being > malicious?

Of course not. Does it have a much, much, much smaller chance? Absolutely. Is it far and away the most effective measure against malware besides not installing anything? Also true.

> Have you not seen what can be done by an app in iOS?

An App Store app? No I haven't, care to demonstrate?

<comment><USER10> Dropbox, Skype, and Microsoft Office being distributed through App Store would be a hallelujah moment for me beyond all other hallelujah moments.

A _staggering_ number of people I meet either can't get the job done, are too intimidated to start, download some malicious garbage, get waylaid by virus scareware, have no idea how to get the app into /Applications, get frustrated with Auto-Start naggers, freak out on Sparkle update dialogs, or never figure out how to pin the app to the dock.

Mac App Store is the answer to a lot of questions nobody "in the know" has had to ask in a decade or three.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER11> Apple seem to be less interested in comparing themselves to MS and PCs in general these days.

In ~2005 their entire marketing was based around trying to sell you a Mac as a PC replacement "Your next PC should be a Mac".

I guess they are less interested now because it's a smaller % of their revenue and most of the people who would want/can afford a Mac are already giving them plenty of money so there's no desperate need to increase their market share in that area.

<comment><USER12> Apple's current focus is iPhone and iPad.

Microsoft has zero market share in the table market ("there is no tablet market, there is an iPad market"), and a very small share in the mobile phone market.

When you are #1 in a market, you don't do comparisons.

The Apple Stores are probably the best marketing the Mac can ever get. So it's better for Apple to spend money on the stores than on making TV ads for the Mac. And so they have: <http://www.asymco.com/2012/06/25/the-face-and-the- brand/>

<comment><USER13> It's pretty clear that the next Microsoft v. Apple war is being waged in the tablet market (the show is over for cellphones -- Apple won). Traditionally Microsoft hasn't done well at competing with Apple on their own turf (mobile, mp3 players, etc), but it'll be interesting to see what the Microsoft Surface means for all of this.

<comment><USER14> Apple won big in smartphones, but Android has a bigger marketshare. Competition between all smartphone vendors have made the customer the biggest winner in any case.

<comment><USER15> Is that even relevant when Apple is taking home the biggest slice of the profit pie?

<comment><USER16> This article sums up quite a bit of why that is:

[http://www.thestreet.com/story/11586384/1/android-users- dont...](http://www.thestreet.com/story/11586384/1/android-users-dont-know- enough-to-matter.html)

</comment></comment></comment></comment></comment></comment><comment><USER17> I love the way the article only quotes two people, both from companies that sell antivirus software. Not that their views should ignored just because of who they work for, but their self-interest was clear.

The first suggests that Apple should be encouraging their users to install antivirus software. My understanding is that Apple's position is the opposite: 3rd party antivirus software on OSX provides so little extra security that it is not recommended. Does anyone know of a 3rd party antivirus application that would have stopped flashback?

The second suggests Apple should do more to support older versions of OSX. I view it as a positive, security-wise, that Apple does such a good job of keeping its OSX users current. Mainly it does this by making new versions affordable, but discontinuing support for old versions is an important part of that.

<comment><USER18> Mac OS X Security Configuration Guide:

[https://ssl.apple.com/support/security/guides/docs/SnowLeopa...](https://ssl.apple.com/support/security/guides/docs/SnowLeopard_Security_Config_v10.6.pdf)

 _Installing antivirus tools helps prevent infection of your computer by viruses, and helps prevent your computer from becoming a host used to spread viruses to other computers. These tools quickly identify suspicious content and compare them to known malicious content._

Quoting the Snow leopard one since that seems to be the most recent. They've also used stronger wording in the past: "Apple encourages the widespread use of multiple antivirus utilities so that virus programmers have more than one application to circumvent, thus making the whole virus writing process more difficult." and "Regularly check for viruses on your hard disk using an anti- virus program, especially if you download files from the Internet or share files with others."

While I agree that the state of AV software is generally rather poor and provides weak protection, I'd be surprised if the major AV choices didn't prevent a flashback infection at least by the time it had become commonly talked about.

</comment></comment><comment><USER19> "It doesn't get PC viruses" will, by definition, always be true. It's just not as relevant as it used to be, as Windows is much better in this regard today. If anything, this change is a nod to how the computing industry has moved on - using a Mac is no longer PC virus avoidance, but more "use this because it's great".

That said, most of the "virus" writers have turned to spyware and adware, and other scummy malware that demands money, and there is nearly none of this on OS X.

<comment><USER20> >> "It doesn't get PC viruses" will, by definition, always be true.

Macs are PCs.

<comment><USER16> "PC" has been appropriated numerous times by vendors to mean a specific platform. In the times were personal computers were less-standardised "IBM PC" and later "PC Clones" referred to the platform and not "personal computer" specifically. This naturally led to Macintosh computer being referred to as Macs, even though they too are "personal computers".

The problem is that many people today don't understand the history of personal computing and that "PC" has an established history of meaning a specific mainstream platform. I think some mistakenly poke fun at Apple, as if they had invented the label 'PC' for their ad campaign. When actually Apple merely took advantage of this convenient, existing differentiator for their PC vs Mac ads.

Apple have been working references to other platforms out of their marketing materials for years. Comparisons are no longer needed when a company has found their publicly-held niche.

<comment><USER21> just asking seriously.. aren't Macs x86 now? Doesn't that distinction comes from the time when Macs used a totally different architecture (risc) based on something called Ironically "PowerPC"? I still can't see the difference now. Why then don't call Linux-PC or BSD-PC to others if based on the platform? I may be wrong, but the way I see it its just something anachronistic with an historical basis, but now just used for marketing purposes.

<comment><USER16> The early intel macs were "x86". The current line up is x86_64. Depending on who you ask in the industry this is called AMD64, Intel64, EM64T, IA-32e. This is the 64 bit platform as developed by AMD, it's not to be confused with Intels IA-64 as sold in "Itanium" chips.

</comment></comment></comment></comment></comment><comment><USER22> I don't think it's a sign of Apple taking security seriously as much as it is a lawyer avoiding liability suits.

<comment><USER23> I think any competent PR representative would have inevitably pulled those statements, as they were never true even when they were written.

<comment><USER24> Untrue. This[0] is what was written in 2010:

> The Mac is designed with built-in technologies that provide > protection > against malicious software and security threats > right out of the box. > However, since no system can be 100 > percent immune from every threat, > antivirus software may > offer additional protection.

Something similar is still present in today's security page: <http://www.apple.com/osx/what-is/security.html> (near the bottom)

[0]: [http://web.archive.org/web/20100123154433/http://www.apple.c...](http://web.archive.org/web/20100123154433/http://www.apple.com/macosx/security/)

</comment></comment></comment><comment><USER25> I'm genuinely curious... are there viruses that spread in OSX?

Not trojans or whatnot that require users to click on files they shouldn't, but rather actual viruses that make use of vulnerabilities in OSX to spread from computer to computer, either via Internet or thumb drives or something?

In other words, if I always follow responsible practices (never opening files from untrusted sources), has there been any threat up through now that could compromise my OSX installation?

<comment><USER26> The real question to ask is not "Has there been?" but "Will there be?"

Given that Mac OSX is on the rise on the popularity scale I am almost dead positive we will see a lot of increase in malware for OSX, even remote attacks where the user will be infected even if he acts sensibly.

The risk of that happening to you though is fairly low. The risk of clicking something and then getting malware through that is way higher, from a risk point of view.

<comment><USER27>
      > Given that Mac OSX is on the rise on the popularity scale
      > I am almost dead positive we will see a lot of increase
      > in malware for OSX

This was repeated so many times, over so many years. Yet OS8-9 had more viruses in the wild despite much smaller market share.

</comment></comment></comment><comment><USER28> Microsoft should put "doesn't get Mac viruses" on Windows.com.

<comment><USER29> Similarly, I always tell people that I don't get Dutch Elm Disease. Puts a lot of concerns to rest.

</comment></comment><comment> mkr-hn Apple tried to claim Apple PCs were special, but it didn't remove the single biggest hazard to any claim of security.

PC means personal computer, which means a system owned by millions of people without the technical skill to assess whether or not that attachment (whether it's birthday_card.dmg or birthday_card.exe) really came from grandma.

All PCs are vulnerable to users. I'm glad Apple figured it out a few years sooner than Microsoft did.

<comment><USER30> How do you figure that 'Apple figured it out a few years sooner than Microsoft did'?

I don't endorse Windows. But for all Windows' brokenness, Microsoft has not claimed invulnerability to viruses and has put a significant amount of effort into improving security from XP to today. The main reason it has had more trouble with malware is that it has been a much more popular platform, meaning that is where all the victims are.

<comment> mkr-hn Microsoft didn't make the same claims, but they showed the same lax attitude toward security for years. Apple only needed to see a few malware outbreaks to come to terms with reality.

</comment></comment></comment><comment><USER31> I'm mildly surprised no one has sued over this yet. And since I keep seeing the mantra that flashback is a trojan. Here's some history: [http://mac- antivirus-software-review.toptenreviews.com/histo...](http://mac-antivirus- software-review.toptenreviews.com/history-of-macintosh-viruses.html)

<comment><USER32> Considering the effort that Apple marketing has made to make it clear that "Macs" and "PCs" are not the same thing, it would be very difficult to win a case, as Macs clearly _don't_ getinfected by "PC" viruses.

Which is not to say that your stement is wrong - it _is_ surprising that nobody has tried to sue, even if they would almost certainly lose...

</comment></comment><comment><USER10> Free and unprofessional advice on how to avoid Mac malware and headaches:

\- DO NOT INSTALL A VIDEO CODEC PACKAGE

\- DO NOT RUN COPIED OR TORRENTED SOFTWARE

\- DO NOT DOWNLOAD ANTIVIRUS PACKAGES OR "SYSTEM CHECKERS"

\- Enable Firewall (System Preferences -> Security -> Firewall Tab)

\- Uninstall Adobe Acrobat Reader unless your PDF workflow absolutely requires it

\- Disable Java immediately (Spotlight Magnifying Glass -> 'Java Preferences' application. Uninstall Java entirely for extra credit.)

\- Make sure Adobe Flash is at the dead latest self-updating version and set to auto-update (System Preferences -> Flash. Must be 11.3.x.x or greater)

\- Update all non-stock browsers to self-updating versions (Name of browser -> Updates...)

\- Allow Microsoft Office to check for updates weekly. (Help -> Check for Updates)

\- Allow Software Update to do its thing, at least weekly (System Preferences -> Software Update)

</comment><comment><USER33> >"Safeguard your data. By doing nothing."

For a brief moment after reading that I had to consider if the article was satire.

</comment><comment><USER34> This is somewhat of link bait. Yes, they changed the wording on their site, but what do you expect them to do in addition? Plan a press conference about the change? Have a press release? Of course it is "quietly"; Apple has product upgrades that they do not feel worthy of a press release.

Back to the subject: this possibly/partly is a response to the outcome of a complaint at an advertising complaints commission in the Netherlands (correlation is present, but the Dutch Apple site still had the original text while the US site had the updated text). They got the short end of the stick there, but the commission cannot do more than naming and shaming ([https://www.reclamecode.nl/webuitspraak.asp?ID=76881&acC...](https://www.reclamecode.nl/webuitspraak.asp?ID=76881&acCode))

</comment><comment><USER35> Wow, I had no idea that they said stuff like that on their site. Even though it specifies "PC viruses," the average computer user doesn't understand the distinction. Just last night a relative mentioned how Macs don't get viruses (which I corrected).

<comment><USER36> Are macs not PCs? Perhaps I'm an average user, but I thought PC stood for "personal computer".

<comment><USER37> That depends.

To lots of people (myself included), "PC" means "personal computer" and include desktop and laptops from Apple.

However in the 1980s/1990s, there were "PCs" and "Macs". PC was anything running Windows (etc.) and a "Mac" was from Apple (i.e. a Macintosh). Apple (and many Apple fans) continue to use "Mac" instead of "PC". I've had Apple fans ask me if I use "a Mac or a PC?" (Since I use Linux, I don't know what to say :P)

<comment><USER6> I usually say "I run Linux."

</comment></comment></comment></comment><comment><USER38> While Apple's install base is steadily growing, I still think they have a significant advantage in obscurity that grants them security.

i.e. Why do virus-writers target Windows? Sure, it has the largest install base, but Windows also runs a lot of servers and embedded systems. These two things are the real jackpots. What's taking control of one person's computer compared to taking control of a server with credit card information or a system running a billboard in Times square? Apple doesn't do embedded systems and their servers, while some do exist, are exceedingly rare.

Is security through obscurity enough though? That depends on who you are and how interesting your data is.

<comment><USER39> What do you mean by obscurity? Which level of the system are referring to? You seem to indicate that Windows is somehow open. Can you explain what you have in mind?

<comment><USER38> I said what I meant by "obscurity" and I did not say anything about Windows being open, but I'll restate things in other words in case it clears things up.

OSX and iOS are used predominantly to run personal computing devices. In addition to PC's, Windows also runs a significant number of the world's servers (although Linux dominates here) and embedded systems (see [http://www.microsoft.com/windowsembedded/en-us/windows- embed...](http://www.microsoft.com/windowsembedded/en-us/windows- embedded.aspx)). Despite OSX and iOS gaining significant market share, virus- writers may still find that the sweetest targets are disproportionately running windows. OSX and iOS are more "obscure" in the sense that they don't run many of the systems virus-writers want to target.

</comment></comment></comment><comment><USER40> Can anyone here speak to the risk to FreeBSD (or other BSDs)? As MacOS becomes more of a target, how much more vulnerable does FreeBSD become?

<comment><USER41> Most BSDs aren't running stuff like Bonjour which increases exposure to the network.

<comment><USER42> Bonjour is just Apple's name for zero config networking which most Linux and BSD distributions _do_ support to various degrees.

<comment><USER41> I was under the impression it also did file server and printer discovery among other things. I know OpenBSD doesn't do that out of the box.

</comment></comment></comment></comment><comment><USER43> Good to see Apple not contributing to the "Macs can't get viruses," "Macs can't get spam" misinformation any longer. Users need to learn to defend themselves, not just rely on the OS, which can't really protect users from phishing attacks. Reminds me of this post: <http://news.ycombinator.com/item?id=4004154>

</comment><comment><USER4> This is a great step. I am personally pretty hateful of Apple's decisions as far as hardware lockdown and restrictive use, but it's a tradeoff they offer customers and many consider it a good deal.

That aside, being more security minded as opposed to claiming immunity for marketing purposes is a fantastic move and one to be applauded by the tech community.

</comment><comment><USER44> This article invokes a memory of reading one of PG's essays about the PR machine seeding news stories.

<http://www.paulgraham.com/submarine.html>

</comment><comment><USER45> Title should be "Apple (Quietly) Pulls Claims of PC Virus Immunity".

</comment><comment><USER46> This may be an offshoot of having an engineer as CEO - bringing a degree of rationality to the marketing campaigns.

</comment><comment><USER7> Being immune to PC viruses used to be a great advantage. You can talk about theoretical possibilities all day long, in practical terms the difference used to huge. Apple's marketing exploited that – and why shouldn't they?

Microsoft, however, has improved massively and that advantage is just not longer there. PC viruses still don't affect OS X – but they also don't affect any modern Windows very often.</comment>


Edge Computing at Chick-fil-A - <AUTHOR> https://medium.com/@cfatechblog/edge-computing-at-chick-fil-a-7d67242675e2 <comment><USER2> > Why does a restaurant company like Chick-fil-A want to deploy Kubernetes at > the Edge? What are the goals? That, we can answer.

> Low-latency, _internet-independent_ applications that can reliably run our > business

I like their priorities. I've had too many experiences at other fast food restaurants where they're having some kind of computer issue and can't take any orders, so everyone is made to wait.

I also like the reliability-focused thinking that acknowledges that the internet isn't always there and designs for it.</comment>


Broadcom Is in Advanced Talks to Acquire Symantec - <AUTHOR> https://www.bloomberg.com/news/articles/2019-07-02/broadcom-is-said-to-be-in-advanced-talks-to-acquire-symantec <comment><USER2> What value does Symantec have beyond selling antivirus software to vulnerable and clueless people?

Their consumer Norton antivirus software is known to MitM connections and break the security of browsers and OSes, while they sell BlueCoat TLS breaking boxes to Iran and other unsavory actors. Take a peek at: [https://www.zdnet.com/article/tens-of-thousands-of- chromeboo...](https://www.zdnet.com/article/tens-of-thousands-of-chromebooks- fail-because-of-symantec-bluecoat-problem/)

Additionally, they were so incompetent as a Certificate Authority that they had their root certificate revoked by browser vendors: [https://news.ycombinator.com/item?id=17918748](https://news.ycombinator.com/item?id=17918748)

If Broadcom wants to buy a sinking ship, Symantec is it!</comment>


HTML5 Webcam Toy - <AUTHOR> http://neave.com/webcam/html5/

<comment><USER2> Not working with Windows 7 / Chrome 22.0.1221.0 dev-m.

<comment><AUTHOR> Try the stable Chrome 21</comment></comment>


'Reprogrammed' stem cells to be tested in people with Parkinson's - <AUTHOR> https://www.nature.com/articles/d41586-018-05856-w <comment><USER2> I see a lot of negativity that technology is going to stagnate in the next few years, often out of the "we were supposed to have flying cars by now" vein. But stuff like this makes me feel we may be in for some of the greatest medical revolutions in generations over the next few years.

CRISPR/CAS9, full genome sequencing, stem cells, we're going to start seeing the real results from these over the next decade, and if that means my Mother can have her parkinson's cured, I'm incredibly optimistic about the future.

<comment><USER3> Aside from medicine, technology in general is arguably already "good enough" for most people.

Hopefully we can focus on making social/ethical progress soon as much as we have in technology. There are still many places and practices in the world that someone from the "first world" would have a hard time believing.

<comment><USER4> > Aside from medicine, technology in general is arguably already "good enough" > for most people.

That was true in the 1960s as well. People often don't know what they want until it's old hat.

<comment><USER3> I mean somewhat objectively, not people's perception of it.

Today a person can communicate with anyone anywhere instantly, be almost anywhere in the world in a matter of hours, or get almost everything they would ever need in their entire life without leaving their house.

Sure we had planes and telephones in the '60s, and maybe we'll have teleporters and artificial telepathy in the future, but you know what I mean.

<comment><USER5> I don't think it's possible to be purely objective about this. It's a question of values and meaning.

I think there are many things that will change in the coming centuries that will foster people's values and give them greater meaning.

Of course, bad stuff will happen too. Such is life.

</comment></comment></comment></comment></comment><comment><USER6> I lost the hearing in one ear in a car accident when I was a kid (nerve damage) - I keep hoping that these advances will allow me to regrow my eardrum some day.

<comment><USER7> Is there no option to rebuild an artificial ear drum? Is your ossicular chain also shot?

Regrowing your ear drum is not going to resolve nerve damage, though: it'll deal with conductive hearing, not sensorineural. I'm sure you know this already.

As someone who is losing hearing due to a degenerative disease, I am sympathetic. The worse part of it for me is the severe tinnitus that came along for the ride. It is challenging in so many different ways, not the least of which is that it is completely invisible from the rest of the world.

</comment></comment><comment><USER8> I thought this would have been done 5 years ago.</comment>


Ask HN: What would you do with 3D printing, if... - <AUTHOR>

... you had the skills & time?
Curious about opportunities with building software that helps you fill the gaps.
Here's a great 3D printing primer to get your ideas flowing: http://www.ted.com/talks/lisa_harouni_a_primer_on_3d_printing.html <comment><USER2> My main thought would be to work on creating some custom enclosures for some of the "just circuit board" things I bought.</comment>


Dyson says UK government does not need its Covid-19 ventilator - <AUTHOR> https://www.reuters.com/article/us-health-coronavirus-britain-dyson/dyson-says-uk-government-does-not-need-its-covid-19-ventilator-idUSKCN2262PU <comment><USER2> UK government says Dyson's ventilator is useless.

(both are true, as far as I can tell)</comment>


Alexa Says YouTube Is Now Bigger Than Google. Alexa Is Useless - <AUTHOR> http://www.techcrunch.com/2007/08/13/alexa-says-youtube-is-now-bigger-than-google-theyre-wrong/ <comment><USER2> For google, all regional domains are counted separately, google.com, .de, .ro, etc., while for youtube, as far as I know there's only .com that's viewed all over the world.

<comment><USER3> Also, the YouTube.com measure that exceeds Google.com is only 'page views' -- the Alexa 'reach'/'rank' relationship between the two sites is much more similar to the Compete.com numbers that TC thinks is "getting it right".

Perhaps Alexa counts offsite embeds of YT videos elsewhere as 'page views', and Compete does not? Or, Alexa might reasonably count clicks within a single long-displayed page (paging through comments, starting/stopping/replaying video) as multiple 'page views' even without a reload.

Compete's numbers on pages/visit (16 youtube.com :12 google.com) and visit duration (16 mins : 6 mins) suggest YT 'views', if counted any differently, could way outpace its 'reach'.

And while journalists and techies might visit Google dozens of times a day, but YT far less often, I can believe there are plenty of people for whom the relationship is reversed. The TC view -- "this must be wrong!" -- could be inside-the-bubble thinking.

Alexa's stats have issues -- but TC's analysis is pretty flimsy, and could be missing something interesting in its haste to mock the Alexa totals.</comment></comment>


Dragula: Simple drag and drop - <AUTHOR> https://github.com/bevacqua/dragula/blob/master/readme.markdown <comment><USER2> If you're using React and need DnD in your app, Dan Abramov's library is the bee's knees - [http://gaearon.github.io/react- dnd/](http://gaearon.github.io/react-dnd/)

I've been using it exclusively in a complex react app[0] for the past 3 months and I have absolutely no complaints whatsoever.

[0] - [https://github.com/prakhar1989/react- surveyman](https://github.com/prakhar1989/react-surveyman)

</comment><comment><USER3> Erm...

I tried out your demo page and (literally!) the first thing I did had a bug in it. Just bad luck?

There's an off-by-one error while dragging an item from the left container to the right container, but only when my mouse has just entered the right box. If I continue dragging my mouse horizontally then the item's drop placeholder corrects itself.

Screencast: [http://screencast.com/t/Jw3No0wryqJ](http://screencast.com/t/Jw3No0wryqJ)

<comment><USER4> Screencast requires flash player :( I wish the day where I can forget about flash player will be gone soon...I want to watch your screencast but Adobe won't trick me into installing their malware again...

<comment><USER3> Do you have an alternative website which provides free video hosting? I just use this because Jing is a free/simple screen capturing utility.

<comment><USER5> Try [http://www.streamable.com](http://www.streamable.com)

</comment></comment></comment></comment><comment><USER6> How does this compare to Sortable?

[https://github.com/RubaXa/Sortable](https://github.com/RubaXa/Sortable)

<comment><USER7> Sortable's animations were janky for me on an iPad Air. Dragula was nice and smooth.

<comment><USER8> Here in my FF, they are smooth, but they make it feel very slow (at least I think it's the animations that cause this impression). I hope they are configurable, saw nothing in the readme, but I probably just missed it.

</comment></comment></comment><comment><USER9> Cool. Does Dragula support nested containers?

I've been looking for a library that supports nested containers. For an example of drag and drop with nested containers see [https://www.bkmks.com/](https://www.bkmks.com/)

<comment><USER10> I'd suggest interactjs.io been using it and works like a champ

</comment></comment><comment><USER11> This looks really easy to use!

A tree mode would be awesome, where you can drag elements to be children of other elements as well as siblings.

</comment><comment><USER4> It looks great! I would suggest adding an option of a delayed event, this way if you want to trigger a drag event you have to hold pressed for a second or so, this way it won't interact with touch scroll events of my phone

<comment><AUTHOR> Author here. There's actually a way to do that. There's a `delay` option you can use so that click events get through.

<comment><USER4> I see now :) great work btw, I really like the simplicity of it.

</comment></comment></comment><comment><USER12> This is simplicity at its best. Good one.

Also resizing is one thing you can look into. Grid kind of a thing. That makes it a complete package.

</comment><comment><USER13> Does Rob Zombie know about this? :-)

<comment><USER14> Or CBS with The Munsters?

</comment></comment><comment><USER15> The one thing I don't like (i.e. inconsistent with the UIs of most OSes) is that if the user drags something to a valid target, and then before the mouse is released, drags it off that valid target to an invalid target, and then releases the mouse at that point, the valid target is triggered. What should happen is that the entire drag-and-drop operation should be cancelled, as if the user dragged straight to the invalid target and released.

<comment><AUTHOR> This is hidden behind an option. `revertOnSpill: true`

</comment></comment><comment><USER16> Maybe include a comparison with popular libraries like jquery ui draggable?

</comment><comment><USER17> Does Dragula implement keyboard accessibility?

<comment><USER18> I wouldn't want a DnD library to magically 'implement' accessibility for me. How would that even work in a one-sizzle-fits-all way? If I'm building a UI that needs both mouse interaction and keyboard interaction, I want to consider and build both those things, not expect all the keyboard stuff to happen automatically because I used a library to manage mouse events.

EDIT there's a bad autocorrect in there but I'm going to leave it

<comment><USER17> > I want to consider and build both those things, not expect all the keyboard > stuff to happen automatically because I used a library to manage mouse > events.

I understand what you're saying and commend you for it, but other developers might not want to implement all that themselves, or more often than not, might not even be aware that they have to. In other words, a JavaScript library with zero accessibility features gets added to one hundred websites over night, and in an instant, you have one hundred inaccessible websites. It is an all too common pattern in recent years, as most projects, even the big ones, don't even include accessible examples.

<comment><USER18> But this is a library. It's not a drop-in 'sortable list' component (which I agree could, and should, have built-in keyboard accessibility). It's a general purpose toolkit for setting up drag interactions.

Asking if it 'implements' keyboard accessibility is like asking if a box of hardware tools implements wheelchair accessibility – it might be possible to build something wheelchair-accessible using the toolbox, but that's up to you.

I completely agree that there are lots of devs who won't consider accessibility when using this or other DnD libraries, and that's a shame, but it's not the place of a DnD library to magically create an alternative keyboard UI that somehow corresponds with whatever drag-and-drop UI you've built using the library. That just couldn't work. A human needs to think about it.

<comment><USER17> You make some good points, and I agree that my original question, as it was phrased, isn't the best fit for a library such as this. Perhaps, what I should've asked is whether the demo, which developers will use as a jump-off point, implements any keyboard accessibility (it doesn't, by the way, so I'm not hopeful that any projects using this will be keyboard-accessible).

<comment><AUTHOR> Author here. It's really easy to do. I implement tons of keyboard accessibility alongside dragula in my projects. In the demo it just felt out of scope. In one project I use dragula for a sprintboard, where you can cancel drags with Esc, drop with Enter, and move cards manually across columns with the arrow keys or a shortcut for each column (e.g 'o' for open)

So yeah, it's not part of the lib but it's deadbrain-easy to add on top.

</comment></comment></comment></comment></comment></comment><comment><USER19> Why not HTML5 drag&drop ?

<comment><USER20> [http://www.quirksmode.org/blog/archives/2009/09/the_html5_dr...](http://www.quirksmode.org/blog/archives/2009/09/the_html5_drag.html)

<comment><USER21> This guy seems to fundamentally misunderstand a lot of things about drag and drop.

<comment><USER22> He wrote that article 6 years ago, before a lot of the latest standards were even semi finalized. So when he wrote it he was 100% correct. Now however that article is a bit out of date.

</comment></comment></comment></comment><comment><USER23> Request: Make it so that it works well in scrolling areas too. This has been the major deficiency in most drag and drop libraries that I've tried.

<comment><USER24> Sortable (linked to above) seems to get that mostly right.

</comment></comment><comment><USER25> Didn't work at first for me.

Google chrome 43.0.2357.134 m, windows 8.

I see the hind icon but trying to drag selects text/elements instead.

I refreshed page and it started working.

</comment><comment><USER26> Any AngularJS binding for it ?

</comment><comment><USER27> How did this make the front page? Isn't this just jquery.draggable()

<comment><AUTHOR> Except that dragula is 3.7kb min/gzipped, instead of (95kb + images in jquery + jquery-ui)

<comment><USER28> Thank you. I habitually avoid jQuery, it's almost always a lot heavier than I need it to be, and depend on libraries like yours to quickly add valuable functionality.

</comment></comment></comment><comment><USER29> What a terrible name. =)

</comment><comment><USER30> Looks quite similair to [http://gridster.net/](http://gridster.net/)

<comment><USER31> This is what I'm using. Generally easy to use but there are a few CSS issues. GitHub page has people's workarounds but it hasn't been 'officially' updated for a while.

Edit: also, Gridster shuffles the panels around nicely in both axes and allows resizing which is very useful</comment></comment>


The 2016 Chevy Volt: An energy-efficient car that doesn't drive like one - <AUTHOR> http://arstechnica.com/cars/2015/10/the-2016-chevy-volt-an-energy-efficient-car-that-doesnt-drive-like-one/ <comment><USER2> Poor Chevy. It's a good car by all accounts, but the sort of people who gain social status among their peers by owning an energy-efficient car are the sort of people who lose social status among their peers by owning a Chevrolet.

<comment><USER3> They'd have been better off selling it as a Buick to justify the $40k price tag, but people who want a status symbol can buy the Cadillac ELR.</comment></comment>


John McAfee unleashes decentralized "no restrictions" crypto exchange - <AUTHOR> https://decrypt.co/10048/mcafee-unleashes-decentralized-no-restrictions-crypto-exchange <comment><USER2> Isn't that basically ForkDelta with fees?

</comment><comment><USER3> DDoS attacked already. Tsk.</comment>


Tabletop Gaming Has a White Male Terrorism Problem - <AUTHOR> http://latining.tumblr.com/post/141567276944/tabletop-gaming-has-a-white-male-terrorism-problem <comment><USER2> Your first impulse may have been to deny that this happens. Ask yourself, have you asked and then truly listened to your female friends and colleagues if they have ever experienced this before? Please make the effort and gather some anecdata.

<comment><USER3> So forgive the skepticism, but this woman was molested twice, 'roofied' once, and harrassed at least 5 times, encountered this stuff frequently and no authoritative body ever took notice? Or was this stuff half hyperbole?

I don't wish to dismiss this as not happening, but if this is true than it should get more attention. I mean, I've heard about some of the unwanted attention and comments women get, and some are quite frightening, but how does this relate to the number of women who attend cons regularly, wear revealing clothing, etc etc, year after year, and don't seem to hAve experienced attacks like this, to this degree and w without authorities taking notice?

<comment><USER2> You say they "don't seem" to have experienced attacks. I'm assuming then you haven't asked them directly what kind of negative experiences they have had?

Try it out!

</comment></comment></comment><comment><USER4> "Find another hobby or you're going to die."

In my attempt to get her into gaming, I once brought my girlfriend to an indie game store to grab a controller. The kids there were in the middle of some card tournament. There was an audible COD Twitch stream on the TVs. As we're paying for the controller, a player on the screen yells "Damn dude! He got fuckin' raped!" No one in the store batted an eyelash. The only female in the store, my girlfriend, suddenly felt very uncomfortable. In the parking lot she told me she doesn't want to go into a video game store ever again.

<comment><AUTHOR> It's really unfortunate that a term like "rape" has become so commonplace not just in gaming but with males describing sports events. Boys in need of a superlative. Another disturbing one is males describing sexual intent with violent terms: e.g., "I'd smash her." Not sure if it happens in the US, but I hear it in pubs/bars in Australia.

<comment><USER4> Yeah, kind of a weird coincidence but I was just recently writing a song about criticizing that "hit-it" mindset. I didn't realize that even terms like that have underlying violent connotations. I began listing some terms I hear, but realized how distasteful that is especially given the article above. Here in Vegas there is definitely a lot of that slang thrown around.

</comment></comment></comment><comment><USER5> Now terrorism means means sexual harassment.

<comment><USER6> Or, possibly, terrorism means the use of violence or intimidation to achieve an ideological goal, which just so happens to sound exactly like several incidents detailed in the article.

</comment></comment><comment><USER7> Tabletop gaming isn't the only place this happening. It's also happening in the video game industry and sci-if. At some point the denial about this kind of stuff (or how bad it is) will have to stop.

</comment><comment><USER8> Flagged of the first page already. No wonder people think HN is a bastion of misogyny.</comment>