Was Y Combinator Worth It? - <AUTHOR> http://wiwillia.com/post/80862769673/was-y-combinator-worth-it <comment><USER2> Thanks Walker!

I love telling people the story of how some investors scoffed at Teespring on demoday -- I remember one person asking why they were even there. It shows why it's still possible to make a lot of money in this business, and that startups shouldn't be put off by a weak reception from investors.

</comment><comment><USER3> One thing that i never see addressed concretely for me is this:

assuming I dont want to raise capital unless i really really really really have to, assuming im doing not b2c, assuming I actually am friends with a number of people who've done YC, etc etc

then why YC?

Unnuanced advocacy makes me nervous (and thats all I typically hear). Every single time in my life where I have taken unnuanced, uncaveated remarks on face value, it has blown up in my face. There are many fine businesses that have been certainly enabled by YC, and many that have not been.

Is YC suitable for businesses whose risks have been shifted to be strictly of the "can technology of this caliber actually exist?" sort, rather than "explore the business premise, do an MVP for the tech" sort? (admittedly, one challenge with sophisticated tech is educating folks about it!).

I guess I'm asking for nuance in why. If you can't give me nuance on that, why should I trust your advice on anything more complex?

[edit: to be clear, if someone convinced me, i'd totally apply to YC, just not sure if it makes sense for me]

<comment><USER4> "then why YC?"

This stood out in the post:

"If I could only pitch you one reason why Y Combinator is worth it, it would be the people."

Exactly. And along the same lines the reason that I always give for why it's good to go to a "known" grade a institution (say a top business school if that is your major) is not necessarily for the education but because of the people that surround you and raise the experience level.

In other words a higher degree of non slackers and people who are serious just like you are. Of course they exist everywhere. But there are generally more of them at the top schools. And likewise there are more of them in YC. (And if you read some of my other comments you will see that I'm not a fanboy by any means but this benefit stands out clearly to me..)

And this doesn't even have to do with whether those people became life long friends or associates or not (although that is icing on the cake for sure). It has to do with the immersive experience in being in that type of group.

<comment><USER3> I appreciate the remark, that said Speaking as a person whose gone to some of those schools.... That doesn't make me feel excited. While I learned a lot in those envs, they were toxic and homogeneous in many ways.

Also I'm deep enough in some OSS ecosystems these days that I already have the pleasure of being the (in my mind) slacker in a community of amazing technologists.

Heterogeneity and brilliant folks who are wildly different from me, who I can still communicate with, are how I thrive. Variety is good for the brain!

I'm not in any way suggesting YC isn't great for most folks. I'm pretty weird, being an general extrovert and a deep technologist in the same day is a really odd combo. Both as a help and hinderence

</comment></comment></comment><comment><USER5> Just curious, are there any reports/posts of people or companies who think that Y Combinator was not worth it?

</comment><comment><USER6> As to the usefulness and worthwhileness of YC there cannot be two opinions. The affection and praise of the alumni alone would prove the point even before you consider the companies that have built out of it. And at the heart of that is what Walker points to quite clearly: candor and the clear support that can only spring from it.

<comment><USER7> There "cannot be two opinions?" Actually, there can be as many opinions as there are people (not just companies, but individual people) who have gone through the process. And they can reasonably vary, because not everyone and not every company _needs_ YC or something like it, or can necessarily even benefit from it.

It's ridiculous to suggest that YC is a universally positive experience, just like it's ridiculous to suggest it's completely without value (based on the significant praise you refer to).

<comment><USER8> Honestly curious, is there any company you know of who has publicly stated they weren't happy they went through YC? Not saying it's conclusive either way, would just be interesting to read why.

<comment><USER9> I do know founders who've said as such. Wouldn't say it publicly, I'd imagine.

</comment></comment></comment></comment><comment><USER10> I can say unequivocally entering YC is one of the best decisions I have ever made both personally and for my business.

I'll let others debate the monetary economics of YC and just say that the YC network effect is the most under-rated aspect of YC. Both the W14 batch mates and the YC alums from past batches have been amazing in terms giving us strategic and tactical advices. This aspect of YC simply can not be ignored.

<comment><USER11> Completely agree. This line sums it up best "If I could only pitch you one reason why Y Combinator is worth it, it would be the people.". I don't know any other place in the world where you can meet such a concentrated group of amazing, brilliant individuals (and companies!)

</comment></comment><comment><USER12> If you don't care so much about access to investors, but do want a community of like minded entrepreneurs I'd check out the Startup Chile program. It's not for everyone but it is 40k equity free, and everyone is working on something they are passionate about and it has a really strong community where everyone helps and listens.

Downside is no prestige and of the few investors it does attract, they tend to be low quality by SV standards.

<comment><USER4> "Downside is no prestige and of the few investors it does attract, they tend to be low quality by SV standards."

Taking you at face value (meaning I don't know the facts and I'm relying on what you are saying..) that's a huge downside.

Prestige is important. While YC is not Harvard have you even noticed how many doors going to Harvard, Wharton etc. open? That said not everyone with an open door is able to capitalize on it but I'd say it's a pretty big advantage to have.

Once again, this is based on my many years in business. I have nothing to gain from touting YC and I have been critical at times as well.

</comment></comment><comment><USER13> I doubt I'd find a YC-ruined-my-startup article. To me this seems like more confirmation bias for those that drink the kool-aid.

</comment><comment><USER14> Thanks for posting this Sam!

If anyone thinking about YC has any follow up questions, happy to answer them here. It truly was an amazing experience for us.

<comment><USER15> Hey Walker, great post. I remember you starting this while at Brown, and I also remember when FishCo was shut down. I did NOT know someone used a Pokémon card for an ID. Totally believe it though :)

Inspiring story, and I'll be in touch.

</comment></comment><comment><USER16> I agree with this. People ask me all the time what I thought about my experience at YC was like. And my answer usually comes down to being with the people. When everyone around you seems to be smarter, work harder, and be more driven, you really push yourself too. But, it was also a supportive community. Everyone wanted to see everyone else succeed. Basically, it was a good support group for those days (and there were many) where you just felt down in the startup dumps.

The good news is that you don't necessarily need YC to have much of that experience. If you build a good network around you, with lots of hard-working and positive people, it helps a lot.

</comment><comment><USER17> Is there a breakdown on YC accepted companies by product stage? How many companies were accepted that were already deployed, making money, and growing vs brand new ideas not yet developed? How many companies with significant month-over-month growth are ever rejected?

From the articles I see lately, it seems like there has been a pretty big shift at YC to help companies go from $1MM to $500MM rather than $0 to $1MM. Everything appears to be about pre-existing growth now.

<comment><USER18> _Everything appears to be about pre-existing growth now._

It would be a disaster if that were true, because in this type of investing as in any other, returns are proportionate to risk. Fortunately it isn't. As I said in another thread, a quick sample of the current batch suggests half had no growth when YC accepted them.

YC does face a danger in this respect, because as it gets better known, there are an increasing number of applications from fairly established startups. To avoid that danger we make a conscious effort to fund risky outliers. E.g. the 17 year old kid from Bulgaria with zero revenues or users.

<comment><USER17> It will be interesting to see how YC continues to evolve. In the early days it seemed like it was all about early, early investing (come to San Francisco and build your product, we're betting on you as a founder) to today where 50% of the open slots are no longer even available to these types of startups since they are taken by established companies.

Seems similar to how things like the Olympics evolved. At first participants had to be amateurs but later they started letting in the professionals and the amateurs could no longer even qualify. Good to see that there is a concerted effort at YC to continue to fund the amateurs but I can only assume that will be harder and harder to justify in the future.

<comment><USER2> You shouldn't think in terms of "open slots". We accept all of the companies that seem like good bets, and we don't know how many that will be until interviews are complete. Teespring coming in with a million in revenue didn't push out some other pre-revenue startup.

</comment></comment></comment></comment><comment><USER19> This is the one consistent exception to Betteridge's law of headlines

<comment><USER20> I was just going to post NO for that reason only.

</comment></comment><comment><USER21> No matter how you slice it, ~$14k for 6% is a terrible deal.

<comment><USER14> Hi Nawitus. I completely understand that line of thinking, and it should have been especially true for us given that we'd been running for about 1 year and had $1m in sales at the point where we joined YC.

What I can tell you is that we thought about in the same way as bringing on a co-founder or superstar employee. The value of YC isn't measured in their investment, but rather the value they bring.

Even in terms of the boost to our valuation alone from the validation, beyond everything else, YC more than paid for itself. If you look at our growth graph there's also a sharp inflection that starts shortly after we joined the program. That could be unrelated, but it's my strong belief that it was the value of the program that helped us accelerate.

<comment><USER21> Everyone seems to compare "doing YC" to "not doing YC", which is a false comparison. YC can easily be better than not doing anything, but that doesn't mean it's even close to the best alternative. You could've sold 4% of equity for x million $ and used that to grow your business, for example.

<comment><USER14> I see what you're trying to say, but money is often not the issue - it's the connections and expertise that are so valuable. In my humble, and admittedly limited, opinion the network and community and shared experience/expertise that YC brought far outweighed any million dollar investment we could have taken (and no investor would have even considered giving us millions).

We ended up raising millions (about $22M in the last year), and I don't know if it would have been possible without YC. All our investors and intros came through the network we built while in the program.

Hope that makes sense, of course this is all my opinion and you can evaluate and come to your own conclusion - I just wanted to share my experience and perspective!

</comment></comment></comment></comment><comment><USER22> Unequivocally, yes.

You can haggle over the $'s and %'s all day - but what you can't argue over is where your company stands after YC, especially in the eyes of customers & investors.

Some people have the ability to never worry about investors, but for those who don't, it is insanely helpful. And most of the shift in opinion is based on how your product is being used by customers, which is the primary focus of many YC partners.

Once again for good measure: Yes.

<comment><USER23> After YC - Customers? Please talk about Investors. Customers have no regard for YC. They look at your company and your product, your value addition. Which probably you've already proved, by the time you've gotten into YC.

<comment><USER24> If your other customers are also companies then the YC brand may have an effect (e.g. Stripe). If it's for consumers, maybe not (e.g. Airbnb).

</comment></comment></comment><comment><USER25> "Worth it" meaning worth the equity you give up? Are there downsides other than giving up 2-10% of your company?

<comment><USER26> The relocation and the time it costs. xD

</comment></comment><comment><USER27> Thanks for sharing this! I've never understood how startups snub Y combinator because it "only" offers $17,000. Think long term!

</comment><comment><USER28> For me coming from outside the US, YC is just as much about getting a crash course and network in SV.</comment>


Update Regarding Add-Ons in Firefox - <AUTHOR> https://blog.mozilla.org/addons/2019/05/04/update-regarding-add-ons-in-firefox/ <comment><USER5> I have a bunch of privacy-enhancing addons installed, which have now all been disabled. If I hadn't read HN this morning, I wouldn't even have known why. Until now, I had no idea that it was even possible to remotely disable my addons.

And now Mozilla are saying that the "fix" is to allow them to install & run "studies" on my machine? What are they smoking? I'm having a hard time trusting a company that randomly & remotely disabled all my addons, regardless of the cause.

<comment><USER6> I enjoy a nice cup of outrage in the morning just like the next guy, but this one is really weak and lacks that fresh taste of evil conspiracy that I really crave.

You use a browser that has remote update capability, which allows them to install and run new software on your machine all the time. There is a whole separate section of the Preferences that says "Privacy" in large print that has a section that clearly identifies the Studies feature and lets you turn it off. And you use a browser that lets you install privacy-enhancing add-ons in the first place, and in fact which invented the whole concept of add-ons. When the browser discovered that it couldn't verify the add-on integrity with a valid cert, it did what it's supposed to do, it disabled them to protect you from someone backdooring these add-ons.

Someone at Mozilla fucked up, and they're trying in good faith to fix it. I don't know what else people are expecting them to do, putting on sackcloth and ashes won't resolve the problem.

<comment><USER7> Here's the thing, though: yes, we most certainly are giving them a lot of trust by allowing them to install software on our machines. Which means outrage when they screw up is _totally_ justified, because they broke that trust.

Here's a metaphor: Let's say you let someone seemingly trustworthy watch your kid. (In this metaphor you have a kid). And they let your kid get a broken arm through gross negligence (let's say they passed out drinking beer), and then someone said "well, obviously, you should have never trusted that person, after all, they can do anything with your kid while you're gone, so why are you outraged?" You probably would still be pretty outraged right? You would certainly question your decision to trust them, but at the end of the day you have to trust someone, you'd be a complete shut-in if you could never hire a baby-sitter.

</comment></comment></comment><comment><USER8> At the minimum they should add a testsuite that runs at least a month into the future to catch these kinds of things.

There was a similar issue[0] a few years ago that was only caught a month in advance.

Even better would be to set things up to only do a verify on install instead on every startup.

[0] [https://bugzilla.mozilla.org/show_bug.cgi?id=1267318](https://bugzilla.mozilla.org/show_bug.cgi?id=1267318)

<comment><USER9> > _Even better would be to set things up to only do a verify on install > instead on every startup._

That would defeat the purpose of verification: "Add-on signing in Firefox helps protect against browser hijackers and other malware by making it harder for them to be installed." [1]

And it's not just malware that was doing that. Microsoft force-installed the ".NET Framework Assistant" into Firefox on Windows, and you had to edit the registry to remove it. [2] If I recall correctly, AVG and Logitech were also among the list of offenders.

[1] [https://support.mozilla.org/en-US/kb/add-on-signing-in- firef...](https://support.mozilla.org/en-US/kb/add-on-signing-in-firefox) [2] [https://support.microsoft.com/en-us/help/963707/how-to- remov...](https://support.microsoft.com/en-us/help/963707/how-to-remove-the- net-framework-assistant-for-firefox)

<comment><USER10> Could you explain why verifying on every startup, instead of just on install, is necessary? The page you linked doesn't mention it.

Edit: Let me amend my question - why is it necessary for the certificates to expire? If a plugin is signed by Mozilla, why wouldn't it be trusted once it gets old?

<comment><USER11> > Let me amend my question - why is it necessary for the certificates to > expire? If a plugin is signed by Mozilla, why wouldn't it be trusted once it > gets old?

I asked essentially that question earlier, and received some good answers explaining why [1].

Briefly, if something is signed by an expired certificate, whether or not you can trust the signature depends on whether or not the signing took place while the certificate was not expired.

If all you have is the thing and the signature from the code signer, you can't tell for sure when it was signed. If a bad guy has obtained an old signing certificate and its keys, that bad guy can generate new signatures that claim to have been signed while the certificate was valid.

Some code signing systems, such as the one in Windows (and I think the one Apple uses) also use another certificate, from a timestamp service, to prevent this. The way a timestamp service works is you send them a hash of a document, and they generate a certificate signed by them that essentially says "We were shown this hash on this particular date/time".

When you include the timestamp certificate with the signature from the code signer, then when you come across code that was signed by an expired certificate but purports to have been signed while the certificate was still valid, you can check the timestamp certificate to see if that is true. If it is, you can still consider the code signing to be valid.

Forgetting to renew a signing certificate is still bad even if you do this, but not as bad. If Microsoft or Apple forget, it doesn't stop existing applications from working, so end users aren't immediately impacted. It does stop developers from shipping updates or new applications, so still would be a big deal. I could see a bad guy noticing that a company always updates expiring certificates one month in advance, say, and then noticing that a certificate is expiring in just a week, infer that the certificate renewal has slipped through the cracks and is going to expire, and time the use of a critical zero day exploit to fall in the window when updates are broken by the expired certificate.

[1] [https://news.ycombinator.com/item?id=19824017](https://news.ycombinator.com/item?id=19824017)

<comment><USER12> I checked the hash functions for the xpi, its broken MD5 and broken SHA... which doesn't matter for a running instance if FF takes care to download it from their own servers over HTTPS... but in the attack model you describe it is retrieving the signatures from an untrusted disk.

[https://news.ycombinator.com/item?id=19830228](https://news.ycombinator.com/item?id=19830228)

</comment></comment></comment></comment></comment><comment><USER13> IMHO it seems problematic, that they can remotely push code changes, including replacement of trusted certificate, and bypass package managers.

I don't expect software to (significantly?) change during runtime, outside of what was packaged, signed, distributed and installed as part of apt/yum/pacman/etc.

I understand (not that I like or agree with) that some apps are just embedded web browsers, and load everything externally, and that Firefox extensions are in the end just some JS/CSS/HTML loaded outside of system's package manager. However, extensions have limited API they can interact with, and you need to allow permissions for each extension. Having Mozilla owned extension, that can modify core functionality, seems a bit scary.

<comment><USER14> If you didn't have browsers auto updating no-one would update them manually, meaning bad news for web developers wanting to take advantage of newer features.

<comment><USER15> I understand the appeal of that for developers but it comes at the cost of users agency and control of their own system, I've been very annoyed with even simple UI changes in firefox updates as I simply didn't ask or want any such change. Reading other comments here it's clear I'm a dying breed of old and stubborn users that prefers full control and agency over my own system. Making it easier for web developers to implement new features is absolutely not a tradeoff I'd make willingly at the cost of my systems consistency and reliability. Also the reason I use firefox is because of all the major browsers vendors they seem the most aligned with those values although this seems to be changing more and more every year.

<comment><USER14> Mozilla/Firefox have the Extended Support Release (ESR) for you.

[https://www.mozilla.org/en- US/firefox/organizations/](https://www.mozilla.org/en- US/firefox/organizations/)

</comment></comment></comment></comment><comment><USER16> I wonder if there is someone out there in the middle of the ocean with a browser extension based communication and navagation system which is dead in the water?

It sounds to me that the real headline here is that every copy of firefox out there was timebombed and we only noticed because someone forgot to elongate the fuse.

<comment><USER17> The browser itself continued working fine. Are you aware of any life-depending extension? Leaving this particular issue aside, your hypothetical "browser extension for people in the middle of the ocean" was doomed from its inception if it was designed to run as a browser extension (though it opens the door for an interesting discussion about similar scenarios that _are_ happenning, like pilots relying on ipads)

<comment><USER18> > your hypothetical "browser extension for people in the middle of the ocean" > was doomed from its inception if it was designed to run as a browser > extension

Why? You haven't backed up that statement at all. Especially before they killed XUL it was easy to make a non-doomed app that runs as a browser extension, and it's still plenty possible.

No (non-demo) program should brick itself if it can't connect home.

</comment></comment></comment><comment> open-source-ux I hate to say all these things because I use Firefox all the time, but...the communication around the add-ons issue has been poorly handled by Mozilla. I only learned of the problem by visiting HN. But what of the thousands of other users who don't visit HN?

If you visit the Mozilla homepage, there is nothing to acknowledge the problem (at least at the time of writing this message). Let's try the Support page. Where is it? Scroll down to the bottom of the lengthy Mozilla homepage to the page footer to find the link. (How many visitors will make it to the bottom?)

When you click through to the Support page, an easy-to-miss banner in tiny text appears at the top of the page that mentions the problem - <USER2> here: [https://imgur.com/a/TAHZSWa](https://imgur.com/a/TAHZSWa)

Additionally, when the add-ons are disabled, Firefox misleading says: "These extensions do not meet current Firefox standards so they have been deactivated". This is probably a generic message but it's also an example when a generic message is misleading.

Finally, poorly-named settings like "Normandy" and "studies" that give no hint of their meaning only adds to the confusion.

<comment><USER19> The way I see it, people might have gotten used to software break from time to time. Once software breaks it is reasonable to expect it to get fix in a couple days when it is updated. At least this was probably the experience for the majority of users, those that noticed the issue.

<comment><USER20> The sad reality is Mozilla has been losing mindshare to Chrome for a long time and this will rapidly accelerate it. People don't expect things to break. They expect things to work, and when things break they get angry.

I love Firefox. It's my daily driver. It will continue to be. But this is a huge fuck-up and they're probably going to pay big in usership because of it.

</comment></comment></comment><comment><USER21> I'm interested in the general writeup what went wrong that they missed this certificate expiring. That's a structural problem.

Also why it took 6 hrs to assign P1 to the bug

<comment><USER22> > Also why it took 6 hrs to assign P1 to the bug

Because people were staying up until the wee hours of the morning working on fixing it instead of toggling priorities in Bugzilla. This was treated as a five-alarm fire.

<comment><USER23> I agree with you, it was more important to do the work than to signal.

However, I bet it's likely they have procedures and policies for work that first involve signaling like for example the priority level.

I'd be willing to bet lots of things surrounding this issue weren't handled in a by the book manner. So if you are always going to wing it, why have a book (or a public priority level system) at all?

<comment><USER22> First, because priority is for things like major feature work, so that engineers can find the bugs that are useful to work on. In this case, everyone in the team responsible was already spending 100% of their time addressing the issue.

Second, because we care about solving problems, not being bureaucrats.

<comment><USER24> Really? Because being the bottleneck (i.e. single point of failure) responsible for approving all addons is exactly what bureaucrats would want to do ;-)

The non-bureaucratic thing to do, as has been pointed out many times of course, would be to give users the power to override the cert signing check as an advanced option.

<comment><USER22> It is, in fact, an "advanced option", in about:config.

<comment><USER24> But that option only works in nightly builds, not Firefox release builds. If an option doesn't honour what it claims to, imho it might as well not be there.

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> I know Firefox isn't being malicious, but ugh, this seems like the worst possible PR move for this, optics wise. "Hey so uh, we accidentally broke your browser, so you need to opt-in to becoming a guinney pig. But don't worry! You probably were already opted in anyway and just didn't realize it! Also it might take six hours to work."

<comment><USER25> So that's pretty unfair. 1) They state they are working on a fix for normal, release channel users who don't want to run studies 2) they tell you to temporarily run studies to get the fix within _up to_ 6 six hours (could be faster; set expectation) 3) You can explicitly install nightly or 66.4 before it's pushed if you want a fix now

Yes, it's unfortunate, I'd expect them to meet it head on, push a tested fix in a timely matter, admit a mistake was made, explain publicly how/why and apply learning moving forward. Beyond that, what's your expectation?

<comment><USER7> Not saying that their current actions are _wrong_ , just that the optics of it are terrible for them.

There was a chain of bad decisions that led them here though: 1) thinking it's ok to disable software after its installed (using cert expiration -- I'm ok if the cert was _revoked_ but that's a totally different discussion), 2) Taking more control of people's local software than many people are comfortable with, especially considering that their main market is tech savvy people that tend to be more sensitive to this than most 3) Making some of these things opt-out rather than opt-in, giving the perception that they may value data collection and control more than their users privacy.

<comment><USER26> > their main market is tech savvy people that tend to be more sensitive to > this than most

Is that so, though? Firefox is still being used by millions of users, and I doubt those are only the tech savvy internet users.

(Then again, this mostly applies to Firefox users using add-ons, which probably has a higher share of technical users.)

<comment><USER24> One of their biggest 'selling points' is that they protect your privacy. It's really, really off brand for them to be distributing a critical bugfix through a _telemetry collection_ channel.

<comment><USER12> it does feel like the normalization of deviance

it's also entirely predictable that a non-negligable fraction of users -after enabling studies and verifying everything works again- will ... simply go on with their lives and forget about disabling studies...

I also don't understand why the certificate graph is not exposed through a user interface, so that the user can add and remove certificates, or enable and disable certificates at their own discretion. This should have been obvious when the certified add-ons were introduced. Then all they would have to do is host the certificate file on their own domain and everyone could follow the simple steps in the GUI to replace the expired certificate...

</comment></comment></comment></comment></comment></comment><comment><USER27> An article that mentions a timeframe of "the next few hours", but doesn't have any timestamp besides a date without a timezone.

<comment><USER28> You can hover the date to see the full timestamp, it's 2019-05-04 07:01:35 UTC-7.

<comment><USER29> It's an annoying UX antipattern, the only thing worse being not adding the on- hover text at all. Displaying date and time should be the default.

HN has this problem too.

</comment></comment></comment><comment><USER30> Granted I'm using Nightly (and previously disabled extension signing in about:config), but now all my themes are disabled, even the default one apparently, though that is what it is using. Cannot be re-enabled. When do I get my dark theme back?

Also...my default search engine is now Amazon.com?? WTF is going on.

EDIT: Also my only search engine. Heck of a job Mozilla.

<comment><USER31> Bezos and his strategy to name the company something starting with A so it always comes first finally pays off.

<comment><USER30> Now I understand why Google renamed itself Alphabet. One step ahead, literally.

<comment><USER32> Have you been able to restore your search providers? Really a kick in the nuts, this one..

<comment><USER30> Nope. Maybe I should restart Nightly again but...I just added Google back, and it was not as easy as I'd expect. The Firefox "add search engines" page is a mess and straight Google search was like 3 pages down.

Also I found another dark theme that is somewhat similar to what I had (but not official Mozilla) and installed that. All the default ones are still disabled.

<comment><USER32> Thanks.. Same here on every machine.. The hotfix update has been installed and add-on functionality is indeed recovered, but still i only have "amazon.com" as a pre-installed search provider and have been unable to restore them to their default settings without creating a completely new profile. Besides, i would be rather hesitant to install search providers from that list, imho.

</comment></comment></comment></comment></comment></comment><comment><USER33> For me (repository firefox on ArchLinux), the temporary fix was setting devtools.chrome.enabled = true in about:config, and running this small JavaScript snippet in Chrome DevTools (Ctrl+Shift+J):

[https://wiki.archlinux.org/index.php/Firefox#Firefox_disable...](https://wiki.archlinux.org/index.php/Firefox#Firefox_disables_all_extensions_due_to_Mozilla_not_renewing_their_certificates)

AFAIK, this will enable all the disabled add-ons until the next check, which is in 24 hours. This will be hopefully enough time for Mozilla to release a stable channel update, instead of the "Studies hack".

At least for me, fiddling with the Studies settings had no effect; the about:studies page remained empty regardless of what I did. I've also seen multiple reports from people who got the Studies hack working that the fix actually failed to address the issue properly.

<comment><USER34> On Linux you should also have the option of disabling the cert signature check. Go into about:config and set `xpinstall.signatures.required` to false. Just remember to set it back to true once this is fixed.

</comment></comment><comment><USER35> Very curious how the decision to use the Studies program happened. Why not just roll the version early and include the fix in the new version - isn't Firefox an evergreen browser now? Maybe there is extra bureaucracy to roll a new version, or the hotfixers didn't have permission to do it. Either of which I can understand, being that they made the fix late on a Friday night - <USER3> huge kudos to those who worked hard to get this fix started. Seems like a good case study for lessons learned here, I'm eagerly anticipating the postmortem and follow-ups.

<comment><USER36> Doing a full release takes a lot longer, so they presumably decided to use a faster method where possible. [https://hacks.mozilla.org/2018/03/shipping-a- security-update...](https://hacks.mozilla.org/2018/03/shipping-a-security- update-of-firefox-in-less-than-a-day/)

</comment></comment><comment><USER37> Certificate expirations show up on causes of outage lists so frequently, yet little has been done to address the underlying issues of how PKI works to address it. The core issue of time limits on trust and no specs and requirements on how to handle the most common case of saying "yes, this is still trusted" is oddly absent.

Could we have for example a publicly verifiable ledger that can be used to verify a cert chain with not only a defined workflow to answer if a cert is still trusted but also a requirement for the workflow to be fully implemented? Seems quite doable, vs sort of hacks of auto-renew which are hit and miss depending on the CA.

In other words, when do we fix the sport rather than the players here?

</comment><comment><USER38> Interesting. Sadly, I imagine many users will have studies disabled since the Mr. Robot incident. I've re-enabled it but there does not appear to be a way to force it to check for updates. Guess it will show up in the next 6 hours.

<comment><USER39> You can set app.normandy.first_run to true and then restart Firefox.

<comment><USER40> I've seen the same tip elsewhere and tried, but didn't work for me.

What did (seem to) help was setting app.normandy.run_interval_seconds to a small value (21). At least just a couple of seconds after I did, all my addons came back.

Edit: plugins -> addons

<comment><USER18> Remember to put it back to normal after!

</comment></comment></comment></comment><comment><USER41> The most frustrating part of this for me is there is no (relatively) easy way to override this behavior. Its fine to disable the addons, but please allow me to "understand the risks" and continue against Firefox's recommendations.

The feeling of no control over my web browser was why I left Chrome in the first place.

</comment><comment><USER42> On Android I get this:

>We rolled out a hotfix that re-enables affected add-ons. The fix will be automatically applied in the background within the next few hours. For more details, please check out the update at [https://support.mozilla.org/en- US/kb/add-ons-failing-install...](https://support.mozilla.org/en-US/kb/add- ons-failing-install-firefox)

Which is like "we did something we shouldn't have causing unauthorised changes to your computer, so we're going to make unauthorised changes to fix it".

Quite telling is that this is supposed to protect us from other developers. On the add-on screen "Enable" is greyed out, there's no "Enable even though Mozilla doesn't like it".

The UX is just like the "fuck you this computer isn't yours it belongs to Microsoft and we'll do what we like with it" that I thought I'd left in the past decades ago.

It's not your computer Mozilla, you fucked it up, you don't get to mess around with it without asking the owner.

My understanding is that this is literally illegal in the UK.

Mozilla barely had any trust left to burn IMO but they sure went all out.

<comment><USER26> If Mozilla had barely any trust left than the industry as a whole is truly fucked.

<comment><USER43> I could say that for reliable software like SQLite or curl.

But for Firefox? My expectations for browsers in general aren't anywhere high enough to warrant raised eyebrows even in the face of monumental fuckups like the one were seeing today. Specially because users tried to warn that this could happen and Mozilla stubbornly said NO: [https://news.ycombinator.com/item?id=10038999](https://news.ycombinator.com/item?id=10038999)

</comment></comment></comment><comment><USER44> Can we take a moment and consider the side effects?

This is a once in a lifetime chance for Google & Co. to get a glimpse of all those sly fuckers hiding behind adblockers.

This effectively uncloaked a very specific subset of Internet users and exposed them to the very companies that they've been actively trying to avoid. Not just those who avoid Chrome, but those who take extra steps to explicitly evade the tracking.

Surely Mozilla, the privacy advocate, must understand the impact of this fuck up, and yet the offered "fix" doesn't even mention a one-click .xpi install, but rather asks to enable a mechanism that, if left enabled, will grant unnecessary control to Mozilla over people installs.

This ain't right.

<comment><USER45> For me at least, it was pleasantly surprising that Google either has no inventory or just no clue who I am, as when ublock got disabled by this bug, YouTube started presenting me with ads for cars in mostly Japanese, with prices in Yen and "Singapore stock also available".

I guess because I watched anime videos?

<comment><USER46> It would be interesting to see what they show for me, but I'm avoiding surfing websites other than HN until it gets fixed (FF for Android).

<comment><USER47> You can disable the signature verification on Firefox for Android, using about:config and searching for the flag named 'xpinstall.signatures.required'.

Perhaps leave yourself a note to change it back once an update ships : )

</comment></comment></comment></comment><comment><USER48> Mozilla decided to make signing mandatory, then screwed up and now they're trying to fix it by making use of a feature that basically allows them to remotely execute code on all their users silently?

I checked Mozilla's main site again, and it still has this ironic statement in its description tag (it's been there for many years):

[https://www.mozilla.org/en-US/firefox/new/](https://www.mozilla.org/en- US/firefox/new/)

 _Firefox is created by a global non- profit dedicated to putting individuals in control online._

...I guess it's more dedicated to putting _Mozilla_ in control now. Something about this whole incident brings up a point that just feels very wrong to me --- it's not a Google or Microsoft, but the fact that Mozilla also seems to have this large amount of control over its users is unsettling.

</comment><comment><USER49> I'm not gonna bother with 'studies' or manual workaround - I'm just going to wait for an update.

In the meantime I'm enjoying trying out Vivaldi[1] - really reminds me of opera 3/4, that I loved.

1: [https://vivaldi.com](https://vivaldi.com)

<comment><USER50> Will Vivaldi let me put the tabs on bottom where they belong?

<comment><USER51> What? Tabs belong on the side. In a tree. ;-)

</comment></comment></comment><comment><USER52> Instead of enabling studies just click on this link. It installs that specific "study" (hotfix) without installing anything else.

[https://storage.googleapis.com/moz-fx-normandy-prod- addons/e...](https://storage.googleapis.com/moz-fx-normandy-prod- addons/extensions/hotfix-update-xpi- intermediate%40mozilla.com-1.0.2-signed.xpi)

<comment><USER53> How do I uninstall this? It doesn't show up anywhere after installation.

<comment><USER54> `about:studies` will show active studies and allow you to remove

<comment><USER55> I am not sure on others, but it does not show in "about:studies" on mine since I manually added it.

<comment><USER52> Same.

</comment></comment></comment></comment></comment><comment><USER56> This one will be emotional as this destroyed some of my today's work.

F __ __you Mozilla. I lost all my tabs opened in other containers. The containers don 't work too, so I cannot reopen them.

This bug has been known for 3 years, and you did nothing to fix it. You get so much money, and what you do is basically provide a pathetic software (thunderbird) and a nice browser (which you just stopped from working) and you show me banners asking for more money.

You should be ashamed. 3 years. And no, I'm not going to listen things like "this is open source, you are free to fix it". I will just go and switch to another browser. I need a browser which works, not a one which suddenly decides that my stuff should be broken because all the developers and managers have been ignoring a critical issue for a couple of years.

:( I know, this will be flagged, and removed. I don't care, I just need to get all my tabs in containers back. I have never thought that a browser can just close my tabs because a certificate expired.

<comment><USER57> I lose all tabs occasionally. Browsers aren't perfect, it does happen after a weird crash, or something. It's exceedingly rare, like maybe twice a year.

With that said, I've always considered tabs to be volatile state. Browsers make their best effort to e.g. restore the previous session after a crash, but if you want non-volatile browser state, you should use bookmarks.

<comment><USER58> It's not just tabs, but for many users the containers themselves are gone - <USER4> well as their cookies and other associated assumed-to-be-non-ephemeral state.

<comment><USER59> Yep. I just got hit by the bug. Enabled studies, got the fix, but all my configured containers are gone. NOT happy right now.

</comment></comment></comment></comment><comment><USER60> This is why you always have one of your employees keep their clock 30 days in the future.

Preferably someone who doesn't go to meetings and installd updates.

</comment><comment><USER61> Another workaround if you don't want to enable "studies" is to manually re- load the add-ons in Debug Mode. I don't know the full consequences of this, but Firefox seems to be behaving normally having done it.

Go to about:debugging from the address bar. Right at the top is a button to "Load Temporary Add-on", with a checkbox "Enable add-on debugging". (On a Mac, the add-ons are in ~/Library/Application Support/Firefox/Profiles/«ID».default/extensions (assuming that you have only a single profile).) They should stay enabled until Firefox relaunches.

</comment><comment><USER62> From a UX point of view I don't know why tools don't have these two features:

1\. "Warning, a critical method for verifying authenticity is set to expire in X days. Please visit <Y> to update now."

2\. "A critical verification certificate has expired; while you should immediately go to <Z> to obtain an update, you may defer authentication for up to 5 more days."

...or in other words, why can't tools cut us some slack on either side of a deadline? Security for most things is not going to fall apart just by giving people a little room to deal with issues on their own schedule.

<comment><USER63> That would be assuming this would ever happen, which clearly Mozilla didn't expect, wrongly. It's a shame, but eh! Mistakes were made. Precautions will hopefully be made.

</comment></comment><comment><USER64> How long until heads roll?

There's something really wrong with the organization.

And I thought it was only their marketing/pr that was bad.

> We can't afford to lose Mozilla and Firefox.

[https://news.ycombinator.com/item?id=18800360](https://news.ycombinator.com/item?id=18800360)

<comment><USER65> nowadays they seem to make it a hobby to make negative headlines at least once every quarter. I fear there will be no negative repercussions for the leadership.

Basically, the management set their own salaries, the entire work force gets a 40% yearly bonus, and they have no one from the outside to report to.

On top of all of this, the money flows regardless of what anyone is doing. (While there is a yearly loss of 10% of their users, the past deal with Verizon made them very rich, so they can go like this for years). Revenue has been only going up, despite a loss of absolute users. So this explains why they continue to do bad things even though outside observes can not understand - during the last 5 years losing users did not impact their financials in any meaningful way. While people were complaining and users leaving the product, revenue was increasing.

They do take care of their employees with lots of benefits and other stuff, so as an employee you don't want to risk all that with speaking up against your superior.

Over the years they have created a company culture where there are endless number of small teams doing irrelevant stuff, with absurd hierarchies, with some people doing no work at all. With 16 people in the upper management, there's also fragmentetion of decision making going on. It's all a bit headless.

Due to the complicated hierarchies in the company everyone is content with doing just enough to not make life harder for anyone else - suggest to change things fundamentally and actually work on delivering a great product and you will not get very far.

<comment><USER66> This is categorically untrue, and unhelpful.

<comment><USER65> some things I wrote I can not prove, that is right. I would love to revise my negative opinion in light of better evidence.

</comment></comment></comment></comment><comment><USER67> Sadly, this removed my settings for multi-account containers extension :(

<comment><USER67> Just heads up here. I was able to restore it partially on Windows using [https://www.shadowexplorer.com/downloads.html](https://www.shadowexplorer.com/downloads.html) (which is, btw, a great tool!)

You'd be looking for a file C:\Users\YOUR_USER_NAME\AppData\Roaming\Mozilla\Firefox\Profiles\YOUR_PROFILE\containers.json

and also ...\YOUR_PROFILE\browser-extension-data\@testpilot-containers

<comment><USER68> Thanks, you just saved me a headache.

</comment></comment></comment><comment><USER69> (disclosure: I am a Mozilla employee but not commenting in any official capacity)

"Give me control over what code I run on my computer" (meaning "provide a switch to disable the requirement that extensions be signed") keeps coming up over and over. And perhaps it hasn't been clearly stated but the problem is this: if there's a switch that a user can flip, the browser has to record the state of that switch somewhere (presumably on disk). If such a switch becomes available, we'll quickly be flooded with malware that flips that switch without users' consent. At that point, there's no way to tell the difference between savvy users making an informed choice to enable unsigned extensions and malware doing it behind their backs. The browser can do various things to obscure the way that setting is stored, but ultimately any method the browser uses to read and write the state of that switch is something that other software can easily mimic.

This is not a theoretical concern, a modern web browser target is an irresistible target for all sorts of get-rich-quick scammers -- if you don't experience this day-to-day its due in no small part to the fact that browser vendors among others are constantly working to keep the bad guys at bay. But make no mistake: the bad guys are out there and they quickly find and exploit any opportunities that are available to them.

So as to the problem of how to let users disable signing but ensure that they have made a conscious decision to do so, there is a stark tradeoff here: giving the most savvy users that switch necessarily makes other users less safe. The solution that Firefox has opted for here is to handle this tradeoff differently on different channels. The release channel (aka the stable channel, or the thing you get by default when you download Firefox) is intended for a very wide audience, and so it handles this tradeoff by favoring safety for all users regardless of their level of technical knowledge. The developer edition and nightly channels are intended for more technically savvy users and they handle this tradeoff differently; specifically they do provide a switch for disabling extension signing.

If there are other (practical and effective) ways to solve this problem of determining true user intent, I (and I'm sure many many others) would be very interested in hearing about them. In the mean time, using the mass-market versus developer-focused channels as a signal for users' preferences on the risk-configurability continuum seems like a reasonable way to handle this.

<comment><USER70> My gripes with the switch paradigm are that it:

a) isn't transparent

b) doesn't empower the user

c) isn't easily modifiable

a), b) and c) are the exact opposites of what open source software is meant to stand for. Firefox is slowly losing its unique position of being an amazing open source browser in favor of what seems to me a negligible increase in user security. In my mind, Mozilla is wasting time on micromanaging user risk instead of actually innovating.

To put it this way, every time I go out biking, I can get hit by a car. It is a known and well understood risk, one that I have to consider whenever making a turn. However, riding a bike also provides chances to go faster, meet new people and so on. Should Firefox aim to reduce my risk of being hit by a car? No, because I get to choose the level of risk in my life, not Mozilla.

<comment><USER69> You can choose the level of risk. If you want to run unsigned extensions, use Developer Edition or Nightly.

</comment></comment></comment><comment><USER50> So the studies update has hilariously enabled my essential legacy extensions while leaving my more modern WebExtensions still disabled. Way to go, Mozilla.

</comment><comment><USER71> From ghacks (comment section): [https://www.ghacks.net/2019/05/04/your- firefox-extensions-ar...](https://www.ghacks.net/2019/05/04/your-firefox- extensions-are-all-disabled-thats-a-bug/)

This should allow the extensions to work until the next check (Verified locally):

1) Shut down Firefox

2) Open extensions.json (located by about:profile -> Root Directory)

3) Replace all instances of "appDisabled":false to "appDisabled":true

4) Replace all instances of "signedState":-1 to "signedState":2

5) Save and close extensions.json

6) Start Firefox

7) Close Firefox

8) Open extensions.json

9) Replace all instances of "appDisabled":true to "appDisabled":false

10) Start Firefox

11) Disable and re-enable all extensions in about:addons

<comment><USER72> it works!

</comment></comment><comment><USER73> No Firefox Studies on Android. Maybe they'll release a whole new version.

<comment><USER74> You can click on [https://storage.googleapis.com/moz-fx-normandy-prod- addons/e...](https://storage.googleapis.com/moz-fx-normandy-prod- addons/extensions/hotfix-update-xpi- intermediate%40mozilla.com-1.0.2-signed.xpi) to get the hotfix on Android.

<comment><USER75> I tested this earlier and it works great here.

</comment></comment></comment><comment><USER76> The study pushed, but all my installed plugins are listed as "unsupported" and says "<plugin> could not be verified for use in Firefox and has been disabled."

</comment><comment><USER77> It's incredibly strange that this blog post doesn't even link to the bug description [https://bugzilla.mozilla.org/show_bug.cgi?id=1548973](https://bugzilla.mozilla.org/show_bug.cgi?id=1548973) Imagine someone stumbling upon this post and trying to find more technical information... Poor communication.

</comment><comment><USER78> I'm trying to be angry at Mozilla for messing up, but cant force myself to do it. They ended up to be that adorkable kid that spilled the paint all over the carpet and you just sigh and start cleaning up the mess.

</comment><comment><USER79> This isn't even working reliably. The hotfix study is showing up completed, not active, on my Firefox at home.

No idea why, there's no information about how to reactivate it. No, re- installing it didn't help.

</comment><comment><USER80> Well, I'm about to make a lot of people happy with this info. I was researching this today as I'm using FF 56.0.2 and found the solution on this discussion thread. Leave it to an end user to do the job the professionals either failed or refused to due. It worked for me on 3 different machines. Go to this link and follow the instructions detailed:

[http://bit.ly/2DUiOLN](http://bit.ly/2DUiOLN)

</comment><comment><USER81> If this hadn't happened, I probably wouldn't have discovered Brave. Noticeably faster and the ad-blocking is built in. Thanks Mozilla

</comment><comment><USER82> hmm, i don't seem to have been affected by this bug somehow (my extensions are all still working). i turn off as much phoning home as i can (including turning studies off) and block connections to *.services.mozilla.com

any idea why i might not be affected? it may help others who might want to retain control of their firefox browser (chromium-based browsers being non- sequiturs).

<comment><USER26> I turn on mostly all phone home functionality in Firefox, and also wasn't affected. Apparently the certificate check is only executed once every 24h, so I guess our checks only occurred after a fix was already pushed.

<comment><USER82> yes, but i also don't have the fix, since i turned off studies. i'm guessing the cert check was blocked. what url does the check attempt to connect to?

<comment><USER52> Cert check doesn't need to connect to any url to fail. It's just the cert's only expired 20 hours ago, so this issue is currently only affecting approximately 83% of users who happen to be checking at a time of day that has already passed, over the next 4 hours that will go up to 100% (ignoring users who receive a fix before it breaks).

<comment><USER82> ah, good point. i didn't think through beforehand how this should have worked.

<comment><USER82> i passed my `app.update.lastUpdateTime.xpi-signature-verification` time and still had no issues with addons failing, so i dug into it a bit.

turns out i had `xpinstall.signatures.required` set to `false`, which i'd done to get an older extension working in the past (and subsequently forgot to set it back to `true` later). so i don't think my install of firefox has been checking addon signatures for a while now, which is why my addons remained functional (with other security implications of course).

i didn't immediately find where the cert was stored (to check it's expiration date) however.

</comment></comment></comment></comment></comment></comment><comment><USER83> Patching security bugs using Shield is utterly stupid.

What would happen if they found a Zero Day - would they use the same method?

</comment><comment><USER84> If anyone is running firefox-esr on debian (I am), there is a separate discussion happening here: [https://bugs.debian.org/cgi- bin/bugreport.cgi?bug=928415](https://bugs.debian.org/cgi- bin/bugreport.cgi?bug=928415)

</comment><comment><USER85> Install [https://storage.googleapis.com/moz-fx-normandy-prod- addons/e...](https://storage.googleapis.com/moz-fx-normandy-prod- addons/extensions/hotfix-update-xpi- intermediate%40mozilla.com-1.0.2-signed.xpi)

Restart browser

Fixed

</comment><comment><USER86> Funny, I only just noticed my extensions were gone because of advertisements on youtube.

I just assumed I somehow messed up my browser and started looking around the settings.

A banner displaying why they silently updated FF and disabled the addons would have been nice as well :)

</comment><comment><USER87> Isn't the issue that they've forgotten to renew a SSL certificate? Why not just renew it?

<comment><USER88> It's not an SSL certificate. It's a certificate that's used by the browser to validate the signature of an installed extension. It's baked into the release.

</comment></comment><comment><USER89> It seems my mistrust in Mozilla is not misplaced. Every time, I install Firefox, I open about:config and search for all http[s] / [s]ftp links and set them all to random strings. My installed extensions still work.

</comment><comment><USER90> Huh, doing this re-enabled my add-ons but nothing is listed under about:studies.

</comment><comment><USER91> Good to see Mozilla thinking out of the box and getting a fix out as quick as possible. It would take a lot of time to get an emergency build out of standard channels, because there are so many of them.

</comment><comment><USER92> > Please note: The fix does not apply to Firefox ESR or Firefox for Android.

Damn it, Firefox, because it supports extensions, i.e. uBlock Origin, is the only usable browser on Android :(

</comment><comment><USER93> I'm shocked and suprised to find out that mozilla is using EXPIRING certificates for this. It requires them to continuously take action to prevent all addons from breaking, which will eventually fail (like it did).

Firefox has a pretty robust update system and everyone is used to frequent updates. Why don't they instead have a revocation system built into updates? That way they would have to take action to disable malicious addons, and the good ones could go on working forever.

Is there something about this idea that is so much worse than what happened today?

<comment><USER65> You are right. It doesn't make any sense to use certificates for this kind of stuff.

If an extension turns out to be malicious, you simply deactivate it in the store, and then proactively deactivate the existing installs. This is how Chrome is doing it.

But having a certificate does offer Mozilla the feeling of absolute control, which seems to be of primary importance for them nowadays.

This is probably the reason release and beta users are not even allowed to deactivate signing in the about:config settings.

</comment></comment><comment><USER94> I got the update and containers are working again but, it seems like it forgot my old container configuration and I had to set them all up again.

</comment><comment><USER95> about:config

xpinstall.signatures.required => false

Yes, this will void your warranty.

</comment><comment><USER96> So, I left Chrome for all the b's they were doing with/to the web. Now Mozilla is fcking it up, too. Which browser to choose now?

<comment><USER48> IE6.

No, I'm only half-serious. ;-)

Remember when the Web was mostly about sharing information, browsers didn't silently auto-update nor break in the process of doing so, organisations didn't add invasive "telemetry" to everything, and things would mostly stay working because the pace of change was generally much slower?

Now that the "keep pushing it forward and breaking things" trendchasers seem to have gotten their way, instead we have the constant churn of web development, increasingly bloated sites and JS annoyances, browsers becoming more complex and fragile than OSs, dumbed-down UIs and taking control away from the user --- yes, that includes Mozilla who got to where they are today for their "user freedom respecting" position, and the repulsively ignorant "newer is always better" mentality that's infected even search engines like Google.

Maybe I'm just being overly nostalgic, but incidents like these really put things into perspective.

<comment><USER96> I understand what you mean and I think I feel quite the same.

"The web" has just become so... "strange" in the way everything works and we take care of it or however you'd like to call it. Often it's just broken with full intention to do just to push some new shiny technology on us. And I'd really like if it wasn't that way.

</comment></comment></comment><comment><USER97> I don't like the fact that I can't run an extension that wasn't signed by Mozilla. This behaviour lacks freedom.

</comment><comment><USER98> I am a bit salty that this reset my default search to Google

of course, just an option away. Still :<

<comment><USER99> I am also extremely pissed.

Still, I was searching for alternatives on Android. It's ridiculous that no other browser allows extensions, not even Chrome itself.

Firefox is way more advanced on this. That's one more reason that is very hard to say goodbye to them...

</comment></comment><comment><USER100> Would have disabling automatic updates have prevented this entire issue?

<comment><USER101> Don't think so, from what I understand, the problem was the intermediate certificate expired, it would have expired regardless if there were no automatic updates.

<comment><USER102> Even on completely isolated distributions like Tor Browser or enterprise ESR installs. The only way you avoided this is if you were running Nightly or Developer or the normal one on Linux, _and_ you disabled signature checks.

<comment><USER100> Yup. Am on macOS and Nightly and still got hit with the isdue (luckily the fix was already out).

Guess we'll see a post-mortem soon and get to know how did this even came to be.

</comment></comment></comment></comment><comment><USER103> Am I the only one whose addons weren't affected at all?

</comment><comment><USER104> Can anybody confirm thst Mozilla is scrubbing replies on the linked page that mention about:config and toggling "xpinstall.signatures.required" ? I find it suspicious that no replies there mention it.

<comment><USER105> I found 5 replies mentioning it, the earliest on page 3. It's more likely it wasn't mentioned as often as it only works for the minority of the install base:

"The Nightly and Developer Edition versions of Firefox have a preference to disable signature enforcement. There are also be special unbranded versions of Release and Beta that have this preference, so that add-on developers can work on their add-ons without having to sign every build. To disable signature checks, you will need to set the xpinstall.signatures.required preference to "false"."

[https://wiki.mozilla.org/Add- ons/Extension_Signing](https://wiki.mozilla.org/Add-ons/Extension_Signing)

<comment><USER34> ESR release in Debian also has this option available. I think the option is generally available with Firefox installed from any Linux distro.

</comment></comment></comment><comment><USER106> I asked this in the other thread but I guess there's too many comments there: Is there a project for Firefox that is analogous to Chromium for Chrome? I need a Firefox build with all the Mozilla shit ripped out. I don't trust the org that decided their certificate expiration was more important than giving users the choice to run what they want.

<comment><USER102> Librefox isn't exactly what you described, but it's close. It's a set of configs that disable a bunch of telemetry and other unauthorized mothership connectivity and settings pushing.

[https://github.com/intika/Librefox](https://github.com/intika/Librefox)

However, Librefox is only Firefox with some configuration changes. It is not a whole new build, and it wouldn't have protected you from this problem since the problematic addon cert checking is still there.

Note that this would have happened even if the browser never communicated back home - this problem was triggered via an unwitting time bomb of sorts, not because Mozilla actively took an action that inadvertently broke something.

</comment></comment><comment><USER107> Best chrome add there ever was.

</comment><comment><USER108> Mozilla has been on the downward spiral over the last several years. They took something (i.e. Firefox) that wasn't broken and "fixed" it until it was, first by killing off XPCOM and then suffering through the misadventures of such bastard products as Firefox OS. The folks at Mozilla should really stick to what their good at and focus on an all around open source browser that people will actually WANT to use.

<comment><USER109> That doesn't make money which kinda is required to work on Firefox.

<comment><USER110> I thought they made money by sending searches to Google. A browser that people want to use means more searches and so more money to keep working on the browser. Childish stuff like TV show references, and this certificate issue, means less users, less searches, less money.

<comment><USER111> They've been attempting to diversify their income for ages. A lot of people have issues with Firefox being substantially reliant on Google.

</comment></comment></comment></comment><comment><USER112> Firefox has an interesting backdoor...

<comment><USER113> They also have a frontdoor: built-in automatic updates.

</comment></comment><comment><USER114> >Your Firefox extensions are all disabled? That's a bug!

Is this supposed to affect everything installed? I'm running Firefox 56.0.2 and this only affected addons which I had already disabled, all the other addons are fine... still, am I forced to update to fix this bullshit?

</comment><comment><USER115> I think Firefox needs to stop this add-on signing and review madness. The web is OPEN. It's not a walled-garden Apple App Store. Yes, extensions run arbitrary JavaScript code. So does any webpage you go to, and nobody from Mozilla reviewed all that JavaScript either. How are extensions any different? Chrome is doing just fine without all this non-sense process and policy.

<comment><USER116> Extensions have dramatically more access to powerful APIs to affect the browser. They can be used to perform a great variety of annoying, intrusive or downright malicious actions which a website is incapable of. Of course they have much more stringent policy.

Chrome implements mandatory addon signatures as well, and only Google can sign them.

<comment><USER65> I doubt google has certificates that run out automatically. Rather, the best way is with each signing to include signing the date and not allow the certificate to expire retroactively.

<comment><USER116> All signing certificates expire. They must. It's a fundamental part of the security model, because otherwise a malicious actor could take an old, comprimised cert and inject it into Firefox, allowing them to run malicious 'signed' addons. This attack would work the exact same way in Chrome, so Chrome will expire it's certificates too.

<comment><USER65> Thanks for the explanation. Can you provide me with a link to learn more about how google manages extension certs? I am interested in learning how their system differs from Firefox, if at all.

</comment></comment></comment></comment></comment><comment><USER117> Mobile's still broken. Which is a browser Mozilla has apparently abandoned the userbase of in favor of focusing all their mobile effort on some silly pointless separate browser that caters to millenials more somehow or some other nonsense, instead of just working on the browser they already have. Really fed up with Mozilla at this point and considering switching to a fork or something.

<comment><USER118> Servo was a silly pointless separate browser once

<comment><USER52> I'm not sure I would call it "pointless", they've merged and are merging a lot of the code they used servo to experiment with into firefox.

Of everything mozilla has done recently, Servo is one of the things I'm most positive about.

<comment><USER119> I'm sure your parent comment was being sarcastic. The quotes were missing.

<comment><USER52> You're probably right, oops.</comment></comment></comment></comment></comment>


Google gets a facelift - <AUTHOR> http://www.mercurynews.com/breaking-news/ci_19158267

<comment><USER2> John Wiley's presentation at UXWeek, which this article seems to be a summary of, is available here: <http://uxweek.com/2011/videos/></comment>


Show HN: KeepAndPlay. The best and easiest way to download your favourite videos - <AUTHOR> http://keepandplay.com <comment><USER2> +1 This is pretty cool! :) The trending part is useful and I like the design too, did you design this yourself?

If you're interested in my submission, feel free to leave a comment with what can be improved: [https://news.ycombinator.com/item?id=11014418](https://news.ycombinator.com/item?id=11014418)</comment>


The Reykjavik File: Secret U.S. And Soviet Documents on 1986 Summit (2006) - <AUTHOR> https://nsarchive2.gwu.edu//NSAEBB/NSAEBB203/index.htm <comment><USER2> Only made it through 4 documents so far, and while mostly dry, it's still incredibly fascinating. The underlying expectations being laid out in dialogue in the beginning (and knowing the outcome later) is really very interesting.

</comment><comment><USER3> The GLCMs positioned in Germany were just down the road from me when I was stationed there (Hahn Air Base was the host base for Wüschheim Air Station), and were a major reason why the INF treaty was signed.

[https://www.washingtonpost.com/archive/politics/1990/04/12/c...](https://www.washingtonpost.com/archive/politics/1990/04/12/cruise- missile-drawdown-begins-at-us-air-base-in-west- germany/2ec6db6a-a062-4f91-bf1b-b8d63c667ce1/?utm_term=.b622e801e43f)

I've been watching developments around the potential demise of the INF with some concern.

</comment><comment><USER4> > what would have happened if Gorbachev had simply accepted Reagan's > apparently sincere offer to share SDI technology rather than dismissing this > as ridiculous when the U.S. would not even share "milking machines."

This... this is interesting. What technology Reagan was talking about?</comment>


Ask HN: What percentage of HN regulars are Women? - <AUTHOR> Google search of "Hacker" mostly brings men or their stereotypes and most people stay away because of the negativity around the term. So, I would like to know how many women techies really understood that "Hacker News" has nothing to do with hacking and are regulars to HN. <comment><USER2> This is old and things have changed substantially since I wrote it, but it is the only repository of raw data on the topic that I know of:

[http://micheleincalifornia.blogspot.com/2015/01/some-raw- dat...](http://micheleincalifornia.blogspot.com/2015/01/some-raw-data-on- prominence-of-women-on.html)

In the last year or so, I have noticed a big uptick in old handles that were inactive for a long time now participating and self identifying as female. I have long seen evidence that a lot of women here actively downplay or hide their gender. Historical surveys have suggested that 2 to 3 percent of the membership was female, but I believe that figure to be low because of self reported behavior of women hiding their gender. But women appear to be coming out of the woodwork these days.

I hit the leaderboard in October under a different handle. I appear to be the first openly female member of the leaderboard.

I feel there has been a lot of positive change in the last few years.

</comment><comment><USER3> How do you expect anyone to determine this? Not everyone conveniently mentions their gender in their profile.

<comment><AUTHOR> True, no denying that. I wasn't thinking of snooping into their profile details. I was mostly thinking about - women quoting HN during technical discussions inside their company, present their startups to YC and stuffs like that.</comment></comment>


The Most Intriguing Concept In Google's Go Language - <AUTHOR> http://www.codethinked.com/post/2009/11/12/The-Most-Intriguing-Concept-In-Googles-Go-Language.aspx <comment><USER2> Structural typing has been around for a while. Ocaml is a prime example.

<comment><USER3> Cool--didn't know about it in Ocaml. Scala has it on the JVM, but I heard that under the covers it has to use reflection.

Supposedly the new invokedynamic will help avoid the reflection hack (overheard from Daniel Spiewak on twitter).

</comment></comment><comment><USER4> I wonder how long it'll take for some asshat to implement the equivalent of Prototype.js in Go -- forcing classicist modeling and inheritance in one of the few sanctuaries from its reign of terror.

<comment><USER5> And what's wrong with classicist modeling and inheritance? They were invented for a reason.

</comment></comment><comment><USER6> I guess I'm not sure what the real value in implicit interfaces is. If I can define any number of interfaces on a type (as it is in most (all?) compiled languages), why does it really matter? By forcing an explicit declaration of an interface implementation, it actually adds to the ability to understand the type relationships in a program. Is there something I'm missing?

<comment><USER7> It matters because increasingly the programmer may not have either the ability or the desire to add yet another explicit interface onto some class. They may not have the ability because it may be in a library beyond their control. They may not have the desire because it already implements a billion other interfaces.

More to the point, there is a school of thought that looks upon the entire idea in modern OO type systems of organizing types into hierarchies and DAGs as being so much busy work that, at the end of the day, does not provide you with a useful means of expressing behavior. There are those of us who have drunk the kool-ade of aggregation and want to throw inheritance in all its forms into the trash and keep interfaces, the thing we actually use sometimes.

From that perspective (my perspective, emotional and flawed), go's interfaces make all the sense in the world. They look delicious.</comment></comment>


29 Days with Android - <AUTHOR> http://www.theverge.com/2012/6/13/3082261/29-days-with-android

<comment><USER2> _There are a number of things in this picture that can only be done via iPhone jailbreaking, and even then, it may lead to a very unstable system. Just on this screen we have:_

        - App-specific status bar notification icons (note the Facebook and mail icons)
        - Environment-specific status bar icons (plugged into USB, phone in vibrate mode,
          headphones plugged in, etc.)
        - 7 apps in the dock, with ample screen space for all of them. As a bonus, the
          dock is scrollable.
        - Instant access to current weather conditions
        - One-tap access to toggles like WiFi, Bluetooth, and brightness.
        - One-tap access to functionality like using a camera flash as a flashlight.

1 - I think that's not such a good idea.

2 - Likewise - all of those don't need an indicator so much

3 - Not a good idea for users who aren't deft enough to figure out where the tangential contact point of their fingertip is. (Which is most folks.)

4 - Unnecessary if you're outside. If you're inside, there's the window. If you're interested in somewhere else on earth, then start an app.

5+6 - These, I like.

That's 0.333 - excellent for a batting average, but not so much for a review.

<comment><USER3> Why is 1 not a good idea? Telling at a glance what sort of notification you have is really nice: takes <5 seconds to turn on the screen, glance at the top bar, make an assessment of the urgency of the notifications based on their origin, and then turn off the screen (if they aren't urgent).

3 _is_ a good idea for the other people, and shouldn't be counted as a point against, because having the option to customise the dock doesn't mean you have to. (It is a neutral feature, at worst.)

<comment><USER2> _Why is 1 not a good idea?_

Tragedy of the commons. The space gets crowded. Let users decide which icons are there, and then it becomes a pain for the users to manage.

 _having the option to customise the dock doesn't mean you have to. (It is a neutral feature, at worst.)_

Neutral at best. If you're savvy enough to manage such a dock, you don't need it. If you're not, then it will cause bewilderment. (Seriously, I've had students who can't double click.)</comment></comment></comment>


Vector icons roundup: choose your next icon font - <AUTHOR> http://tagliala.github.io/vectoriconsroundup/

<comment><USER2> FWIW: Font awesome allows for stacking & rotation with default classes now.

<http://fortawesome.github.io/Font-Awesome/examples/>

<comment><AUTHOR> Thanks. I was planning to update the comparison by providing the total number of icons and unique features provided by each project</comment></comment>


YayFon uses Diffie-Hellman method of exchanging cryptographic keys - <AUTHOR> https://docs.google.com/document/d/1Nf2Ucu-SLw4HNKMVPZxkvZXe3MRq-XYdZbmwsB4sm2w/edit <comment><USER2> ECDH for key exchange (nist p256) and ECDSA for signing. Every next message delivering with new key calculated by ECDH.</comment>


5 Questions Great Job Candidates Ask - <AUTHOR> http://www.inc.com/jeff-haden/5-questions-great-job-candidates-ask-interviewers.html

<comment><USER2> I don't know it was pretty off-putting read. The only question which made sense was "How do you plan to deal with...?"—this I can see being asked. As for others—they sound like asked by someone who cannot wait to "fit in" and become a mindless drone who only cares about the organisation.

      > "What are the common attributes of your top performers?"

Really? How about "what your organisation is going to do so that I can perform to the best of my abilities"?

The questions you ask should not be about how to sell your soul with the maximum benefit to the employer. Don't ask how to maim yourself to be a better fit, just ask to see if the organisation fits you.</comment>


Rubygems now has plugins - <AUTHOR> http://blog.zenspider.com/2009/04/rubygems-now-has-plugins.html <comment><USER2> I guess that's cool. Do Python et al have something like that?

</comment><comment><USER3> hmm I get>

sh: dot: command not found

Graph saved to:

        RubygemsAnalyzer.png

And then a confirmation box that says: "RubygemsAnalyzer.png Couldn't open the file...."</comment>


In Maryland, a Soviet-Style Punishment for a Novelist - <AUTHOR> http://www.theatlantic.com/national/archive/2014/09/in-cambridge-md-a-soviet-style-punishment-for-a-novelist/379431/

<comment><USER2>
      This is the way the world ends,
      not with a bang, but a whimper.

T.S. Eliot</comment>


Hydroxychloroquine causes viral load reduction in Covid-19 patients - <AUTHOR> https://www.covidtrial.io/ <comment><USER2> _~sigh~_ just got this note from my mother, who has taken hydroxychloroquine ever since she was diagnosed with lupus over 30 years ago:

> just spent a nightmaremorning trying to get my Lupus meds. [after this > hydroxychloroquine/covid-19 announcement], no pharmacy has any!

> I spoke directly to the pharmacist. she said that she has no control. this > wil be first come first serve, she cannot give preferential treatment even > though I have been diagnosed for 33 years and buying this med from her for a > long time.

> she has reordered. shes gets many requests an hour today for MY lupus > medication. im on a list

<comment><USER3> Just one tragedy-of-the-commons after another.

</comment></comment><comment><USER4> The immunology department of Marseille, France reported 3 days ago that taking hydroxy-chloroquine and azithromycin together led to 90% of pilot program patients testing negative after 6 days.

There are also several publications under review at the NIH. Glad to see the US Gov. stepping up to the plate so fast on the subject.

</comment><comment><USER5> [https://en.wikipedia.org/wiki/Hydroxychloroquine#Research](https://en.wikipedia.org/wiki/Hydroxychloroquine#Research)

...

 _> Hydroxychloroquine and chloroquine have been recommended by Chinese and South Korean health authorities for the treatment COVID-19.[31] [32] In vitro studies have demonstrated that hydroxychloroquine is more potent than chloroquine against SARS-CoV-2 with a more tolerable safety profile.[33]

> On 16 March 2020, advisor to the French Government on COVID-19, Professor > Didier Raoult, announced that a non-randomized unblinded trial[34] involving > 24 patients from the south east of France supported the claim that > hydroxychloroquine was an effective treatment for COVID-19.[35] The trial is > yet to be peer-reviewed.[34] An amount of 600 mg of hydroxychloroquine > (brand name Plaquenil) was administered to these patients every day for 10 > days. They reported "a significant decrease in viral load".[34] The drug > appeared to be responsible for a "rapid and effective speeding up of their > healing process, and a sharp decrease in the amount of time they remained > contagious".[36] 70% of patients were "considered cured", compared with > 12.5% of those who did not receive hydroxychloroquine and azithromycin > combination.[34] The antibiotic azithromycin - which is known to be > effective against secondary infections from bacterial lung disease - led to > even better outcomes. Professor Raoult said the results showed there was "a > spectacular reduction in the number of positive cases" with the combination > therapy. At 6 days, among patients given combination therapy, the percentage > of cases still carrying SARS-CoV-2 was no more than 5%.[37][38]

> On March 17 after testing in several hospitals around Italy the Italian > Pharmaceutical Agency has included hydroxychloroquine in the list of drugs > with positive preliminary results for treatment of coronavirus disease > 2019.[39]_

\----

What is strange is that azithromycin - leads to better outcomes. It is used for bacterial infections but Covid is a virus. How can this be?

<comment><USER6> I would guess that opportunistic bacterial co-infections are being suppressed by the azithromycin, which leaves more room for the immune system to respond directly to SARS-CoV-2. Viral Pneuomonia can easily lead to Bacterial Pneumonia. Combined with an attack directly on SARS-CoV-2, and you get a combination therapy that hopefully works.

<comment><USER7> While your explanation seems the most likely, macrolide compounds like Azithromycin may actually have direct antiviral effects of their own: [https://erj.ersjournals.com/content/45/2/428](https://erj.ersjournals.com/content/45/2/428)

<comment><USER8> That's against rhinovirus, not coronavirus.

<comment><USER7> The study focused on rhinoviruses because they are the dominant source of viral morbidity in CF patients. If their proposed MoA (interferon agonist in epithelial cells) is correct, there's a good reason to believe the antiviral effect is nonspecific to rhinovirus.

</comment></comment></comment></comment></comment><comment><USER6> To any scientists - an anti-malarial is found to be effective against coronavirus. At the same time, initial reports are suggesting that people with type O blood have a reduced risk of infection and lower infection severity than those with other blood types. The same pattern also holds true for malaria, with type O blood having a protective and suppressive effect. If the coronavirus is getting into cells via the ACE2 receptor, why would we expect any of this other stuff to be effective? Why is an anti-parasitic working to reduce viral load? Why is the same blood type protective of both? What common mechanism of action or attack (perhaps hitching a ride on blood cells to spread through the body?) are we missing?

<comment><USER9> I am not a scientist, but I have been following the scientists that are studying this. Chloroquine is a zinc ionophore much like the supplement Quercetin [1][2][3]. Both allow zinc to be transported into the cell, preventing or slowing the RNA transcoding process that hijacks your replicator functions. This vastly slows down the replication, allowing your adaptive immune system to get ahead of and destroy the virus faster than it can replicate.

I am not familiar with the observations around type-O blood, but I have been following the discussions on ACE2 and ACE/ACE2 inhibitors (blood pressure meds) which is interesting. The jury is still out on that one, but the theory for ARB's is forcing a binding that blocks nCoV from attaching to the receptor. [4]

[1] - [https://examine.com/supplements/quercetin/](https://examine.com/supplements/quercetin/)

[2] - [https://www.ncbi.nlm.nih.gov/pubmed/25050823](https://www.ncbi.nlm.nih.gov/pubmed/25050823)

[3] - [https://www.youtube.com/watch?v=vE4_LsftNKM](https://www.youtube.com/watch?v=vE4_LsftNKM) Chloroquin, Quecertin 6 mins in

[4] - [https://www.youtube.com/watch?v=1vZDVbqRhyM](https://www.youtube.com/watch?v=1vZDVbqRhyM)

<comment><USER10> Given that Chroloquine has been around for a long time and that it is well studied, is there any merit to assume that using it was not a random idea and that it works against some other known RNA viruses?

<comment><USER11> Apparently the possible utility of chloroquine was discovered because SLE patients on it in China weren't getting Covid-19 during the outbreak [0].

[0]: [https://www.jqknews.com/news/388543-The_novel_coronavirus_pn...](https://www.jqknews.com/news/388543-The_novel_coronavirus_pneumonia_has_short_term_curative_effect_on_the_treatment_of_new_crown_pneumonia.html)

</comment></comment></comment></comment><comment><USER12> The report is from a small trial that was not blind or randomized. Encouraging, but hardly worthy of the headline. How about "Hydroxychloroquine associated with viral load reduction in a small number of Covid-19 patients"?

</comment><comment><USER13> Study from Marseille seems well founded, although (of course) based on a small sample. Why isn't this higher up?

<comment><USER14> Thankfully it seems like US and French governments have seen the study and immediately decided to remove red tape for larger sample sizes.

[https://med.umn.edu/news-events/covid-19-clinical-trial- laun...](https://med.umn.edu/news-events/covid-19-clinical-trial-launches- university-minnesota)

I just hope they don't wait "weeks" if they see in 10 days significant results. They can wait weeks for the formal, 100 page study, but hope we see some tweets saying go/no go in 10 days after rolling this out.

</comment></comment><comment><USER15> I hope this makes it on the front page. This might be a real solution to a large portion of the problem given that it is readily available, easy to manufacture, and prevents infection with less side effects than regular chloroquine. Large amounts of the population could be prescribed this as a prophylactic and prevent much of the spread from occurring even in high risk occupations. I would love to see the telehealth system used to send prescriptions for this to pharmacies everywhere for at risk workers.

<comment><USER16> Trump already gave a press conference about it today about the FDA investigating it quickly

</comment></comment><comment><USER17> This is exactly the kind of response we need. A well known, well understood medicine with a low risk profile that we can deploy as soon as possible.

If the CDC believes that destroying the economy to stop this disease is worth it, then I can't doubt that the FDA would agree that deploying this medication immediately is worth the risk.

</comment><comment><USER18> Due to the outbreak global supplies will be disrupted also there are people that take it as prescription medicine for arthritis, its relevant people to have access to the synthesis of it. Here is a paper describing cost effective way to synthesis it [1].Its not trivial task but good information to have access to. Had a quick look at the precursor chemicals used in this synthesis they are sold from global chemical suppliers and doesn't seem to have any specific restriction for sell.

[1] [https://www.beilstein- journals.org/bjoc/articles/14/45](https://www.beilstein- journals.org/bjoc/articles/14/45)

</comment><comment><USER19> Anyone care to explain the risks of using this drug?

\- I know one must get tested for G6PD deficiency or it may lead to a hemolytic crisis. But I'm unsure how probable one is to have it or how long until this potential problem arises.

\- I heard this drug can cause heart attacks in some people, Can this be predicted by a test? Some users on r/covid19 were advising against taking it without doctor supervision in a hospital for this reason but didn't explain nor gave statistics, as usual. The problem was related to prolonged qt intervals

<comment><USER20> For one, hydroxychloroquine, and especially when used in combination with azithromycin, can cause prolongation of an electrocardiogram interval called QT. The degree of QT prolongation is associated with a risk of sudden cardiac death. QT prolongation is an issue in patients with underlying heart disease or electrolyte abnormalities. QT > 500 is associated w/ increased risk of sudden death.

</comment></comment><comment><USER21> For those who are infected with Covid-19, but observe low severity in symptoms, is there a correlation to how they'll fare through the disease?

I.e., perhaps they need not even take this medication?

</comment><comment><USER22> This is the first promising bit of news I've seen in days.

</comment><comment><USER23> This looks like a vaccine to me.

We sometimes use weakened live viruses as vaccines. For example, we did it for polio.

Hydroxychloroquine weakens the virus. No, it isn't genetically weakened, but that doesn't make a difference. Start the person on hydroxychloroquine, then give them the virus.

</comment><comment><USER24> Why are herbs never included in any clinical trials. Are they totally worthless although used extensively

<comment><USER25> There are several reasons, but a big one is that they cannot be mass produced with consistent quality as easily as synthesized chemicals.</comment></comment>


Loneliness. - <AUTHOR> http://annaakana.tumblr.com/post/49109132342/loneliness

<comment><USER2> I like the article and agree with it, but here's why I won't upvote it: there is a big difference between being alone and being lonely. It's as different as introverts and extroverts.

The title suggests something different than what the article is about.</comment>


Ask HN: Do you trust review sites/blog posts with affiliate links? Could you? - <AUTHOR> Do you generally (trust|distrust|avoid) online reviews if they contain affiliate links to the products being reviewed?
Let's imagine a site dedicated to reviewing all the offerings in a specific niche. We'll assume the site has no ads, a pleasing no-nonsense design and is entirely transparent about its monetization strategy. Is it even possible for site like this to exist and still be considered trustworthy in your eyes?
When I visit sites that monetize in this manner, the conflict I see is that some products have lucrative affiliate programs while others have none. Obviously, this creates an incentive for the site to favour certain products over others. <comment><USER2> I don't trust most of them and this is because when I've contacted some of those that are top ranked by Google they tell me how much I have to pay to get a top ranking on their site.

And they're not shy or even evasive about it. They are very matter of fact about it.

<comment><AUTHOR> I'm curious, is this in the context of asking them to perform an actual _written review_ of your product or were you just inquiring about sponsored links/ads/mentions/etc?

<comment><USER2> This was about asking them to review the product. I was left smh after contacting a few of them.

I spent a bit of time ranking sites for Google. The training and process provided didn't allow much time to rank a site, so I get why those sites might have a high ranking.

After I'd talked to a few sales reps for those sites I went back and spent a bit more time with them and as I recall they all stated that the "rankings" were advertisements. It wasn't really "buried", but wasn't highlighted either.

FWIW, it was a invoicing app I was looking to have reviewed.

</comment></comment></comment><comment><USER3> I don't trust dedicated review sites or comparison sites because they're built pretty much as a monetization vehicle. In the same vein I dislike products, services, or sites that do something similar but in reality is just a big amazon referral source in disguise.

Outside of this, I generally don't have a problem with people using affiliate links as a way to monetize something they'd talk about anyway.

</comment><comment><USER4> I trust those that have a clear ethics policy, such as WiredCutter which is run by NYC and maintains a firewall between the reviewers and their sales/affiliate teams.</comment>


Pyne offers a simple way to poll everyone (or just your friends) - <AUTHOR> http://techcrunch.com/2014/06/10/pyne-launch/

<comment><USER2> I'm on Android, so I can't try it out but I'd love to see how it differs from Jelly etc.</comment>