Square Cash - <AUTHOR> https://square.com/cash <comment><USER2> Seems to work amazingly although I'm a bit concerned about the security. A friend sent me $1. I get an email from square, link to website where I entered my debit #, expiry and postal. It deposited directly to my debit card (I didnt even know you could do that). The deposit already arrived!

"Checking Card Adjustment POS Pin (Credit) $1.00"

So I sent him $1 back (to: my friend, cc: email@example.com, subject: $1). And it instantly sent it to him. I didn't have to verify my details or anything.

I'd feel a lot more comfortable if there was a security blog explaining how they are validating that I indeed sent the email and it wasn't simply spoofed.

Edit - I did this from Gmail which I presume authenticates all of the emails via dkim? I'm guessing this won't work as automatic for other providers?

Edit2 - Just attempted with another friend and had to verify manually. The automatic-authorization appears to only apply when it's between two previously validated parties.

<comment><USER3> I just found a major limitation with this thing. It blocks payment from any prepaid Visa/Mastercard - even reloadable cards attached to virtual checking accounts that support ACH (payroll cards, Netspend, etc). That eliminates payments from a huge section of the population.

[http://prntscr.com/1xm5le](http://prntscr.com/1xm5le)

Another issue: if you make a mistake on the initial email, and want to send a different amount, you're out of luck. When you send a corrected email from the same address and go to the payment page, it adds any previously unfinished transactions from your email to the amount being sent, with no way to cancel the mistaken one. So just never make a mistake, and never do a test transaction you don't intend to finish, or you'll be required to finish and pay for all of it when you finally do have the correct amount and want to send a transaction (which you can only send with a small subset of the debit cards in existence).

These payment companies are always introducing interesting new things and then they hobble them with basic oversights and fundamentally flawed policies. In the last hour I've gone from excitement to disappointment with this service. It had promise based on the description, but this particular service (probably not Square itself) will fail very quickly.

<comment><USER4> >> I just found a major limitation with this thing. It blocks payment from any prepaid Visa/Mastercard - even reloadable cards attached to virtual checking accounts that support ACH (payroll cards, Netspend, etc). That eliminates payments from a huge section of the population.

.. Aaand it's not an accident either.

<comment><USER5> Is that to meet the money laundering/auditing requirements?

</comment></comment></comment></comment><comment><USER6> This is my favorite type of product. Here's why:

\- Take an existing known medium (in this case email) and makes it way more useful.

\- They didn't try to build a bunch of new UI for connecting your Facebook so you can find and invite and pay your friends, paying out to your card, etc.

\- It magically hides the messiness of an enormously complex problem (fraud, different types of debit cards & banks all over the world) behind a very simple interface.

\- Unlike every other P2P payment system, I can actually sign up and receive money (or convince my friend to) using _only what 's in my pocket_ (debit card)... not hunting down ACH/wire details.

<comment><USER7> Looks like an excellent target for phishing attacks!

<comment><USER3> That was my first impression. I could rip the site, post it to my own domain, and start sending out emails saying "you've got cash, give me your credit card number so we can credit it" in about 10 minutes. Great concept, and I plan to use the service, but as it gains momentum and acceptance, it's going to be a great attack vector for the Nigerians.

<comment><USER8> As a Nigerian, I'm offended. You know, other countries scam too!

<comment><USER9> After getting to know a Nigerian[0], I must say this constant jab against Nigerians is getting annoying to me as well.

[0] [http://valanx.org/index.php?option=com_content&view=article&...](http://valanx.org/index.php?option=com_content&view=article&id=145:power- to-the-developers-nigeria&catid=25:skore-blog&Itemid=99)

</comment></comment></comment></comment></comment><comment><USER10> This is one area where the US seems to be behind compared to the UK. I am from the UK and that service would look quite poor if it launched over here. We have a system called faster payments service that offers instant (although in some cases up to 2 hours) bank transfers for payments up to £100,000 (can differ between banks). You can use this directly if you share bank account numbers and sort codes but there are also wrappers around FPS like Barclays PingIt that people can register with and use your mobile number instead. There is no fee associated with these services.

<comment><USER11> The US equivalent is ACH, which has the major downside that using only the bank ID (routing number) and account number you can effectively wipe out the target's account. It's up to your bank (or whatever ACH proxy) to keep you from doing that, not to the interchange, both legally and technically. ACH also takes several days to work, and has a wide window for either bank to declare the transfer fraudulent, so many banks stretch the time out longer to account for that. Most stock brokers will credit your account long before the ACH transaction completes (with some restrictions of course).

There are also wrappers around this here like Chase's Quickpay or Ally's Popmoney but most require that both people use the same bank, or that you give your ACH details to a bank that isn't your own.

Paper cheques just have the routing/account numbers along the bottom, and AFAIK essentially work via ACH anyway, so they have all of the same downsides, plus taking longer to complete.

Also, the window for fraud with ACH is so great that when you tell one bank about another account's ACH details so that you can transfer money, they "authenticate" this by making small, sub-$1 deposit amounts, and asking you what the amounts were, to prove that you can see the target account. So this "linking" process takes the entire ACH transaction time as well the first time you do it. Some banks have taken to using a service called Yodlee which _asks you for the target accounts ' username and password_. That's right, Wells Fargo asks for your username and password on Scottrade to authenticate the transfer because they don't trust the way ACH's liability lies. So this won't work to send $8 to your buddy anyway.

Moving money without a service like paypal/venmo/square/google wallet is really quite difficult, especially if you don't want to trust an organisation with a history of taking people's money (Paypal) or if you don't want to pay a transaction fee.

<comment><USER12> Are you serious? Why would _anyone_ design a system like this?

In Australia, the equivalent is EFT (Electronic Funds Transfer). You can deposit money to anyone's account by telling the bank their BSB (Bank/State/Branch number) and their account number; however this is not sufficient information to withdraw money.

To withdraw money: 1\. at a physical bank branch: a. you put your credit/debit card in a POS terminal and enter your pin/sign to authenticate. b. provide yous credit/debit card and photo ID to the teller. 2\. at an ATM: credit/debit card + pin number. 3\. online banking: either the credit/debit card number and a password and often a pin as well, or a separate number and password.

All of these use an independent authentication source to the bank account number.

Also the delays quotes here are insane: In Australia, there are essentially 2 ways to pay for something (excluding cash): 1\. EFT (Electronic Funds Transfer) 2\. Credit card (possibly using a debit card) transaction.

On POS terminals, you can choose either; the differentiator being whether you want to use a savings account (EFT) which goes via your bank, or a credit (or savings account accessed via debit card) account, which goes via MasterCard/Visa.

All forms of EFT take 1-2 business days between banks, pretty much all the time; and they're universally free for the payer.

Credit/debit transactions seem to take 1 day universally.

We have a fairly stagnant banking system, with 4 major banks having basically the entire consumer market (and the vast majority of the nonconsumer market as well). Why, in a small, stagnant market like ours, do we fare much better than the US system?

[edit: I forgot to mention, checks are dead here, they're now almost only used for large transfers of money where: 1\. you don't want to use EFT; 2\. they're over the daily online maximum for EFT transfers, and you can't be bothered to go to a bank branch (although you can only get bank checks at a branch AFAIK); 3\. You want an immediate guarantee that the ammount was paid and the date/time/payer/payee (as opposed to waiting 1 day for the payment to come through).]

<comment><USER13> _and they 're universally free for the payer._

Not quite. Vendors can now legally add a surcharge to cover the cost for payments from a credit card. Some vendors traditionally refused Amex when they had to eat the charge, since Amex was something like a 4-5% cost to the vendor as opposed to the 1-2% costs of the other cards.

 _Why, in a small, stagnant market like ours, do we fare much better than the US system?_

We have strong banking regulations, apparently. I heard somewhere that during the GFC, there were only ten banks of that kind globally that hung on to their AAA credit rating, and all four of the Australian big banks were in that ten.

<comment><USER12> Credit card transactions do sometimes have fees attached; specifically I was referring to EFT, which for person-to-person has no fees at all, and doesn't attract fees to the payer at the POS (whereas credit cards can).

Yeah, the real question I was getting at was, given the Australian market is even more insular and stagnant than the US, why do we have much better systems?

What you're saying sounds plausible; a comparison of the US and Australian regulations on deposit banks would be interesting.

<comment><USER14> Actually EFT _does_ have fees. Typically between 10c - 25c / transaction.

They are minimal, but they are there.

Plus the fee for the terminal of course. Which varies significantly between banks in AU.

<comment><USER12> Sure; I could have been clearer here.

Specifically, you can do an EFT transfer from a bank account to any other bank account in Australia via online banking, and it's free (at least in all the times I've used it).

In the case of ETFPOS terminals, EFT is always free for the payer (the customer), and credit cards are usually free for the payer, but do sometimes have a fee for the payer (certainly AMEX and Diners).

As I've now been corrected on, both types of transaction have a fee for the payee (the merchant).

The fee for the terminal itself is definitely true - I was mainly thinking of fees in terms of payers, i.e. the customer, not the merchant.

Though given there are alternative methods for credit/debit payments (i.e. alternative terminal types, like the swipe thingy that plugs into iPhones) it'll be interesting to see if people keep the combined EFTPOS + credit/debit card terminals, or abandon the EFT side, as the number of non-debit bank/keycards dwindles.

</comment></comment></comment></comment></comment></comment></comment><comment><USER15> The most stunning part of this is the "free" part.

The Durbin amendment regulates the cost of debit transactions over the Visa/Mastercard network. It's $0.22 + 0.05%.

Mossberg reports that Square is planning to monetize via "premium options" like international transfers. But still, $0.22+ is a lot to lose every time someone uses your mass-market service.

Good thing they raised $341M of VC money.

Who said the dot com days aren't back??

Source: [http://allthingsd.com/20131015/the-money-is-in-the- email/](http://allthingsd.com/20131015/the-money-is-in-the-email/)

<comment><USER16> my guess is the '1-2 days' for you to get your cash is how they are monetizing it. Sure, a poster above got $1 almost instantly, but as volume increases, 1-2 days in some form of investment vehicle will add up.

<comment><USER17> They'd want to be making returns north of 20% per year just to offset the fees alone if the numbers abalone outlined are correct.

Edit: to elaborate on how I calculated that:

1\. We don't know transaction size so I just focused on the 0.05% transaction fee. Obviously if transaction sizes are small, the fixed element of fee is higher as a proportion of the amount held for 1-2 days so the required return to break even is much higher.

2\. If the transaction fee is 0.05%, $1 transferred turns into $0.9995

3\. Square is sending $1 to the recipient. Therefore to break even, it must turn 0.9995 into $1.00 in the 1-2 days it holds the cash for.

4\. To do that in 1 day, it must earn a return that is roughly equal to 20% annualized. So the annual return is (0.9995 x 20) = 0.1995. The daily return is 0.1995/365 = roughly 0.0005.

5\. Adding the return of 0.0005 to the $1 brings you back to the $1 that Square sends on to the recipient. So they break even if they are earning 20% a year on the cash they hold before it gets sent on to the recipient.

Note the required return to break even is lower if they hold the cash for 2 days. However I'd guess they don't because one of the banks along the way probably hold it for at least half that time. Also, even if they do hold it for 2 days, you still have to overcome the fixed cost, so that moves the required return back towards my 'north of 20%' figure.

PS - since the Square guys are obviously smart, I'm sure they've done the above math so I'd question whether they really are paying these kinds of fees on each transaction. However if they are, Abalone's dotcom days comment is entirely correct.

</comment></comment></comment><comment><USER18> Do Interac email transfers not work in the US? They're pretty much the same thing: send money to an email recipient who then clicks a link to deposit it in their account. I'm surprised that this is big news, and that it seemingly doesn't exist down south.

<comment><USER19> Interac is an exclusively Canadian payment-processor. The American equivalents are PLUS and Cirrus--who could have implemented this long ago, but for some reason haven't.

<comment><USER18> I didn't realize that. The ubiquity of Interac around these parts, and its deep integration with all things financial, led me to believe it was an international institution.

After spending the last week trying to find a cellphone plan for my mother, seeing a Canadian institution that mostly works and is mostly good for the consumer is a welcome breath of fresh air.

<comment><USER20> At my bank interac e-transfer costs $1.50 a pop but paper checks are free and unlimited. It boggles the mind.

<comment><USER21> Only if you're still tied to the notion that prices are proportional to costs. e-transfers are more convenient for consumers, so they can charge more for them.

<comment><USER20> I see it as being incentivized to waste relatively large amounts of their time and money printing, shipping, and processing my checks for stupid small amounts like $23.46.

But you're right, I'm sure that for every person like me there are many who just pay the $1.50 for the convenience.

</comment></comment></comment></comment></comment></comment><comment><USER22> Note that it takes 1-2 days for the deposit. They must be using ACH to do this. The 'free' part is great. Even with Square, I'd be hesitant to enter my debit card number.

Planet Money recently did a great episode all about the US's ACH system and why it works the way it does.

[http://www.npr.org/blogs/money/2013/10/04/229224964/episode-...](http://www.npr.org/blogs/money/2013/10/04/229224964/episode-489-the- invisible-plumbing-of-our-economy)

<comment><USER23> Faster transfers are possible. Some companies (Kabbage maybe?) are able to do same day or instant transfers without wiring.

I believe it's done by opening bank accounts at major banks, and then using the interbank transfer system which is instantaneous and only requires an account number and a name. Other services offer pushes to credit cards or debit cards using bill pay systems or blind credits.

It isn't actually that hard to move money from person to person. The real issues with this sort of stuff are: a) payments fraud b) money transmission law and regulatory compliance

<comment><USER22> Based on the comment above that tried it, your theory of transferring between accounts in the same bank (and then reconciling later) would make sense.

The Planet Money podcast noted that some banks (Capital One, BoA) offer a similar service if both ends have accounts.

</comment></comment></comment><comment><USER24> They're obviously taking a loss on this (due to credit card fees) if the recipient gets the full amount sent. So this must be a loss-leader that's building up to something else where they expect to make a ton of money.

That "something" is most likely just "replacing cash and cards", but will be interesting to see how it plays out. It's a bold move regardless.

EDIT: I meant debit card transaction fees, not credit card fees.

<comment><USER7> I believe that Amazon Payments is the only system that lets you pay someone with a credit card, although it's limited to $1,000/month (otherwise people abuse it, sending cash to each other to rack up points on their credit cards).

<comment><USER25> I thought that there were now ways for payment processors to flag that a transaction is not supposed to earn points? (eg. balance transfers, cash withdrawals etc...)

Otherwise I could deposit $10,000 from my credit card into my on-line gambling wallet, then withdraw it, repeat...

<comment><USER26> I challenge you to find a website that will let you charge $10k into an online gambling account from a credit card. And any that do exist will charge fees higher than credit card rewards in most scenarios.

But yes, you also will not earn points on balance transfer transactions. But they typically are processed via ach.

<comment><USER25> You're right, I haven't tried to deposit more than about $1000.... however I could just do that over and over again.

<comment><USER26> With a credit card? Which site? To my knowledge this did not exist. Discount fees would cost them 2% at least.

</comment></comment></comment></comment></comment></comment><comment><USER27> Note that this isn't available everywhere: [https://squareup.com/help/en- us/article/5136-troubleshoot-sq...](https://squareup.com/help/en- us/article/5136-troubleshoot-square-cash#square-cash-supported-states)

(Would have been nice to see this on the actual page rather than hidden in "Troubleshooting")

</comment><comment><USER28> Hmm neat, however what benefits do I get using this when it's also built into Gmail and provided directly by Google Wallet?

[http://www.google.com/wallet/send-money/](http://www.google.com/wallet/send- money/)

<comment><USER11> Because you don't use gmail? Because your target doesn't use gmail? Because you're already a square user and not a Google Wallet user? Because you'd like to use a debit card without paying a fee? Because you like the letter S better than you like the letter G?

<comment><USER28> I'm pretty sure Google Wallet in Gmail lets you send money to someone not using Gmail. But you are correct. I guess it's a good solution if you don't want to deal with PayPal/etc. when you happen to use your own email setup or Outlook/Yahoo/etc.

<comment><USER11> It has nothing to do with being edge-cases like "if you're hosting your own email thing". Personally, I just like to limit how many of my eggs are in one basket, and I already have a lot of eggs in the Google basket. I like my bank's own built-in system for this right now between me and their other customers, and for everyone else I use venmo. It works great, and I have no real complaints about either system.

But really I don't need to be talked out of using Google's like it's the default, and I'm not clear on why you do. I don't really get the "why do you use your own favourite toy instead of my own favourite toy?" crowd

</comment></comment></comment></comment><comment><USER29> And composing an email to send someone money is secure how?

What stops someone from spoofing my email address, CC'ing it to firstname.lastname@example.com, and clearing me out? And if someone does get in to my email account I'm toast?

<comment><USER30> You'll receive a reply from Square asking you to link a debit card."

So you need to confirm it (and provide a debit account) I guess - but not sure how subsequent transactions are handled.

<comment><USER31> Presumably linking a debit card only happens once, and afterward, you're only contacted to verify suspicious transactions.

</comment></comment></comment><comment><USER32> Brilliant solution, but can anyone tell me how they avoid fraud? I just sent money to a friend, and back. It worked fast and flawlessly, as expected. Supposedly money will be posted to my account in 24-48 hours. All good there.

Now, how can they make sure that the email is genuine and wasn't spoofed? Sure, they can check for white-listed domains and SPF records, but still seems fairly weak process. The FAQ [1] doesn't say much either. Human validation is even worse.

It helps that the send receives an email confirmation with the transfer, but you may not check the email before the money is posted. I guess they're pushing the onus of the proof to the receiver -- after all to receive the money you have to have a bank account and a visa/mc debit card.

Whatever the security mechanism, it's a brilliantly simple solution. If it takes off, it'll quickly replace Dwalla and other micropayments.

[1] [https://squareup.com/help/en-us/article/5144-square-cash- sec...](https://squareup.com/help/en-us/article/5144-square-cash-security)

</comment><comment><USER33> I'm completely taken back by the simplicity of this + that it's free. So many times have I paid a contractor via PayPal as a "friend" to reduce PayPal's fees.

Moreover, why hasn't a bank or credit card company done something like this yet? Amazing how the solution disappears into a cc: address line and unique link in your email.

</comment><comment><USER34> The simplicity of this is amazing.

That being said, I have a question: Here in Canada, I can send an email transfer of funds from my bank account to my contacts by simply logging into my bank online and specifying the email address of the recipient. Does this type of system exist in the US?

<comment><USER35> Agreed. Once this comes to Canada, it'll kill Interac Email Money transfers (of which my plan only allows two free per month, and is not nearly this simple).

<comment><USER36> I think OP meant the opposite. This is cool, but the incumbents in Canada have already done it, and it's more trustworthy (it happens on your bank's website) and 'good enough'. Even if the tech-savvy switch to Square, the average bank- user will prefer to use INTERAC. At best this could pressure banks into giving away more free INTERAC transfers with their paid accounts.

</comment></comment></comment><comment><USER37> Looks like it's US only? ZIP code??

 _Residents of 48 US states have the ability to send and receive Square Cash. Currently, you 'll be limited to receiving Square Cash if you live in the following two states.._

</comment><comment><USER38> I've had a debit gift card for 10 months with $35 on it. Just used this to send that money to myself. Awesome.

Amazing what you can do with a card number and expiration date. Don't loose your debit cards!

</comment><comment><USER39> It sounds great, but I'm always left wondering what the angle is for free services. Will they make their money off of float? Is it something to do with the way debit cards are charged?

<comment><USER40> I think linking accounts to debit cards is pretty valuable on it's own. It opens the door to making payments for a lot of people much easier down the road.

<comment><USER41> Like how Paypal encourages you to tie your bank account to your Paypal account; they get to charge merchants the credit card interchange rate while taking advantage of the low ACH funding risk on the buyer/purchaser side.

</comment></comment></comment><comment><USER3> I just scoured the site and saw no limits for receiving through square cash. I can't imagine that this is actually the case; does anyone have any idea what the actual policies are?

<comment><USER42> $2500 a week, or $250 a week before ID verification, according to WSJ.

[http://online.wsj.com/news/articles/SB1000142405270230337690...](http://online.wsj.com/news/articles/SB10001424052702303376904579137512381777756)

<comment><USER43> That's described as a limit on spending, not on receiving. It may be symmetric, but it's not clear to me from that.

</comment></comment></comment><comment><USER44> Reminds me of a similar gmail feature [http://www.google.co.uk/wallet/send- money/](http://www.google.co.uk/wallet/send-money/)

</comment><comment><USER45> Seems a little scary, to be honest. It's plausible that malware (or even just somebody physically using your phone or computer for a minute) could generate and perhaps send these emails on a user's behalf (and then delete the confirmation and the "sent" copy, depending on the mechanism). If I were ever to use this service, I'd surely use a dedicated email address that's harder for me to casually send mail from.

</comment><comment><USER46> I was talking to a colleague about how Dwolla implements a similar pay network. I don't know Square's implementation. It varies with different P2P providers. Some create their own 'rails' in the backend (PopMoney, etc.). Some follow the 'clearing firm' / brokerage model of the commodities / equity markets. They have accounts in all major banks with deposit (debit) accounts and simply do an inner-bank transfer on both ends on your (and your recipient's) behalf.

That got me thinking though. It's 2013. The ideal solution is not to be beholden to any centralized authority or group of 'clearing' accounts for routing. The ideal solution is security but flexibility and distributiveness. The ideal solution is a network of trust with similar 'hubs' / 'clearing firms' that one can choose to route through automatically, have all the routing be automated for you via solid protocols.

There is the chance to create clusters of payment routing networks that are more elegant. It would make money movement so much more liquid in our world. And would be a really great thing.

Maybe Square is the beginning of that solution. I hope it gets even more distributed though. It's mostly companies leading the way for this. And good for them. But there's another possibility: something very open, but given the right protocols and architecture, very secure.

There is no incentive to create such an architecture other than the amazing world that it would mean where you could travel to different countries and authenticate seemless money transactions to whoever had a phone or email endpoint (again there would have to be name servers + some sort of money equivalent of SMTP + TLS / chains of trust + distributed clusters of shared 'clearing' bank accounts + routing algorithms to these accounts, etc.).

But that didn't stop Tim Berners-Lee or the early internet folks....

</comment><comment><USER47> I want to learn more! The Help page is a 404 though: [https://squareup.com/help/en-ca/topic/139](https://squareup.com/help/en- ca/topic/139)

What banks does this work with?

<comment><USER48> I wanted to do the same, to figure out how they make their money, but also a 404: [https://squareup.com/help/en-ca/topic/139-square- cash](https://squareup.com/help/en-ca/topic/139-square-cash)

Looks like the help in only available in US English. If that is the case, and it looks like they are using some sort of CMS, then it should be fixed up and and content fallback to something useful rather than a 404. This is a link off the landing page on a site with very little content, pretty unacceptable in this day and age (but for now there is the benefit of doubt to assume you are doing a beta run for feedback).

</comment></comment><comment><USER40> I think they've done something quite clever by (I infer) getting people to join up when they receive money. Venmo puts up an unnecessary wall by requiring that the payee sign up before they can be paid.

</comment><comment><USER49> A point about spoofed email, Square always seems to ask the sender for a confirmation whether the email was spoofed or not. I tested this by sending it legitimately and through an unauthorized email server.

The only thing that was concerning was when I sent a spoofed email, the receiver was able to know the sender name (cash account name) – "ABC is about to send you cash". Very minor but it allows anyone to find out your name provided they know your email address.

</comment><comment><USER50> What are they using to do the animations on the demo site?

</comment><comment><USER51> Yet another US only payment option. I get it, but at least state it somewhere so people like me don't get excited and then suddenly disappointed.

</comment><comment> k-mcgrady I don't see anything on the site but on Google Play it warns the app can't be installed on my Nexus 4 - I take it this is US only?

Edit:

Looks like it's not even available in all states in the US [1]

[1] [https://squareup.com/help/en-us/article/5136-troubleshoot- sq...](https://squareup.com/help/en-us/article/5136-troubleshoot-square- cash#square-cash-supported-states)

</comment><comment><USER52> Square Cash is definitely some sort of loss-leader, but for what?

Most obvious long-run plan would be for user/debit card acquisition (which has lower interchange rates) to support their bread and butter business (merchant tools) as this would increase their profit margins by reducing processing expenses, especially since Square simply charges a single rate to merchants...

</comment><comment><USER53> >Free. Actually Free.

Ok now I'm confused. I realize it's probably a marketing ploy, but how could the fees on this not eat them alive?

<comment><USER41> ACH transfers are stupid cheap compared to credit card transactions.

<comment><USER6> debit cards != ACH

<comment><USER41> You can apparently convert debit card transactions to ACH transfers: [http://www.digitaltransactions.net/news/story/3518](http://www.digitaltransactions.net/news/story/3518)

</comment></comment></comment></comment><comment><USER54> There's a similar thing in Sweden, called Swish ([https://www.getswish.se/](https://www.getswish.se/)). But it's a cooperation between banks, and you link it with your phone number, the transfer is instant, you have to identify using something called Bank ID.

Square Cash seems nice, but I prefer the approach of Swish.

</comment><comment><USER55> I've been using Square Cash for a few months, and it's worked flawlessly. (A friend used it to send me money, and I jumped on the bandwagon; didn't even realize it was pre-release!) Square is attacking the consumer payment market from all angles, and I think it has the potential to become one of the biggest companies of this bubble!

</comment><comment><USER56> This needs an out-of-bound verification for the transfers. At the very least, it should confirm every new recipient - "Did you really mean to send $500 to email@example.com?"

Seriously, I am all for the simplicity of the system and the flow of the narration, but where the heck is the explanation of how this is _not_ trivially exploitable?

<comment><USER57> I just tried it (not being a square user) and got a confirmation email.

"You're sending $1 to firstname.lastname@example.com Just link your Visa or MasterCard debit card to send this cash."

If I did sign up and not receive a confirmation email for any following transfers I send, then I agree, I'd be worried as well.

</comment></comment><comment><USER58> I get that this is cool because it doesn't require an app or anything to work. But I just don't see this replacing venmo for me. Albeit venmo requires a bit of set up (so does this) and an app, but once that's in place sending money is quicker and easier and I don't have to remember to cc anyone. Thoughts?

</comment><comment><USER59> I really liked the idea. Its really good for all the parents who are not so tech savvy and can send money this easily. And its all free ? I don't understand why ? i mean I am not saying that it should be paid of something but being an entrepreneur myself I would love to know how you guys are making money on this.

</comment><comment><USER60> Not talking about the product for a moment. There are a lot of not-so-great "flat design" websites out there, but Square Cash's is one of the best I've seen. I keep seeing these loud sites with full-width graphics and animations on everything. This is how it should be done. And responsive to boot!

</comment><comment><USER61> Interesting, I currently use Venmo, which ties into Facebook accounts so it's super easy to find people. But Venmo is only free is you tie your checking account.

With this I can tie my debit card (which I guess is the same thing). So, I don't seen any real positive benefit over Venmo IMO. Can anyone else point anything out?

</comment><comment><USER62> This is simply a user acquisition mechanism for the rest of the Square business. They lose money on every transaction.

Read this: [http://www.quora.com/Square-Inc-1/What-are-the-details- behin...](http://www.quora.com/Square-Inc-1/What-are-the-details-behind- Square-Cash-P2P-Service)

</comment><comment><USER63> I think thats an awesome idea, in the current world where the cash is not used as often as before and its hard to just send money to your friend or relative without dealing with long forms, swift codes, routing numbers etc...I am just wondering how did they manage to make it free? Any ideas?

</comment><comment><USER64> I love and trust Square, but would be extremely hesitant to trust my debit card anywhere online. Someone going on a charging spree with my credit card doesn't bother me as much as the thought of someone stealing this number and taking the money directly out of my account.

</comment><comment><USER65> Anyone know if this will work with international debit cards?

E.g. if I have an debit card with my account at a Jamaican bank, can someone from the US email me cash and it arrives instantly or is this just a US service? Can't find any details about this on the site.

<comment><USER66> I'm guessing it's a US-only service because Google Play refuses to let me install it, saying it's not compatible with my device. The only reason I think of (I have a pretty recent phone!) is that I'm not in the US.

</comment></comment><comment><USER67> I don't really care about that new feature, but man, I love that background video playing with the animation.. Is there a library to help create that? Seems like it's a <video> with some animation css on top of it?

</comment><comment><USER68> I'm not quite sure how to sign up. When I go to "Account" at the bottom right and enter my email address, it takes me to the purple "how to sign up" section, but it's not clear what to do from there.

</comment><comment><USER69> Free. I bite, What's the catch ? I presume recruit users to use the Wallet app ?

<comment><USER11> This is similar to competing services on venmo and paypal. I believe they make money on:

1\. The "float". The interest that they make from the period that people have cash in their accounts. If an ACH takes 4 days to complete, they may take 5 days to complete it, and collect a day's worth of interest

2\. The halo effect. Now you're a Paypal/venmo/square user, and therefore more accessible to vendors using them as a payment processor. Those vendors pay the service transaction fees.

</comment></comment><comment><USER70> I cannot believe this is happening. This is extremely cool...

But didn't we agree that email wasn't a safe protocol?... How long do I have to cancel a transaction? Are they going to honor the fake ones like Visa does?...

</comment><comment><USER71> Echoing the other commenters: this is really great, but I'm a little weirded out because it's free. I'd like for them to be upfront about why it's free, since all the alternatives aren't.

<comment><USER11> That's not true, venmo and paypal and google wallet are all free if you use ACH.

</comment></comment><comment><USER72> This looks pretty interesting, but, as everyone said, security sounds like it will be a huge issue. Will there be other methods of verifying a user for email, now that it can be linked to your bank account?

</comment><comment><USER73> I was just impressed by how the colors of the buttons in the top left corner (when idling at the section with the video background) is synchronized with the color theme of the video background.

</comment><comment><USER74> Hands down one of the best interfaces / UX I have ever used. It's about time someone made sending money really simple and free. Can't wait to see how this service matures.

</comment><comment><AUTHOR> I remember seeing this talked about a while back and not thinking much of it, but the details look slick. Sending money with no signup required seems pretty awesome.

</comment><comment><USER75> If they are really losing 0.05% + 22¢ every transaction, then Venmo should use Square Cash to make a lot of large transactions, forcing them into bankruptcy.

</comment><comment><USER76> Since the emails are not encrypted, anyone in the middle who's capable of scanning this traffic can basically see all the transactions passing by?

</comment><comment><USER77> In addition to phishing risks noted below, I wonder how many typo squatters will pop up for the email@example.com cc.

</comment><comment><USER78> [http://d.pr/i/oEmN](http://d.pr/i/oEmN) chrome banned the request.

</comment><comment><USER79> Aren't emails sent in plaintext? What are the security and privacy implications of using this service?

<comment><USER11> Since it's based on email, the same as email. You can encrypt the body but not (most of) the headers. So yes, there's a privacy concern there.

</comment></comment><comment><USER80> Glad they changed it from 50 cents to free. Smart move.

They solve this problem with the least amount of friction.

</comment><comment><USER81> Any idea what mailsystem they use to handle all these mails? Or is it an in- house build system?

</comment><comment><USER82> The security here is very very questionable. It is non-existent and that worries me.

</comment><comment><USER83> how does the email source verification work? SPF and DKIM checks? any idea how they can credit a debit card? I'm guessing they rolled out their own solution with a few of the biggest US banks, having accounts at each one?

</comment><comment><USER84> Would this still work if someone used a fake email script?

</comment><comment><USER85> how do they make money with this? BTW I didn't know I could scroll for the longest time! I thought it was an animation.

</comment><comment><USER86> It doesn't accept British Pounds yet :(

</comment><comment><USER87> on an aside, what a great website, the background video and colorization all work so well.

</comment><comment><USER88> what about sending cash to an international debit card? Has anyone tried this?

</comment><comment><USER89> Did Square just kill Dwolla?

</comment><comment><USER90> hmm? isn't Email address fakable?

</comment><comment><USER91> NSA will start to deposit the cash you send, its just "Metadata"

<comment><USER11> I understand the attempt to farm karma by mentioning the NSA in every single unrelated thread, I'm just surprised that this is the best that you could do. Surely there's a better story to be told in monitoring financial transactions (which they actually do) than in pretending that they're going to steal the $8 you sent to your buddy for beer.

<comment><USER91> I'm not sure the source of your frustration. The idea was to be funny and hint at the fact that email is not that secure. I wouldnt feel secure sending more than $8 on this platform... How am I to know that my email (or packets as part of the transmission) are 1) Encrypted, 2) Not tampered with 3) From whom they claim to be from.

email guarantees none of those traits 1. Encryption from server to server is optional, 2. Who knows how many MXs are hit until it finally makes it to my mailserver 3. Mailservers have know authentication mechanisms that ensure someone cannot send mail on my behalf.

Yes, well configured mail servers will make attempts at these things through SSL/TLS connections, doing direct connections only (no proxies/relays) and by only accepting mail from servers listed as MX servers or with SPF records etc.

Thanks for the -4pts.</comment></comment></comment>


Nutrition Science Is Broken. This New Egg Study Shows Why - <AUTHOR> https://undark.org/2019/07/18/science-of-eggs/ <comment><USER2> "To put it another way: Eat what you like but keep it balanced..."

That is, actually, a pretty poor summary of the experts the author quoted just a couple paragraphs above. But I agree with the overall conclusion that nutrition science is mostly bogus.

</comment><comment><USER3> Nutrition science is broken - because people keep using random new studies to try and make points about nutrition.</comment>


Vooza Introduction - <AUTHOR> http://vimeo.com/44424340

<comment><USER2> the video is private</comment>


Tell HN: YouTube, Dropbox censor "storm clouds gathering" content - <AUTHOR>

I follow this account (presumably videos created by one guy) on facebook. Normally he posts conspiracy theory junk by most measures, but I find his videos thought provoking.
Recently he published a video with his thoughts on Charlie hebdo (I have not watched it). If you read his facebook feed, he is saying youtube and Dropbox removed his video.
Url: https://www.facebook.com/StormCloudsGathering <comment><USER2> ...great way to get promoted?</comment>


Active-Active for Multi-Regional Resiliency - <AUTHOR> http://techblog.netflix.com/2013/12/active-active-for-multi-regional.html

<comment><USER2> The one thing that stood out for me was the use of UltraDNS.

Does using UltraDNS preclude using CloudFront or similar CDN?

<comment><USER3> UltraDNS must be the main way they do their own routing, per comments from an ex-AWS engineer:

"Funfact, everyone here knows that Netflix is on AWS. That's a no brainer, it's plastered all over the AWS site and the Netflix blog. However, if you traceroute their IP space and check their AS numbers, you'll see they do all their own routing. Obviously, this is done with Direct Connect."

[http://www.reddit.com/r/IAmA/comments/1e5o4p/iaman_exaws_eng...](http://www.reddit.com/r/IAmA/comments/1e5o4p/iaman_exaws_engineer_ask_me_anything_about_the/c9x59yg)</comment></comment>


Interview with Don Woods, co-creator of INTERCAL - <AUTHOR> https://esoteric.codes/blog/don-woods <comment><USER2> O, apparently BitBitJump was invented during the seventies. I didn't know that before (esolang wiki says 2009).</comment>


Fun with :target demo  - complete interface done in CSS (no JS!) - <AUTHOR> http://virtuelvis.com/gallery/css3/target/interface.html <comment><USER2> There is Javascript for the window dragging.</comment>


"They're abysmal students": Are cell phones destroying the college classroom - <AUTHOR> https://arstechnica.com/?p=1637139 <comment><USER2> This is an argument against free college. Students will take college more seriously when they are paying for it.

If students are not paying any attention in class but still graduating, the grading standards may be too lenient.

<comment><USER3> True but also obfuscates any issues pedagogical imo. Also, making something unnecessarily hard or obtuse isn't the answer either, paradigmatically sends the opposite message to a wise notion of both building our information management under keeping close to KISS mantra(appropiately when needed) too. Also, people going to college now pay for it down the line anyway, via cumulative debt.</comment></comment>


Charlie Hebdo iOS - <AUTHOR> https://itunes.apple.com/us/app/charlie-hebdo./id957966299?mt=8

<comment><AUTHOR> It claims to be official, i have doubts. Can someone check the app?

<comment><USER2> It's linked from their offical page: [http://www.charliehebdo.fr/](http://www.charliehebdo.fr/)</comment></comment>


An update on the Google bar - <AUTHOR> http://googleblog.blogspot.com/2012/02/update-on-google-bar.html

<comment><USER2> I use Google Voice. Unfortunately that's nowhere to be found on my "google bar".

Yes, I see Translate, Offers, Blogger, Finance, Books, and Music, none of which I use. But I don't see Voice which is in the same account.

<comment><USER3> What's been frustrating for me, historically, is that the dropdown list _is different_ for different parts of Google. For example, compare it at google.com and at gmail.com.

I think they're _trying_ to improve it -- looks like in Gmail it lists services you use first, like Reader and YouTube, but not Voice? -- but it's certainly not consistent. Plus with each re-organization you have to re-learn all over again.

</comment></comment><comment><USER4> Apparently google fired all of its designers. "Where should we put this?" "STICK IT IN A BIG LIST."

Imagine if every program had a "File" menu and nothing else, with all the same options.

</comment><comment><USER5> Am I crazy, or am I not the only one that never actually got the Google bar in the first place? It never came up on my account.

<comment><USER6> I just got it like yesterday. I can't believe they're changing it back already.

</comment></comment><comment><USER7> Will this eventually reorder based on my habits? HNers will probably still bitch if the items moved around. DAMN YOU GOOGLES!

<comment><USER8> Please, learn from the experience of Office. Menus that change themselves confuse and infuriate every type of user --- experts, developers, novices, etc.

People build up muscle memory, and breaking it unexpectedly leads to very angry users.

</comment></comment><comment><USER9> Does google ever hire people that specialize only in design? It seems like a technical programming background is required. Does anyone know otherwise?

</comment><comment><USER10> While they were screwing around with this irrelevant nonsense, THEY BROKE SEARCH TODAY!!

Yes, all day none of the outbound links from Google search worked unless cookies were enabled. Unbelievable. They really have taken their eyes off the ball.

(They seem to have fixed it now.)

<comment><USER11> Do you have a link to a writeup? I haven't heard of anything like that.

<comment><USER12> <https://bugzilla.mozilla.org/show_bug.cgi?id=725634></comment></comment></comment>


Why I work at 10gen on MongoDB (and why you probably should too) - <AUTHOR> http://noshpetigara.com/post/7091732384/why-i-work-at-10gen-on-mongodb-and-why-you-probably

<comment><USER2> Well put. Many of the same reasons I joined 10gen and am very happy to work with Nosh ;)</comment>


Testing services on Kubernetes with Linux traffic control - <AUTHOR> https://kinvolk.io/blog/2016/05/testing-web-services-with-traffic-control-on-kubernetes/ <comment><USER2> There was also a very good talk on this exact subject at KubeCon EU 2016, if you want some additional material on the subject.

[https://youtu.be/67SyRpBja2I?list=PLosInM-8doqcBy3BirmLM4S_p...](https://youtu.be/67SyRpBja2I?list=PLosInM-8doqcBy3BirmLM4S_pmox6qTw3)

<comment><AUTHOR> Right, thx for pointing that out. This post is a follow-up to the talk Alban gave.

</comment></comment><comment><USER3> We need more tools like this. Following the Jepsen tests ([http://jepsen.io](http://jepsen.io)) its obvious that very few systems take network partitions and non-optimal network conditions into account.</comment>


How tracking pixels work - <AUTHOR> https://jvns.ca/blog/how-tracking-pixels-work/ <comment><USER2> This article is brushing a lot of stuff very fast. In reality there is much more to it:

1\. You don't need to visit Facebook properties for them to link your activity to you. Unless you're a brand new user and they have never finger printed you...

2\. Referrer might be in the pixel tracker, but there is way more to that, including product IDs, product costs, your stage in the funnel (have you Added to Cart but not Purchased?), product category, etc.

3\. Everytime a Facebook owned property (or piece of: Like button, FB connect) is 'used' by a device you use, then you can be sure the relation between you and that Pixel call is made (ahem, improved).

Install the Chrome Extension Facebook Pixel Helper, and check what happens when you use an ecom site. You'll be amazed to see what is shared with Facebook (no PII though).

<comment><USER3> In particular it would be interesting to go into why and how these 3rd party trackers get included on a page. I mean, the answer to both is obviously "money", but how does it work in practice? Old Navy agrees to implement a facebook tracking pixel in every page? Or it comes "for free" with a like button? etc.

<comment><USER2> It's part of the onboarding of any Facebook Ads user (i.e., advertiser) to implement the Facebook Pixel on their site.

Without it you're not going to achieve much on Facebook as you need to feedback their system when a particular ad had an impact so that they can model the ad delivery accordingly and get you more converting users. Whatever your conversion is (viewing a page, registering, purchasing).

</comment></comment></comment><comment><USER4> Ever since I enabled Dark Mode on Mac I started seeing so many 1x1 white tracking pixels on recruiter emails. Now I've disabled loading images by default in my email client.

<comment><USER5> I think I assumed 'tracking pixel' was just a metaphor — you mean they're literally serving 1x1 images? Why not 0x0 images? Why not a single transparent pixel?

<comment><USER6> All of tracking pixels I've worked with come with a css attribute "hidden", so they don't actually show except in some edge cases.

<comment><USER7> Huh... I thought browsers didn't fetch hidden images. Or is that only if the image or its parent elements are "display: none"?

<comment><USER6> I don't _think_ either case it true.

</comment></comment></comment></comment></comment><comment><USER8> >Safari and Firefox both block many third-party cookies by default (which is why I had to change Firefox's privacy settings to get this experiment to work), and as of today Chrome doesn't (presumably because Chrome is owned by an ad company).

Wow. I am very strongly considering switching to Firefox now, just from this paragraph.

<comment><USER9> Doesn't Chrome have a "Block third-party cookies" setting (disabled by default) that you can enable in Settings > Site Settings > Cookies and site data > "Block third-party cookies"?

I'm under the impression that Safari and Firefox have this enabled by default. Is the only difference that it's disabled by default in Chrome?

<comment><USER10> Safari and Firefox both have a blacklist of known trackers in addition to cookie blocking. Not only that, these browsers also fight against other means of fingerprinting.

<comment><USER11> Safari does not have a blacklist of known trackers; it generates one dynamically based on tracker-like behavior it sees as you browse.

</comment></comment></comment></comment><comment><USER12> If anyone's curious about why tracking pixels use a gif, here's a great explanation: [https://stackoverflow.com/a/6639140](https://stackoverflow.com/a/6639140)

<comment><USER13> You can do a png instead of a gif. It would be ~68 bytes instead of ~35 bytes. A webp image would actually be 1 byte smaller than the gif. So perhaps Google will move to that if Safari ever caves and supports it.

<comment><USER14> I was going to say: isn't "Content-type: image/webp" one byte larger than "Content-type: image/gif", making this useless?

But apparently 204 No Content allows you to omit Content-type. Leaving this up in case anyone else was wondering :)

</comment></comment></comment><comment><USER15> That's all nice, and I thank Firefox for blocking all these, but once there are too many browsers or extension doing the blocking, I wonder what will prevent sites to implement tracking server-side instead of client-side ?

<comment><USER16> Serverside doesn't have access to my tracking cookies. It has to be a request initiated by my browser to the third party domain

<comment><USER17> They will definitely keep tracking users based on info available to the server, like IP address. However that is orders of magnitude less precise than what is in place now.

<comment><USER18> Is it less precise? [http://uniquemachine.org/](http://uniquemachine.org/)

<comment><USER17> It certainly should be. You can make it _much_ more precise with the tracking mechanisms that browsers like Firefox are blocking now (tracking pixels, 3rd party cookies). It's the difference between having a snapshot in time available to a specific site vs. a whole history across the internet.

Facebook can't show you customized ads if all it can recognize is that it's you. It already knows who you are, you told it by logging in, now it needs to know everything you're doing everywhere else so it can connect all those dots to you. This can't work if all it can say is "this is definitely voidmain0001 from their home computer but I know nothing else about them". The only way is to share that tracking between companies which is more difficult and still more limited in scope than 3rd party cookies.

I know you are voidmain0001 here and can read all your comments. But if I have no idea who you are on amazon.com so I can sell you your favorite tech in my ads then the usefulness of this information is limited.

Just as a rule of thumb, if those mechanisms weren't adding to the precision then nobody would have invested so much in constantly developing them.

P.S. The site above keeps failing half way for me. "Computer says no" type of thing.

</comment></comment></comment></comment></comment><comment><USER11> > tracking pixels: it's not the gif, it's the query parameters

Sometimes it's also the base URL too.

<comment><USER19> Exactly, You're just a mod_rewrite away from serving a single gif under infinitely many names. All you have to do is include a unique name in every email, and then look through your log files to see if anyone came for that gif.

Tracking pixels are a pretty ancient technique and for good reason. It's basically no effort at all to set up the basics, and only a tiny bit more effort to get fancy at it and stick the accesses in a database instead of in the server logs.

<comment><USER20> The first party website can't see the tracking cookie so now tracking is compartmentalized for every first party and there is no more tracking across sites. Quite a win.

</comment></comment></comment><comment><USER21> Good and short description, but it's only a little part in digital marketing.

This is just retargeting, an old hat. You can do even more sophisticated things, like predicting what's the best next step in the sales funnel. In general, every step you take before you purchase online is recorded to build your customer journey. And there's a lot more data, like referrers, user agent, times and so on.

</comment><comment><USER22> Thank you for sharing this. I work with marketing tech, and having this laid out allows me to share with them a little more of the tech that we rely on.

And, it allows me to remind them that our work is utterly terrifying in terms of privacy. That's (part of) why I use Pale Moon, I have control of what gets downloaded or sent to servers.

</comment><comment><USER23> Its only a matter of time before the ad companies make their tracking unblockable e.g. by hosting something critical to the page, e.g. "make the webpage download jquery.js from our mirror, and you get all this tracking that can't be blocked!"

Isn't this happening already, and if not, why not?

<comment><USER24> This is called CNAME cloaking[0] and it's already happening in the wild[1].

      [0]: https://medium.com/nextdns/cname-cloaking-the-dangerous-disguise-of-third-party-trackers-195205dc522a
      [1]: https://9to5mac.com

</comment></comment><comment><USER25> Very nice and simple explanation. Worth reading if you still do not know.

I am not a bot despite sounding like one.

<comment><USER26> That's what a bot would say.

</comment></comment><comment><USER27> Do any browsers or popular blockers object to these things if they aren't setting cookies?

I've used a 1x1 transparent image on many pages on my site for a long time, with a simple page identifier attached to the URL, such as "?index" for the main page.

This was simply for convenience in analyzing logs. If I wanted to know which of those pages were visited in the last N days, it was a simple matter at the command line to take the logs for those data and make a quick report that counted how many times that image was fetched, broken down by page identifier.

</comment><comment><USER28> nice, quick intro in to how this crap works. combining DNS blackholing, plus adblockers and firefox or brave will make the biggest difference. :)

<comment><USER29> [https://jvns.ca](https://jvns.ca) is full of explanations that bridge the gap between general, layperson understanding and actual technically applicable knowledge. She's helped me relearn the Linux/bash ecosystem after a decade of absence.

</comment></comment><comment><USER30> This crudely represents one way law enforcement and intelligence agencies (friend and foe) identify targets for further analysis. Think about ways this is weaponized a little more. We saw an example of this in the US Navy prosecution of Gallagher for war crimes.

<comment><USER11> > This crudely represents one way law enforcement and intelligence agencies > (friend and foe) identify targets for further analysis.

What, using tracking pixels?

</comment></comment><comment><USER31> A future web browser will allow fine-grained access control for 1x1 pixel images (and other objects) that are retrieved from other domains...

</comment><comment><USER32> Hey, I ran one of those trackers once. Good stuff, though you only captured one aspect of the domain. Enabled lots of content. Good times, good times.

There are a couple of other use-cases other than the 3rd party ID-syncing use- case without a 3rd party cookie. You can record information through one of the client-side onboarding providers on their side. Though, to be honest, they have pretty big latency.

</comment><comment><USER33> Would also recommend Brave for privacy-conscious users.

</comment><comment><USER34> thanks for sharing good information

</comment><comment><USER35> So Google is hosting fonts because they are a nice company that is just providing us with free fonts?

Think again.

If you block tracking pixels you should also block the loading of external fonts. Extra bonus: fast loading pages.

Some CDN also exist for this reason.

<comment><USER36> The font resources are hosted on a cookieless domain and sent with caching headers. None of this applies.

The reason Google is hosting fonts is to make the web an attractive platform, so they can monetize you in other ways.

<comment><USER35> So my IP address never ends up in their logs?

<comment><USER36> IPV6 privacy extensions make IP addresses have very little tracking value, but this article is about tracking pixels, and Google Fonts clearly don't apply here. If you set your Referrer-Policy headers correctly, Google doesn't know which pages your users are visiting.

</comment></comment></comment></comment><comment><USER37> @jvns you can fix that ugly content overflow [1] with this:

      .entry-content code { word-break: break-all }

[1] [https://i.imgur.com/ajiycSw.png](https://i.imgur.com/ajiycSw.png)

<comment><USER38> Heads up that there's a repeated word in the first sentence too:

"I spent some time yesterday talking to a reporter yesterday"

Thanks for the post — I enjoyed it!

</comment></comment><comment><USER39> I don't see how, in 2020, any conscientious member of this site could justify their use or advocacy of Chrome. It's an evil product peddled by an evil company for evil means. The alternatives are as good if not better from a usability perspective.

Safari is great if you're a regular Mac user.

Firefox is great if you're a dev on any platform.

Chrome is toxic evil that needs to die for the good of humanity.

<comment><USER40> There's still some sites where chrome just works and Firefox does not including major sites like Periscope. I'm confident I could clear my cache/cookies, disable plugins, or other wizardry to get it working but in reality I just use chrome for these sites. That's why I'm a Firefox user but not an advocate. My mom can't handle the idea of using a different browser for some sites.

<comment><USER41> Not sure why you're being downvoted, this is sad but 100% true. For me, it's only a very rare site that doesn't work in Firefox, but one of them is my medical account. No choice but to have Chromium installed, otherwise I can't view my lab results, read my doctor's notes, and pay the bill. I assure you I don't like it but it's a fact of life.

I only use it for those very few sites (less than 1% for sure), but not having it handy at all is just not an option.

As for my mom, luckily she hasn't had any complaints so far, so she just uses Firefox as it's what's installed by default. I certainly don't think I could train her to switch between two different browsers, though. If it came to that it would have to be Chromium full time, there.

One site that deserves a plug here is binance.com. They stopped working with Firefox a couple of months ago, but it was fixed in 2-3 days after I reported it. I guess a little healthy (heh) competition goes a long way.

</comment></comment></comment><comment><USER42> Very good information</comment>


Ask HN: Graphical Tablet for Remote Collaboration - <AUTHOR> I find drawing very effective when i need to communicate ideas and explain architecture. However, i find it very unnatural and cumbersome to draw with a mouse on Google Jamboard (the app not the hardware).
I was thinking about getting a graphical drawing tablet, but I'm worried it is just a gimmick. And all reviews are from artists anyway.
Do you have a similar setup? What combination of hardware and software do you use? <comment><USER2> I've been doing something similar with some friends of mine for fun instead of work, but the concepts are the same. I purchased a relatively cheap Wacom knockoff from Amazon and have had very good luck with everything about it, from the pressure-sensitivity to the Linux support.

Depending on the software, the pressure-sensitivity might not work so well, but that shouldn't be an issue for whiteboard-style usage.

My recommendation is that you use a 60% or tenkeyless keyboard so that you can comfortably fit the drawing tablet to the far side of your mouse on the desk and still be able to type. Having a trackball is nice since it means that you don't have to give yourself a large area in which to use the mouse. If you're ambidextrous with the mouse, this won't be an issue.

<comment><AUTHOR> Thanks! can you share the model you have ?

</comment></comment><comment><USER3> I'm not an artist but tablet displays feel more natural than plain tablets to me. Consider a "convertible" laptop with a built-in Wacom tablet. For example, I recently got a Lenovo Yoga 12 and found it to be super nice for not very much. I don't really need the tablet, but I tested it with The GIMP and it worked great!</comment>


Making Games in Unity with No Experience (YT Series) - <AUTHOR> https://www.youtube.com/watch?v=K2OGes1-b6E&list=PLUtKzyIe0aB3TZfe2wsIgJgGZW5G_NAxa <comment><AUTHOR> Tom Francis, maker of a number of indie darlings, has started a great youtube series on how to make games in Unity with limited experience. Does a great job (so far) balancing why you do stuff, and just doing the stuff and telling you how to mess with it.

It reminds me, in many ways, of the QBasic programs I used to mess with as a kid. (Looking at you, gorillas.bas)</comment>


European Critics Envision Google's 'Unbundling' - <AUTHOR> http://online.wsj.com/articles/european-critics-envision-googles-unbundling-1416614877

<comment><USER2> Technical challenges are for technical people to solve and not the EU. Last time the EU attempted to solve a technical problem with legislation we all got the mandatory cookie educational program.</comment>


GitPlex – browse code in Git repository like in IDE - <AUTHOR> https://www.gitplex.com <comment><USER2> Sourcegraph is also working on a similar service.

Also: unless you've okayed the name with the Git folks, you're going to need to change the name. Git is trademarked, and they are no longer allowing just anyone to use the mark without first seeking permission. (GitHub, GitLab, and others have been grandfathered in.)

See [https://public- inbox.org/git/20170202022655.2jwvudhvo4hmueaw...](https://public- email@example.com/)

<comment><USER3> The usage of "Plex" also confused me as to what this was.

<comment><AUTHOR> Not a native English speaker. In my dictionary "plex" has the meaning of "many things". Also I heard of googleplex. And the software manages many git repositories, so I use the name "GitPlex".

<comment><USER4> There's a good chance the commenter you replied to meant confusion with Plex the streaming media server, too.

<comment><USER3> Yep.

<comment><USER4> Are you by chance the same viper007bond from wp-hackers I knew 10+ years ago?

<comment><USER3> Yep, there's only one of me. :)

</comment></comment></comment></comment></comment></comment></comment><comment><AUTHOR> It parses source code of popular programming languages so that user can search symbols, jump to symbols, show/search outlines in every revision of the repository.

Currently supports Java/JavaScript/C/C++/CSharp/Python/Go/PHP/R/CSS/LESS/SCSS.

<comment><USER5> This should be on the homepage in big bold letters

<comment><AUTHOR> Good idea. Make it appearing on home page now, :)

</comment></comment></comment><comment><USER6> You could benefit by throwing up a 60 second walkthrough video. I know it's not a complex concept to grasp, but it would help ensure people can check it out quickly, without missing any of the highlights you might point out,

<comment><USER7> Even that should be the second level in. If it says "watch this 60 second video we'll explain it" they better already have teased me with something.

I'd make a 6 second animated gif with some key feature (picture of UI, key feature invoked e.g navigation to symbol). Being a gif means it can auto play which a video shouldn't.

</comment></comment><comment><USER8> This webpage is rather unreadable on an iPhone. White text on an image with a partially white image seems a might problematic to me...

<comment><USER9> After browsing the website on said iPhone, I still don't know what your product is, looks like, or does. There's no screenshots besides the videos but I'd rather not watch videos to learn about something.

<comment><AUTHOR> It is a self-hosted Git repository manager. Updated web site to make this explicit.

</comment></comment></comment><comment><USER7> Please make version control systems pluggable if you make a larger scope product. For a source nav product building it "on" git is fine. But once it has builds, issues etc it would be great if it also supported other version control systems. This is the biggest flaw of some of the existing players (e.g github).

I have high hopes that git will be replaced by something better, but the more products there are built on top of it, the harder it gets.

<comment><USER10> Pluggability is very hard. Different version control systems have entirely different concepts of revisions.

It's very obvious, and much worse, when an IDE has plugins for VCS, as often the VC concepts aren't mapped well. When original git integration came out it was often terrible, because it forced git to behave like SVN.

I'm not saying we should tie ourselves into a single VCS, but tight integration has lots of benefits, and pluggabilty while maintaining those benefits is harsh bordering on impossible.

</comment></comment><comment><USER11> > Analyzes commit history for intuitive commit query

I'd work on the copy on the home page if I were you. This isn't a valid English sentence.

<comment><USER12> It seems that either the whole copy has been written with Google Translate or the whole _page_ has been _generated_ to target specific SEO keywords.

</comment></comment><comment><USER13> I love this feature: source browsing with cross reference. It's fantastic. I hope GitHub can also provide this long time ago, but it seems that they are too slow to add new features.

Now, most of the git products provide one-stop project management features, such as issues, discussions, docs, continuous integrations, any plan to add those features in GitPlex?

<comment><AUTHOR> Thanks for the kind words. My next priority is to add issues to GitPlex, and then builds. I worked on a continuous integration system for more than ten years, and have some lessons learned to be put into GitPlex.

</comment></comment><comment><USER14> I like the fact that everything loads really fast and the file encoding is informed.

<comment><AUTHOR> Thanks for trying. I spent a lot of time improving the performance, and it works pretty fast for very large repositories such as Linux, Chrome, etc.

</comment></comment><comment><USER15> > Free for up to ten users

I couldn't find any more billing information. Is there anything?

<comment><AUTHOR> $20 per year per user for additional seats: For more information: [https://www.gitplex.com/purchase](https://www.gitplex.com/purchase)

<comment><USER15> Ah, just found it.

Clicking through the button labelled "Free for 10 users" was a bit confusing though, mostly because with a button with that text, I was expecting to see mention of other plans.

<comment><AUTHOR> Makes sense. Updated the web site to point to purchase page for this button.

</comment></comment></comment></comment><comment><USER16> This is nice. I really love this. However, it is lacking demo for pull requests and I wonder what happen to the tree graph if there are too many branches.

<comment><AUTHOR> Please check here for pull request demo: [https://dev.gitplex.com/projects/gitplex- docs/raw/1.0/video/...](https://dev.gitplex.com/projects/gitplex- docs/raw/1.0/video/iterative-review.mp4)

As to tree graph for too many branches, can you please elaborate?

Thanks!

<comment><USER16> The link you gave me responded with :

``` Object Not Found Unable to find blob path 'video/iterative-review.mp4' in revision '1.0' ```

About tree graph for too many branches, please take a look at an example, such as [https://dev.gitplex.com/projects/tensorflow/commits](https://dev.gitplex.com/projects/tensorflow/commits). You can see on the left of the commits, there is a tree. I just want to know if we have a lot branches, how the UI handle that :)

<comment><AUTHOR> Sorry, correct video link here: [https://dev.gitplex.com/projects/gitplex- docs/raw/1.0/video/...](https://dev.gitplex.com/projects/gitplex- docs/raw/1.0/video/pull-request.mp4)

As to tree display for many branches, GitPlex will abbreviate the line with arrows like below: [https://dev.gitplex.com/projects/gitplex- docs/blob/1.0/image...](https://dev.gitplex.com/projects/gitplex- docs/blob/1.0/images/many-branches.png)

</comment></comment></comment></comment><comment><USER17> Does thos work alongside an existing git solution (such as GitLab), or is it an alternative/replacement?

<comment><AUTHOR> It is an alternative/replacement, and we plan to add issues/builds in future versions.

</comment></comment><comment><USER18> very nice. It would be nice to have similar features on github, right now I have to clone the repository and use gitk.

</comment><comment><USER19> This looks pretty bad, hard skip, but I have been desperately wanting this as an IDE plugin for my IDE of choice. I would gladly pay for a plugin that let me fully review pull requests entirely in my IDE. Comment, approve, see hooks, etc. Nothing like that currently exists.

<comment><USER20> Could you elaborate on what looks bad about it?</comment></comment>


OpenBSD's unveil() - <AUTHOR> https://lwn.net/Articles/767137/ <comment><USER2> _> There is no reason why your PDF viewer should be able to read your SSH keys, for example._

Well GNOME's evince can read remote files over at least http/https and ftp, eg: evince ftp://remote/foo.pdf. I guess it's just a short step to adding ssh/sftp support. The remote support is implemented using glib's [https://developer.gnome.org/gio//2.36/GFile.html#g-file- new-...](https://developer.gnome.org/gio//2.36/GFile.html#g-file-new-for-uri) which has a generic plugin mechanism for URL schemas, although I didn't look into whether ssh is already supported.

:-)

<comment><USER3> I'd argue this is a misfeature. Different users have different needs, but I really like knowing that especially my basic "view a file downloaded from the Internet"-applications have a limited attack surface, even if that means it has fewer features. Actually, I'd prefer to have that confidence for _all_ my applications, possibly except necessarily overcomplicated behemoths like web browsers or Emacs.

<comment><USER4> Wouldn't it be better to expose these other schemas via FUSE mounts anyway? I suppose the main issue is one of UX— how do you make a system "Open file/path" dialog that under the hood is capable of setting up and properly lifecycling something like an sshfs mount? Almost seems like a thing you'd want support for at the systemd service level.

OTOH, doing it as a system dialog that runs safely in its own process feels a lot better to me than building the functionality into every app in a piecemeal way.

</comment></comment></comment><comment><USER5> It's a great concept. But I would NAK the API for Linux:

> Calling unveil() for the first time will "drop a veil" across the entire > filesystem, rendering the whole thing invisible to the process, with one > exception...

Sorry, but the semantics of calling it once should be similar to the semantics of calling it twice. The first call _veils_ and the second call unveils.

Also, on Linux at least, efficiently implementing "you can only see this subtree" is quite tricky due to races against moving the directories in question around. I wonder how OpenBSD gets around those races.

<comment><USER6> From context I understand the meaning, but what does "NAK" mean here? I'm guessing it's an acronym?

<comment><USER7> Not acknowledge, e.g. would advise against and, if were the maintainer, would reject the change.

ACK and NAK are used quite a lot in communication protocols, and the usage drift from there.

</comment></comment></comment><comment><USER8> I like this. It's simple, progressive, delivers a real benefit instantly, cheap and easy to understand.

Entirely the opposite of SELinux.

</comment><comment><USER9> I'm working on a problem where I have a single executable that is run as a dynamic number of long-running processes where I'd like to restrict each process to a separate directory.

For example, process 1 could only r/w files in "/some/path/1" and process 2 could access "/some/path/2". But the number of processes is dynamic. I might have two or I might have 100. So I need to be able to specify new directories at runtime.

I've been looking at the linux hardening mechanisms but I couldn't find a way to do this with, for example, selinux. With selinux it seems you are mostly able to create system level policies that applied to whole programs. I haven't found a way to provide something like a parameter to change the policy for a given process.

But it looks like this would be very easy to accomplish with unveil(2). This is very interesting work!

<comment><USER10> Out of curiosity, what would be the point of restricting child processes to specific directories?

If I trust a binary to read a directory, what's the point of constraining specific processes further?

The only use case I could think of is where the binary itself runs untrusted code from a third party. (e.g. plugins).

<comment><USER11> The point of pledge(2) (and unveil which builds on and complements pledge(2)) is to protect against the consequences of human failing: if the software has an accessible exploit, limiting its ability to see the system means the attacker has a much harder time pivoting into something useful.

That's why pledge(2) and unveil(2) are useful despite _literally being part of the software it restricts_.

</comment></comment></comment><comment><USER12> An audience member recorded a recent talk about OpenBSD unveil(2), given last month.

[https://www.youtube.com/watch?v=wdeFQJXd_II&list=PLbx1j8Pb6u...](https://www.youtube.com/watch?v=wdeFQJXd_II&list=PLbx1j8Pb6u3CMxFPYESt2eBoLh8CFdCrd)

</comment><comment><USER13> The simplicity, and the fact that it forces conscious choices at source/compile time are great, but I wonder if it comes at the cost of flexibility. For anything sufficiently complex, you'll need some configuration after deployment, which selinux handles through policies and labels. In case of unveil, are the file paths hardcoded ? As a simple example, you build chromium with write access to ~/Downloads. What happens if you want to write to ~/New_Downloads ?

<comment><USER14> The paths that you unveil(2) can be hardcoded, set from a command line flag, or parsed in from a config file. What can't be done, however, is arbitrary file access at runtime, as there would be no point at which you could lock unveil or drop the equivalent pledge promise.

For the chrome case, you can currently only access ~/Downloads. This involves changing our habits as /users/. If you need to access files from outside this directory, you need to open a terminal and copy/move files there yourself.

That said, for now.. the chromium package does actually have a external unveil policy in /etc/chromium/unveil.* for each process type (main, gpu, renderer, etc). But that won't necessarily always be there.

<comment><USER11> > For the chrome case, you can currently only access ~/Downloads. This > involves changing our habits as /users/. If you need to access files from > outside this directory, you need to open a terminal and copy/move files > there yourself.

That is where Apple's approach is probably better: have an entirely separate process bridging the software and specific tasks. The bridge process should be easier to audit (and can have its own restrictions and sanboxing e.g. the only things it needs are to communicate over a socket and see the filesystem), and the browser never gets to see the filesystem.

<comment><USER14> OpenBSD was already using pledge(2) to protect the different chrome process types, many of them can't access the filesystem directly. Chrome actually has a privsep design, IPC, fd passing over Unix sockets etc.

For example, the GPU and plugin processes can only act on file descriptors received this way:

[https://github.com/openbsd/ports/blob/master/www/chromium/pa...](https://github.com/openbsd/ports/blob/master/www/chromium/patches/patch- services_service_manager_sandbox_openbsd_sandbox_openbsd_cc#L227)

But this alone doesn't protect this "bridge" process itself from accessing the filesystem, this includes your SSH keys, which is where unveil() comes in.

<comment><USER11> > But this alone doesn't protect this "bridge" process itself from accessing > the the filesystem

Of course not, but the point is that the bridge process only comes in contact with the user and a software invoking it, and its sole purpose is to pick a file on the filesystem.

Including your ssh pubkey if that's what you need to select/upload.

<comment><USER14> Perhaps that's the case, and that's all it's doing, but at least for chromium, it's the main browser process itself currently handling the Open/Save File dialog box.

</comment></comment></comment></comment></comment></comment><comment><USER15> > _There is no reason why your PDF viewer should be able to read your SSH > keys, for example._

Is there any way to make use of unveil() at the _command line_ to accomplish the above? To clarify, I suppose unveil() is not intended to be used that way, but will there be some sort of wrapper that allows us to restrict a third- party already-compiled program to certain directories only?

<comment><USER16> The entire point of unveil() and pledge() is tight integration with the program itself, the programmers know best what their program requires, and unveils/pledges are typically invoked AFTER all the startup junk executes (such as reading in libraries, config file dances, etc).

To restrict it before the program even starts would require a huge amount of what amounts to spurious unveils once the program starts its main operating loop, and really misses the point of the abstraction its trying to create.

This is exactly where approaches like selinux fail, they rely on static distro/user defined policy that can only ever be set from before the program starting, and thus must encapsulate everything the program might ever try to do. With unveil and pledge, the program itself indicates what each branch needs to do, and can much much more tightly restrict itself.

<comment><USER17> I don't think they fail. Usually you profile the program first, and once you set up the rules, a deviation might get blocked. If you want to define what the program is definitely not authorized to do, this is the way to go.

Using the unveil() is a completely different approach that should yield less false positive and involve less hassle. There is just one caveat: you need to make sure the binary hasn't been tampered with. If someone replaced/modified it, SELinux will block unauthorized behavior, whereas counting on unveil() still working in this case might let you down.

<comment><USER18> _"If someone replaced /modified it […] counting on unveil() still working […] might let you down."_

 _Might_ is an understatement. If somebody changed what you run, there's no guarantee at all that it even still _calls_ unveil.

However, I would think chances that your system is set up such that third parties can tamper with your binaries are about equal to those that the system setup allows them to 'tweak' your SELinux configurations.

</comment></comment></comment></comment><comment><USER19> Is it just me or are they reinventing the plan9 vfs and it's mount, bind and rfork calls?

</comment><comment><USER20> It would make more sense for process spawns to specify veiling behavior, such that unveil() only unveils things.</comment>


Covid-19, T-cell immunity and vaccine industry - johnx123-up https://twitter.com/JamesTodaroMD/status/1292873236716433416 <comment><AUTHOR> It's frustrating that narrative seems to be that NYC somehow is an exemplar and they perfectly timed "getting their act together" and that's why there isn't much spread.

So in spite of however many thousands of protesters for months and the seeming resurgence in cities that weren't hit hard in the initial wave in the US, and NYC not experiencing that - we're supposed to believe it's cause NYC is now wearing masks and not some type of immunity in the population?

Something doesn't seem right with the popular/expert narrative (which has been consistently wrong and unable to predict events accurately so far, or even make decent recommendations).</comment>


Show HN: My weekend project to learn JavaScript OOP - <AUTHOR> http://220.127.116.11:3001 <comment> at-fates-hands Remind me again why journalists would do this over a factory that builds. . . batteries?</comment>


IPad still kicking Android Butt, No End in Sight - <AUTHOR> http://www.lessonsoffailure.com/companies/ipad-kicking-android-butt/ <comment><USER2> I like my Galaxy Tab. I found it actually is more usable as a tablet than the iPad. The home screens are more powerful, the native Google Apps kick more butt, and its multitasking is better.

Sure, it doesn't have all the apps, but I use the web more than anything.

The article seems to be written from a fanboy perspective. I don't care about sales. I care about the platform.

Android is open. I can do more with it. That's what I care about.</comment>


Tesla Model S Burns During Supercharging in Norway: Reports - <AUTHOR> http://jalopnik.com/tesla-model-s-burns-to-a-crisp-during-supercharging-in-1750581400 <comment><USER2> I wonder what caused this, and how often similar stuff happens with ICE cars. I know fuel can be ignited when refueling, but there are all sorts of steps to mitigate that. Were any errors committed in this disaster?

If a kid was in a baby seat in there, it would have been awful.

<comment><USER3> Static discharge causes a lot of gas pump fires. Enough that I remember seeing shows on Discovey Channel that talked about the fact that once your car is pumping, you shouldn't re-enter and exit the vehicle until the nozzle is out. Especially if you're the one touching the nozzle.

And for god's sake don't pull the nozzle out once the tank ignites. That makes a fireball.

In short, it's common enough that warnings about it show up on daytime television.

edit: That said, charging batteries burn often enough that every high-power charging device I've ever had said not to leave it unattended while charging. When you're pumping that much energy into something that quickly, things can happen.

<comment><USER4> This is news to me. In the UK the petrol pump nozzle has to be held, you can't just put it in there and expect it to fill up your tank - at all times the handle has to be held. Is this not the case in the USA? Can you put the nozzle in the tank, walk about, get in and out of the car and rely on the nozzle staying in the tank, filling up the tank until it magically knows the tank is full? If so then that is where your problem is. In the UK we don't have forecourt fireballs, it sounds to me that this is an American 'innovation', one that is probably needed given that Americans need to consume their own bodyweight in 'gasoline' to get to work and back in one of Detroit's finest 'cars'.

<comment><USER5> > Is this not the case in the USA?

Most of the time, no. Not _every_ pump handle has a functioning hold-open mechanism, but the vast majority of them do.

> ...filling up the tank until it magically knows the tank is full?

It's not magic, it's simple application of physics. [0] I would be _shocked_ if this wasn't a feature of _every_ nozzle that was usable by members of the public... nozzles in the UK included. :)

[0] [https://en.wikipedia.org/wiki/Fuel_dispenser#Automatic_cut-o...](https://en.wikipedia.org/wiki/Fuel_dispenser#Automatic_cut- off_in_fuel_dispenser)

</comment></comment></comment></comment><comment><USER6> According to an Norwegian article so was the car brand new, only delivered to its owner two days ago: [http://www.dagbladet.no/2016/01/01/nyheter/bil/fritid/brann/...](http://www.dagbladet.no/2016/01/01/nyheter/bil/fritid/brann/42589222/)

The car was connected to a public Tesla supercharger that can deliver 120 ampere and 500 volt.

</comment><comment><USER7> In the event of a destructive fire caused by a manufacturing defect, does Tesla replace the car or offer a full refund based on a replacement value of a Tesla without going through the owner's insurance even if it is outside the warranty period? Or must the owner file a claim with the insurance company?

</comment><comment><USER8> When a large lithium battery (car, Powerwall) combusts, what area is contaminated with hydrogen fluoride? Since its a gas (unless dissolved in water) would it dissipate without trace or leave behind toxic residue ?

<comment><USER9> I don't think there's any fluoride in these batteries. The Model S uses Lithium Nickel Cobalt Aluminum (NCA) batteries and the powerwall uses Lithium Nickel Manganese Cobalt (NMC) batteries. Neither contain any Fluorine, and since they produce electricity using chemical reactions not nuclear reactions, no new elements will be produced. Not too sure what you're asking.

Source for the battery composition: [http://fortune.com/2015/05/18/tesla-grid- batteries-chemistry...](http://fortune.com/2015/05/18/tesla-grid-batteries- chemistry/)

<comment><USER8> Seems the issue is not settled. NMC were also tested: [http://www.ncbi.nlm.nih.gov/pubmed/25714114](http://www.ncbi.nlm.nih.gov/pubmed/25714114)

and

"More HF is generated per cell as the number of cells increases. The NMC cells tested generate significantly less HF gas than the LFP cells. However, only one cell type from a single supplier was tested so it is impossible to conclude if this is a general characteristic of NMC cells."

[http://www.egvi.eu/uploads/Scania%20-%20Abuse%20testing%20of...](http://www.egvi.eu/uploads/Scania%20-%20Abuse%20testing%20of%20E-vehicle%20battery%20cells%20and%20packs- aat.pdf)</comment></comment></comment>