Ask HN: Why is UIWebView in iPhone SDK a second class citizen? - <AUTHOR>

I tried my hand at development for the iPhone the year before last, but all of ideas blurred the line between native and web applications. However, this proved to be impossible on the iPhone as the UIWebView isn't even close to being Safari. Now I hear the new OS upgrade doesn't offer access to the new optimized JavaScript engine. I know Apple wants to control various aspects for overall better user experience, but it seems that the only options are to fork WebKit or otherwise be someone with the money to be able to negotiate with Apple. Does anyone know of practical, exact reasons why this may be, or is Apple really trying to weed out the lone developer with ideas that are alternatives to the Apple way? <comment><USER2> what were you trying to do? I've found the UIWebView to be pretty decent and have worked on some hybrid native/web apps.

I have native code calling into JS code that runs in UIWebView, and JS code calling back into Obj-C, etc.

<comment><AUTHOR> Oh don't get me wrong, it does I guess what it promises, but lets take for example scrolling. The built in Safari has great physics reactions and overall nice and speedy. The UIWebView is very flakey on scrolling (this was I guess version 3 something when I was messing with it). In general, the rendering I found to be rather different at subtle CSS settings. The same page in Safari would act one way, whereas UIWebView would render it differently. Now lets talk same origin policy. Android and iPhone both honor this as they should, but at the time I was developing, iPhone even enacted this for XML calls. If you did an XML call on the Obj-C side, from a remote server, it would not let you mix that data with your local served web page resources. Now the biggest thing is this point some of dev friends are making that there's a new performant javascript interpreter, but it is hands off to the developer. Another avenue I tried was to access iframes, from a foreign server, with javascript, ala greasemonkey ... no go there. The origin policy is enforced because the page running your javascript is locally hosted. I love the origin policy for general web use, but if I'm designing a browser more or less, it shouldn't apply. I would also think this is safe because UIWebView seems to support having its own history, cookies, etc, so it isn't like I'm trying to sniff what else the user might be doing elsewhere. So far in my android dev experience this all just works, and I'm even given a WebKit class to work with.</comment></comment>


How Did the Duck Hunt Gun Work? (2011) - <AUTHOR> https://www.mentalfloss.com/article/26875/how-did-duck-hunt-gun-work <comment><USER2> My second software job was strange. I was interviewing for the niche position of "troubleshooter" in 2001 @ bizrate (an e-commerce rating company). During the interview I was asked a number of classic MSFT/Google style brain teasers, including "list a number of ways to move a mountain" and "how does the Nintendo duck hunt gun work" (which I guessed at, correctly over 30 seconds on how I would make such a game). When I was a kid playing with it, it never entered my mind to think about the functionality.

<comment><USER3> "list a number of ways to move a mountain"

The canonical answer being paint it pink and apply a Somebody Else's Problem Field? Or is that an indication you're "not a cultural fit"?

<comment><USER2> Painting it pink and then trying to assess how it feels (move it emotionally) is not an answer I gave. That's very creative. You got the gist.

</comment></comment></comment><comment><USER4> The article says you don't notice the blackout and flashing, but I always did. Can other people see it?

<comment><USER5> it's very noticeable in duck hunt, but I always assumed it was a deliberate effect.</comment></comment>


Explaining and Harnessing Adversarial Examples [problem with deep networks] - <AUTHOR> http://arxiv.org/abs/1412.6572

<comment><AUTHOR> Quote from Intro:

These results suggest that classifiers based on modern machine learning techniques, even those that obtain excellent performance on the test set, are not learning the true underlying concepts that determine the correct output label. Instead, these algorithms have built a Potemkin village that works well on naturally occuring data, but is exposed as a fake when one visits points in space that do not have high probability in the data distribution. This is particularly disappointing because a popular approach in computer vision is to use convolutional network features as a space where Euclidean distance approximates perceptual distance. This resemblance is clearly flawed if images that have an immeasurably small perceptual distance correspond to completely different classes in the network's representation.

These results have often been interpreted as being a flaw in deep networks in particular, even though linear classifiers have the same problem. We regard the knowledge of this flaw as an opportunity to fix it. Indeed, Gu & Rigazio (2014) and Chalupka et al. (2014) have already begun the first steps toward designing models that resist adversarial perturbation, though no model has yet succesfully done so while maintaining state of the art accuracy on clean inputs.</comment>


Adopting DevOps (Blog Series): Addressing Data Friction - <AUTHOR> https://sdarchitect.blog/2019/03/06/adopting-devops-part-v-addressing-data-friction/ <comment><USER2> Weird article. I kinda expected some sort of example design or products.</comment>


University of California introduces a modern logo - <AUTHOR> http://www.chicoer.com/news/ci_22141280/university-california-introduces-modern-logo

<comment><USER2> This looks like something made by a ten year old who just learned photoshop.

If this actually catches on, I'll eat my hat, but from where I'm standing it's one of the worst logos I've ever seen. It's unclear in meaning and borders, uses gradients poorly, and isn't balanced.

<comment><USER3> The gradient is what kills it for me.

Is it supposed to represent a buffer, spinning away as you shovel tuition in until you can load "the real world"? :P

<comment><USER4> Yeah, the single color versions they had in the video look much, much nicer.

</comment></comment></comment><comment><USER5> This seems like deja vu, University of Waterloo was also trying to modernize its logo, didn't go to well: <http://www.youtube.com/watch?v=0lF1YfYOumM> of course a Hitler interpretation: <http://www.youtube.com/watch?v=gHLKp3lwdK0>

Instead of replacing everything, the new logo is used only for advertising materials, while the old logo remains on the diplomas.

p.s the new logo looked horrible once it was introduced, but a year later most people don't mind it; though it left a really bad impression on the student body as the university decided to pretty much ignore the popular opinion

pew pew

<comment><USER6> Seems to be going around. Stanford did something similar just recently as well:

[http://www.change.org/petitions/stanford-university-bring- ba...](http://www.change.org/petitions/stanford-university-bring-back-the-old- logo-or-provide-a-better-redesign)

</comment></comment><comment><USER7> As a UC Berkeley student who has a passion for design, I can honestly say that the UC system has made a mistake here. Though I imagine this is probably the popular opinion.

However, I attempted to figure out what the symbolism in the logo was supposed to be. Disregarding the "fresh, hip, and modern" style that they were going for, I can definitely see how this could have been pitched. From my analysis, the U is supposed to subtly be shaped as a book and the C is supposed to be a loading sign... It's symbolically loading knowledge.

Regardless of the symbolism, my opinion is that it is painfully ugly and not representative of the UC system. If the regents were democratic, I would definitely vote to throw it out.

Edit: I didn't actually see the associated video before posting. [1] At least the book symbolism shined through without knowing that first. That's one plus, I suppose.

[1] <http://vimeo.com/53530934>

</comment><comment><USER8> Did they pay some logo consultant over six figures for that?

Did they run a competition for student and professor entries at their various schools?

It does look nicer than the DeVry shield it pays homage to. [http://www.gmkfreelogos.com/logos/D/img/DeVry_Education_Shie...](http://www.gmkfreelogos.com/logos/D/img/DeVry_Education_Shield_75th_year.gif)

</comment><comment><USER9> They will revert. I'll put money on it. Who's in?

<comment><USER10> Not me. It's hideous.

<comment><USER11> You're in agreement with the parent comment. "Who's in?" means, "Who's in on the bet that they will revert the logo [because it's hideous]?" (We're all in agreement, of course. This new logo is the seventeenth sign of the Apocalypse.)

<comment><USER12> I read that he wanted someone to take the bet with. As in he wanted someone who disagreed so they could stake money on the outcome.

</comment></comment></comment></comment><comment><USER13> Brand New did a review on the new logo that brings some more insight and perspective [1]. Here's an interesting note:

 _Basically, the previous wordmark could have not even existed and no one would have complained._

1\. [http://www.underconsideration.com/brandnew/archives/ic_uc_we...](http://www.underconsideration.com/brandnew/archives/ic_uc_we_all_c_for_california.php)

</comment><comment><USER14> It's possible to have an emblem for a stately, revered and old institution that looks modern, looks good in print but not so... _well_ , saccharine-y silly looking.

Consider the French government logo:

[http://en.wikipedia.org/wiki/File:Logo_de_la_R%C3%A9publique...](http://en.wikipedia.org/wiki/File:Logo_de_la_R%C3%A9publique_fran%C3%A7aise.svg)

<comment><USER15> Reminds me of this: <http://en.wikipedia.org/wiki/File:Major_League_Baseball.svg>

</comment></comment><comment><USER16> Waiting for the new logo to fully load, all I see is a slow yellow loading gif.

</comment><comment><USER17> Just terrible. I hate to see this new trend of creating these new logos. It reminds me of Web 2.0. The old logo is beautiful and timeless.. this new logo is just.. ah.

Their new slogan tops the cake: "Whether you know it or not, the University of California, or a UC grad, has probably played a part in your day."

</comment><comment><USER18> If the aim was to design something modern and minimalistic , the fading gradient at the end of letter 'C' somewhat destroys the point. Clear boundaries would improve the clarity and enhance applicability (on stationaries, prints, etc). I don't mind going modern, but they should do it well with clear purpose.

<comment><USER19> That's a 'C'? I though it was a loading spinner!

</comment></comment><comment><USER20> When this was announced a few weeks ago, the University of California added this comment to their Vimeo account:

"Thank you again for all your thoughtful comments and feedback. To clarify: this new visual approach DOES NOT replace the historic UC systemwide seal. We love the seal. The seal will still be used in all formal systemwide communications, on diplomas, official regental and presidential communications, and other formal applications.

"The two symbols serve very distinct roles. To preserve their gravitas, many of our campuses, and other universities across the country have limited use of their official seals in similar ways. It also does not replace the individual identities of each of our UC campuses. It gives our campuses and others a simple, distinct way to reference the system as a whole.

"We looked at many different solutions, but felt that building off the seal was a great way to honor our history, while also pointing to our strong tradition of pioneering innovation. We've done considerable testing on the overall approach, and have generally heard very positive feedback."

\---

To me, the new logo looks cheap and flashy, instead of timeless. Universities are some of the only long-lasting institutions that we have, and this new visual style has zero life in it.

Someday, we'll look back at this logo like we look back at bellbottom jeans and denim jackets.

</comment><comment><USER21> it just looks like the wait spinner in Android stuck in a baby-blue tarp...

Honestly who came up with this idea.

</comment><comment><USER22> Wow, that looks terrible.

<comment><USER23> The survey widget says 96% prefer the old logo to the new one. I couldn't find anywhere on the UC website that referred to the new logo. Is this official, or just a proof of concept?

<comment><USER24> <http://admission.universityofcalifornia.edu/> <http://research.universityofcalifornia.edu/> <http://vimeo.com/universityofcalifornia>

all use the new logo

</comment></comment></comment><comment> B-Con I went to UC.

Need to stock up on my alumni clothing before this hits the stores. Bleh.

</comment><comment><USER25> Wow, was there a contest to top the London 2012 Olympics logo for worst logo ever?

</comment><comment><USER26> That is what I would consider an atrocious logo. Who did they test this against?

</comment><comment><USER27> Awful. Simply awful.

</comment><comment><USER28> This is so fucking terrible. The fact that UCs will now have this awful logo makes me a little sad.

As a side note, that video is really stupid. It seems like they're trying to show how the new logo evolved form the old logo, but in the video they handwave away all the old parts and then trace around the book in the center, but only use one random edge of the book shape. WTF? Why even pretend that's where the top edge of the new logo came from. this whole thing is a disaster. Seriously. What the fuck.

</comment><comment><USER29> That logo reminds me of the first time I figured out how to make gradients in Photoshop. It wasn't good then, and it isn't good now.

</comment><comment><USER30> It's a shame seeing such an interesting historic logo get replaced with one that has little personality and uniqueness. Something similar to the Starbucks logo redesign might have been more appropriate, keeping the idea of the original logo but refining and simplifying to make it more modern.

<comment><USER18> couldn't agree more

</comment></comment><comment><USER31> They're going to struggle to get that printed on anything. Yellow on blue is just asking for muddy colors.

</comment><comment><USER32> Your tax dollars at work, Californians.

</comment><comment><USER33> Best part about this is the link to my home town newspaper. I used to deliver the Enterprise Record every afternoon on my bike after school. Yes, in the 70s the Enterprise Record was an afternoon paper.

</comment><comment><USER34> huge fn waste of money when the system is starving (or being starved by the inflated administration). don't the big bosses know this is a SOCIALIST UNIVERSITY SYSTEM and should just stick with the "good enough" cheap logo to keep tuition more affordable?

of course not... because they're eager to sell out the people to the banksters. instead of creating a political push for more funds from the state, they are pushing to get more private donations. it's the wrong way to go.

</comment><comment><USER35> Hey all, I created a Facebook page, just for fun:

<https://www.facebook.com/UCAlumniAgainstNewLogo>

</comment><comment><USER36> Simplistic logos are so easy to pan mercilessly & dismiss, and as a UC grad that was my first instinct too.

But a quote on one of the subsequent sites in the comments (from UC's creative director) makes their case:

"Previously, the UC system only used its seal as its primary visual identifier, where it was abused with impunity. . . this is less of a rebranding exercise, but instead the creation of a coherent, consistent, and relevant brand identity where before there was none."

This actually makes sense to me.

The UC system has always been intimately connected in name, but disconnected in culture and practice.

So visual execution of the logo aside, pushing to have a unified brand in front of the millions of eyeballs that are exposed to the UC system every year is a pretty damn smart move from a branding perspective.

<comment><USER7> The strategic thinking behind the move is brilliant. Even if the logo cost $100,000 there is an argument to be made that more people will be able to connect with the brand and hopefully will donate. I'm quite certain that this type of move could be majorly profitable. But as hackers we know that a solid idea is not enough... the execution is what truly matters. The UC system's idea is awesome; the execution is pretty bad.

<comment><USER37> "Even if the logo cost $100,000 "

It's likely going to cost millions. All the letterhead. Every web site. Physical signage.

"Connecting with the brand"? You're suggesting that people weren't familiar with the "brand" before?

</comment></comment></comment><comment><USER38> Whatever, I do not think this is a good logo. It is really like an art of child.

</comment><comment><USER39> Someone's been playing with 53/Paper's circular color mixer...

</comment><comment><USER40> lol</comment>


SnoopSnitch - <AUTHOR> https://opensource.srlabs.de/projects/snoopsnitch

<comment><USER2> Really awesome.

I tested it on a supported Phone but with CyanogenMod nightly from 2014-12-24 and the /dev/diag device exists but when I start the test, the Applications force-closes. But maybe its just my AppOps.</comment>


Show HN: Easily connect to a VPN in a country of your choice - <AUTHOR> https://github.com/rodrigogs/easyvpn <comment><USER3> It's bad enough of an idea to connect to an open/untrusted WiFi network - <USER2> we're showing HN how to connect to random VPNs all over the world? My cursory opinion of this is that it's the worst idea ever I've ever seen make HN's front page.

<comment><USER4> > My cursory opinion of this is that it's the worst idea ever I've ever seen > make HN's front page.

Not disputing that it's the worst but it could be even _more_ worse.

It's missing the key component: a curl | bash install and upgrade script running over HTTP (not HTTPS). In this case it'd be extra hilarious as upgrades would presumably go over your existing VPN connection which could then hijack the script and run arbitrary code on your machine.

<comment><USER5> I gotchu' (/s)

curl [http://pastie.org/pastes/10992864/download](http://pastie.org/pastes/10992864/download) | bash

</comment></comment></comment><comment><USER6> I guess this tool is intended for command line operation and scripting. If all you want to do is get around regional restrictions to watch videos, see [http://hola.org/](http://hola.org/) .

EDIT: Also, you should assume that any anonymous VPN service has a good chance of being spyware or even malware, so you should sandbox it in a virtual machine or similar.

<comment><USER7> If you do (don't!) be sure you pay: [http://hola.org/faq#intro- cost](http://hola.org/faq#intro-cost)

 _Hola VPN turns 10M users into exit nodes_ (2 years ago)

[https://news.ycombinator.com/item?id=9614993](https://news.ycombinator.com/item?id=9614993)

 _Hola VPN Already Exploited by "Bad Guys", Security Firm Says_ (2 years ago)

[https://news.ycombinator.com/item?id=9645050](https://news.ycombinator.com/item?id=9645050)

</comment></comment><comment><USER8> > Automatically connect you to a random VPN in a country of your choice.

Why would someone do such a thing?

<comment><USER9> The source of the VPN servers is vpngate.net - an academic research that started 2013, at Graduate School of University of Tsukuba, Japan. From their about [0] page:

       - You can get through the government's firewall to browse restricted web sites (e.g. YouTube).
       - You can disguise your IP address to hide your identity while surfing the Internet.
       - You can protect yourself by utilizing its strong encryption while using public Wi-Fi.

The list of servers (on the main url) gives throughput and others stats and you can support them by creating a node [1].

They use SoftEther for VPN server - does someone have any experience with it?

[0] [http://www.vpngate.net/en/about_overview.aspx](http://www.vpngate.net/en/about_overview.aspx) [1] [http://www.vpngate.net/en/join.aspx](http://www.vpngate.net/en/join.aspx)

<comment><USER10> I've taken a cursory look at SoftEther a few months ago.

It looks like a research project that was then unsuccessfully commercialized, and then released to the public somewhat hastily.

The code quality leaves a lot to be desired (there is nothing offensive, but it still does not inspire confidence for there not being security bugs), and the code style is not great either. The amount of marketing copytext is disproportionately large to the amount of code comments and design documentation.

It generally seems to go for a everything-but-the-kitchen-sink approach in terms of features (which is not a bad thing per se, but an approach that I dislike). The SoftEther repository is 280k lines of C and headers, while OpenVPN is 80k.

<comment><USER11> Bugger. I set up SoftEther because it was the only thing I could get working reliably (by that, I mean only 2 disconnections per hour).

</comment></comment></comment></comment><comment><USER12> For people seeking a more secure option:

You can easily build your own IPsec VPN server using a one-liner [1], with support for both IPsec/L2TP and Cisco IPsec.

Disclosure: I am the author of this repo.

[1] [https://github.com/hwdsl2/setup-ipsec- vpn](https://github.com/hwdsl2/setup-ipsec-vpn)

</comment><comment><USER13> VPNs are great. Free VPNs from god knows who, are not that great. A VPN is exactly the kind of thing you want to be paying a trustworthy entity for.

<comment><USER14> or run yourself, you can put openvpn on a $2.50/month debian or centos VPS.

<comment><USER15> Do check that they have the tun/tap module included on the vps before signing up or open VPN won't work on that vps host.

<comment><USER14> Yes, that's essential. Assuming use of a vps that is not really a real vm (xen pv, xen hvm or kvm), but more like a glorified jail, which is what most of the cheap ones are that use openvz or similar.

</comment></comment></comment></comment><comment><USER16> I wonder if they are able to avoid misuse of regional content download by different people. Who pays for bandwidth? Just wondering...</comment>


Show HN: Wit-cms – a flat-file, blog-aware, publishing platform for Express - <AUTHOR> https://www.npmjs.com/package/wit-cms <comment><AUTHOR> Hi, HN. I'm the project author.

I wrote this CMS a few years ago after having become dissatisfied with both Wordpress and Jekyll. `wit-cms` is an npm module that attempts to split the difference between both of the former, in that it reads content from markdown files, yet provides Wordpress-like taxonomies.

`wit-cms` does _not_ generate static HTML sites like Jekyll - it is not a "site generator". Rather, it parses page/post markdown files and stores their contents in RAM as properties of a JavaScript object. As such, deployments are less "messy" (in my opinion) than with Jekyll, and page speed times are good even without using any kind of server-side caching.

`wit-cms` has no administrative backend, and thus has a small attack-surface. I personally publish new content using an npm script and `git pull` over SSH.

In my opinion, `wit-cms` is great for technical users (which are comfortable using command-line tools) that maintain small blogs. I have thus decided to share the project here.

I hope some of you find it useful. Feel free to ask questions or share feedback. Thanks.</comment>


Loftit - <AUTHOR> https://loftit.com/ <comment><AUTHOR> Property management made easy. Start for free! Collect rent. Charge late fees. Get valuable insights. Manage your contractors. Fix repairs. Chat with renters. Start for free!

<comment><USER2> You should use "Show HN" if you built it, it's more topical

<comment><AUTHOR> Got you.</comment></comment></comment>


The Escalator Pitch - <AUTHOR> http://www.businessweek.com/smallbiz/content/may2008/sb20080516_673078.htm <comment><USER2> There's a dangerous trap here, which is use internet-meme vernacular to shorten your pitch. I think the example fails due to this:

"lefora.com is forums made easy—it's like blogger for forums"

I need to know what Forums are, what Blogger is, and what they mean.

Compare this to Google:

"access to the world's information in one click"

I'm playing around with mine:

"Get more out of your calendar than you put in."

<comment><USER3> When comparing "access to the world's information in one click" to "lefora.com is forums made easy—it's like blogger for forums" you're confusing the mission statement with the value prop. Value prop answers "what's the practical use right now? What problem does it solve for me?". Mission statement is "where do you take it next? what's the pattern to your actions?".

Your users wouldn't care for your mission statement nearly as much you yourself or your investors should. The press, well those might be either way - depending on who is their target readership.

One important exception to the rule is if your mission is touchy-feely, like "our new GM seeds are solving world hunger, one seed at a time" (for a GM research lab). That would make good press for any newspaper.

</comment></comment><comment><USER4> Sanj, the point is that you are pitching media or VCs or someone whose attention you need to grab quickly. If you are talking to someone in the media who doesn't know what forums or Blogger are about a tech start-up asking for coverage, you are probably talking to the wrong person.

</comment><comment><USER3> Here's the one I have coined recently, trying to explain to my friends why I bought Dyson vacuum:

Dyson is the iPod of vacuum cleaners.

How's that? :)

<comment><USER5> I didn't know that Dyson Vacuum cleaners need to be replaced yearly. I guess I'll cross that off my wish list.

<comment><USER3> Analogies are not 100% accurate and you may have to sacrifice precision to deliver colorful message in short time frame.

Which is the whole point of escalator pitch.</comment></comment></comment>


Break up Google - <AUTHOR> https://apps.bostonglobe.com/opinion/graphics/2018/06/break-google/ <comment><USER2> I'll be the devil's advocate.

I miss the old Ma Bell. Its monopoly meant that AT&T Bell Labs had no financial pressure which allowed it to pursue pure research and crazy ideas that won several Nobel Prizes and laid the foundation of the 21st century.

It's impossible to say what would've been. Would it really have been worse than the miserable choices of telcos in their current form? Verizon, AT&T, etc.

Similarly, Google's ad revenue allows it to pursue incredible advances in AI and driverless cars that would otherwise be unprofitable.

<comment><USER3> > Similarly, Google's ad revenue allows it to pursue incredible advances in AI > and driverless cars that would otherwise be unprofitable.

yet at the same time, they can decide what's "in" and what's "out" (figurately) overnight. They could declare that driverless cars "are not worth it" or that AI research "has to be reorganized", and who would be there to counter them?

<comment><USER4> Facebook, Amazon, Apple, Tesla, Microsoft, Uber etc etc. Google have a very powerful position but its not like they don't have formidable competitors in every field except maybe search.

</comment></comment></comment><comment><USER5> I never understood in the first place, why governments let advertising become such a big business. Yes, there's the informational aspect to it, Farmer Joe needs to know that there's a new tractor that fulfills his needs, but we're long past that.

Nowadays advertising mainly tries to sell things that people don't need. They can't use these like Farmer Joe to produce new value. Instead it harms the economy when people buy them.

There is of course something to be said about having luxury goods available as reward for people that do well economically, but it should not be the case that the poorest families feel like they need to buy overpriced Adidas shoes to be accepted in society.

It's nowadays central to advertising to build a brand image, to convey a feeling, to always play the same jingle. Which is psychological warfare, it carries essentially no informational value.

<comment><USER6> > (...) why governments let advertising become such a big business (...)

> Nowadays advertising mainly tries to sell things that people don't need. > (...)

Free market fundamentalists (I'm not one of them) would tell you that no one can judge better than the individual themselves what they need or don't need, and that if an individual says they're willing to part with their money to buy X, then that's them saying they actually need it.

Even though I don't buy this view because the world is more complicated than the binary cause-attribution that it implies, I do think it brings up the question of who decides who needs what. If I believe Axe deodorant will get me "the hottest babes" and I decide really need it, would you have the government override my decision?

</comment></comment><comment><USER7> I wonder if Eric Schmidt left because of this debacle: [https://www.nytimes.com/2017/08/30/us/politics/eric- schmidt-...](https://www.nytimes.com/2017/08/30/us/politics/eric-schmidt- google-new-america.html)

</comment><comment><USER8> I'm surprised this opinion hasn't got more traction historically. It seems so obvious...

</comment><comment><USER9> Break up Microsoft and Apple, too

<comment><USER9> Hello, Intel</comment></comment>


Accelerating QEMU on Windows with HAXM - <AUTHOR> https://www.qemu.org/2017/11/22/haxm-usage-windows/ <comment><USER2> If AMD are at all smart they'll be attempting to contribute AMD-V support to [https://github.com/intel/haxm](https://github.com/intel/haxm) ASAP.

Now _that_ will be a fun pull request to watch.

<comment><USER3> Already in the issue tracker, although the "have to ask my superiors" comment isn't too encouraging: [https://github.com/intel/haxm/issues/5](https://github.com/intel/haxm/issues/5)

<comment><USER4> Looks like the superiors just replied :)

[https://github.com/intel/haxm/issues/5#issuecomment-34652021...](https://github.com/intel/haxm/issues/5#issuecomment-346520217)

</comment></comment></comment><comment><USER5> Ugh, no Hyper-V support kind of defeats the point these days... Especially on Win10... Maybe there'd be a way to do this for Hyper-V too

<comment><USER6> I don't understand. Hyper-V is already hardware accelerated and takes full advantage of VT-D.

<comment><USER5> Hyper-V doesn't have the same emulated devices support by a long shot.

</comment></comment></comment><comment><USER7> There's a project that uses QEMU to emulate the original xbox, xqemu: [http://xqemu.com/](http://xqemu.com/)

I wonder if this will help their project too.

<comment><USER5> That doesn't help the project at all... HLE seems to be more workable for Xbox... Xenia is VERY far for the Xbox 360, it isn't technical but organisational issues instead

<comment><USER8> HLE sucks for the XBOX, there is many low level stuff which can be replicated well without hacks.

You can't compare Xenia to the 1st XBOX, at all.

</comment></comment></comment><comment><USER9> Is there an equivalent to HAXM for Linux? Would it be KVM?

<comment><USER10> Yes, exactly. All of KVM, HAXM and the OSX Hypervisor.Framework are basically providing APIs to user applications that encapsulate the CPU's virtualization capability so that you can use it to implement VMs without needing kernel privilege. They differ in how high a level of abstraction they provide (eg KVM does a lot more for you in the kernel, H.f punts to userspace for everything), but the principle is the same.

</comment></comment><comment><USER11> It's on my backlog of experiments that I'll probably never get to, but has anyone had success running QEMU on, say, AWS (virtualized) Windows servers to run Linux VMs? I presume HAXM isn't relevant for attempting this?

<comment><USER12> I don't think any of the public cloud providers support nested virtualization.

<comment><USER13> Several do support nested virtualization under Linux; I've tested that. I don't know if they do under Windows, though.

<comment><USER14> [Disclaimer - I work for Microsoft]

Azure just released nested virtualization VMs. I've tested Hyper-V running in such a VM and it worked well. Have not yet tested HAXM.

</comment></comment></comment></comment><comment><USER15> Didn't Android SDK on Windows use qemu & haxm for years already?

<comment><USER6> HAXM started off as a part of the Android SDK for Windows but is now a standalone component as its wider applicability has been noted and capitalized upon.

</comment></comment><comment><USER16> HAXM works on OSX AFAIK, it would be nice to have it in OSX as well</comment>


Show HN: Easily add a NSA backdoor to your Rails app - <AUTHOR> https://github.com/goshakkk/nsa_panel

<comment><USER2> Sigh. I guess humor is the only way to deal with this.

That and donating to the EFF. Link for the lazy [https://supporters.eff.org/donate](https://supporters.eff.org/donate)

<comment><AUTHOR> Of course. Who in their mind would support the shit NSA does.

<comment><USER2> Unclear. But I do know people who genuinely read 'The Onion' articles as fact.

</comment></comment></comment><comment><USER3> Party like its 1999!

[http://www.heise.de/tp/artikel/5/5263/1.html](http://www.heise.de/tp/artikel/5/5263/1.html)

</comment><comment><USER4> Wait, I thought the NSA backdoor gem was named "active_record < 3.2.12"?

</comment><comment><USER5> NSA Backdoor as a Service

</comment><comment><USER6> For Django apps, just create an admin staff user with permission only to see the User model. Better, make it read all models.

Maybe autoreply to any email from the NSA with credentials for an automatically just created NSA user.

</comment><comment><USER7> Actually, if companies like Facebook and Google are taking part in this (like many people assure) they probably have developed code like this for their services.

I wonder how those developers feel.

<comment><USER8> The number of people that would need to cooperate to keep the existence of this type of code secret is unfeasibly high. It's much more likely that the NSA simply has the companies' TLS keys and can intercept "secure" traffic. They then would have the technology to put in into a structured format and enable querying over the sniffed data.

</comment></comment><comment><USER9> "I think they `are` `a` `terrorist`." NSA is not happy with the grammar. :P

<comment><AUTHOR> [http://en.wikipedia.org/wiki/Singular_they](http://en.wikipedia.org/wiki/Singular_they)

</comment></comment><comment><USER10> Someone needs to write a Javascript version.</comment>


SteamVR Knuckles Dev Kit - <AUTHOR> http://steamcommunity.com/sharedfiles/filedetails/?id=943406651 <comment><USER2> I can't believe you missed the opportunity to call this "SteamVR & Knuckles". dang, could you fix this criminal oversight? The current title does not match the original title anyway.

</comment><comment><USER3> I really wish that Valve would move past the idea of controllers altogether. A controller with buttons will always necessarily constrain you to thinking about gameplay and experiences in terms of what has been done for 2D games, rather than freeing designers to build novel mechanics. The only true solution for VR is cloth gloves with perfect finger tracking. As someone who has spent thousands of hours in VR, anything else becomes extremely clunky and annoying to use long term. Something along the lines of ManusVR ([https://manus- vr.com/](https://manus-vr.com/)) is definitely the way forward.

<comment><USER4> Ever try leap motion lately?

<comment><USER5> How is it lately? I have the original one from the Kickstarter. I played with it a bit because I had some crazy ideas about recognizing ASL, but I found that, while it was super great at instantly recognizing orientation and open vs closed hands, it utterly failed to capture complex handshapes ("this hand is making a fist except the thumb is poking out a bit between the middle and ring finger").

<comment><USER4> The whole software stack has since gotten an overhaul and works more reliably now. Still an occasional trouble with particular finger poses, but, it's really nifty on a VR headset.

<comment><USER6> Orion might work a little better, but it's still not objectively good. It's been over a year since the beta was released and still no final version. I don't think we are ever getting a working Leap Motion, as the company has said they aren't building consumer devices anymore and only focused on partnerships with headset vendors for integrated solutions.

</comment></comment></comment></comment></comment><comment><USER7> I'm getting a 503. Here's a copy: [https://web.archive.org/web/20170622171257/http://steamcommu...](https://web.archive.org/web/20170622171257/http://steamcommunity.com/sharedfiles/filedetails/?id=943406651)

<comment><USER8> Loads fine for me from Seattle, WA.

</comment></comment><comment><USER9> VR is like the quintessential example of a two sided market.

Developers don't want to make games for it, because there aren't enough people with headsets. And Customers don't want to buy headsets because there aren't enough games yet.

But innovation like this is always great. The controller for the vive has been my biggest gripe.

</comment><comment><USER10> Steam is getting hammered due to the summersale as-is. So to free up server capacity for the gamers in the HN community please use the archive link below instead ;)

<comment><USER11> The archive link doesn't appear to include the images, which are perhaps the most interesting part of the whole page IMO.

</comment></comment><comment><USER12> VR is klunky, about 20 years away from being a fun experience.

<comment><USER13> I'm willing to bet that it could be at least half that time. Even stuff like Cardboard/Daydream/Gear-VR provide some entertainment and those are at the lowest tier. The main obstacles for me would be not well enough performing hardware (considering the aforementioned devices use a cell phone) and second, lacking software.

I'd say within the next 3-5 years both of those areas will improve dramatically (as demand for VR increases) enough to make those platforms a viable VR entertainment system.

As for Desktop VR devices like Oculus and Vive 20 years is probably more reasonable as it's much more expensive. Many people get a smartphone every couple years through their phone plan but I'd wager most people do not currently posses a computer capable of running a VR headset with recommended requirements.</comment></comment>


DNS-over-HTTPS - <AUTHOR> https://developers.google.com/speed/public-dns/docs/dns-over-https <comment><USER2> > Currently, web-based applications must use browser extensions to take > advantage of advanced DNS features such as DANE, DNS-SD service discovery, > or even to look up anything other than IP addresses. Extensions for features > that depend on DNSSEC must validate it themselves, as the browser and the OS > may not (be able to) validate DNSSEC.

If only there were some way for Google to let people take advantage of advanced DNS features without requiring browser extensions ... alas, they'd probably need to add that code to a web browser. But then, where would they find a web browser they could add such code to? Ah well. Google should ask those web browser vendors why they won't implement DNSSEC, at least. Maybe start with asking the browser with the highest market share, whichever that one is.

<comment><USER3> agl has explained in detail why they don't do that: [https://www.imperialviolet.org/2015/01/17/notdane.html](https://www.imperialviolet.org/2015/01/17/notdane.html)

tl;dr they can't, because DANE is undeployable in the current Internet.

<comment><USER4> That argument seems to boil down to " _We can't use any new record types in the DNS ever again because 4-5% of users had problems when we silently tested it_ ". First, this is defeatism writ large – if we can't develop anything new, ever, we may all just as well go home and give up. Secondly, these things don't exist in a vacuum; if a website _failed_ because a user couldn't access DANE or whatever, this would create pressure on all affected parties to _fix_ the situation. This is how things _progress_ instead of stagnates.

<comment><USER3> > First, this is defeatism writ large – if we can't develop anything new, > ever, we may all just as well go home and give up.

No, it means you need to consider the existing realities when designing a new protocol. A good example is HTTP/2: Probably countless proxies would produce crap once they see an HTTP/2 packet. So people came to the conclusion that they need to wrap HTTP/2 in TLS in order to deploy it. (I know that there's HTTP/2 without tls, but nobody is using it for precisely that reason.) HTTP/2 was built with deployability in mind. DNSSEC was not.

> Secondly, these things don't exist in a vacuum; if a website failed because > a user couldn't access DANE or whatever, this would create pressure on all > affected parties to fix the situation.

This is simply not what's happening. What happens in the real world is that people blame their browser for breaking things that previously worked. There are countless examples for this.

<comment><USER5> >What happens in the real world is that people blame their browser for breaking things that previously worked.

There are 3 browser vendors of any note right now. It wouldn't be that hard for them to collaborate to push this change at the same time.

</comment></comment></comment></comment></comment><comment><USER6> I find it somewhat amusing that in order to use DNS-over-HTTPS you must first resolve a domain using "normal" DNS (dns.google.com). You'd think they'd go ahead and publicly advertise a static IP for that so you can use it without relying on normal DNS.

<comment><USER7> The certificate has to match, so I don't think there would be a problem.

<comment><USER8> Assuming none of your CAs have been compromised.

<comment><USER9> If you're not trusting CAs, there's not much point to DNS over HTTPS, is there? Might as well be DNS over HTTP. Or just DNS.

<comment><USER9> To expand on this, there _would_ be three advantages, but none have to do with CA trust: (1) Clients implementations may be slightly simpler, since they have to handle one less protocol. (2) The initial DNS would be removed altogether as a possible source of error, rather than a detectable possible source of error. (3) Some marginal additional privacy. But reverse DNS means not really.

</comment></comment></comment></comment></comment><comment><USER10> DNSCurve solved this years ago: [http://dnscurve.org](http://dnscurve.org) , with implementation notes here: [https://dnscurve.io](https://dnscurve.io)

<comment><USER11> No it didn't. DNSCurve only solves recursive to authoritative. The request from a typical PC to recursive is still without encryption. And provides no mechanism for the PC to even know whether the result it receives is valid or not or if DNSCurve was even used by the recursive.

</comment></comment><comment><USER12> > (including DNS-based Internet filtering)

What guarantees that they wouldn't start filtering URLs on their own (upon request by DMCA, or FBI)?

I do get that they say what they log ( [https://developers.google.com/speed/public- dns/privacy](https://developers.google.com/speed/public-dns/privacy) ), yet if in case this ever does become a _commonplace_ thing, they'd be easily able to obtain IP addresses of users trying to access blacklisted websites, and hand them over to officials (upon request, maybe?).

</comment><comment><USER13> We did the same thing w/ JSON responses: [https://www.openresolve.com/](https://www.openresolve.com/)

This is a bad idea outside of experimentation. Not to be used for production.

If you want to secure DNS look at QUIC, TLS, or my favorite, DNSCrypt (which I funded).

<comment><USER14> Why is this a bad idea? You can't just say "it's bad" with no justification.

As a user, I can sure think of some countries with broken Internet access where this would come in handy.

<comment><USER13> I'll rephrase, it's way better accomplished with UDP without sacrificing security in the ways I list.

Running DNS over HTTPS over TCP isn't needed. It doesn't solve a problem.

Doing JSON DNS for OOB DNS checks is useful since most applications speak HTTP. :-)

</comment></comment></comment><comment><USER15> I've actually just written a blogpost about it. [http://www.dmitry- ishkov.com/2016/09/dns-over-https.html](http://www.dmitry- ishkov.com/2016/09/dns-over-https.html) You can run a local DNS server which is gonna use Google's DNS-over-HTTPS. But as eridius noticed you still have to resolve dns.google.com

<comment><USER16> I would not use that implementation. It is broken in multiple ways. The most impactful to normal browsing is that it only supports a couple of RR types which doesn't include CNAMES.

<comment><USER16> I didn't mention it in my original comment because I thought the code didn't exist anymore but I found an old Time Machine backup disk with the code on it for an updated version of the referenced implementation. I have put it up on Github at [https://github.com/tssva/dnshttps- proxy](https://github.com/tssva/dnshttps-proxy). I need to throw up a README and give attribution. Will get to that later today.

This version will support all RR types supported by the miekg/dns library which is the vast majority of them and any you are likely to come across in the wild. It also allows you to specify regular DNS resolvers which can be used in two ways. As fallback if connectivity to the DNS over HTTPS service fails or to always use to resolve specific domains. It also allows you to restrict access to the proxy to certain networks. The rest of the code should be IPv6 friendly but for some reason I implemented the access list in a manner that only supports specifying IPv4 networks. Guess I have something to work on.

If no DNS resolvers are specified it attempts to use the Google Public DNS servers to resolve dns.google.com. If DNS resolvers are specified they are used to resolve dns.google.com. A flag to always use the Google Public DNS servers would be useful, so now I have 2 things to work on.

As far as performance impact I have generally seen from 20 - 80msec of additional delay. Using a caching resolver behind the proxy would help mitigate this. As is the additional delay is pretty much unnoticeable when web browsing.

</comment></comment></comment><comment><USER17> Why can't you just send DNS messages over an SSL/TLS socket? What's the value add for http and REST?

<comment><USER18> I would assume being able to reuse the connection for multiple requests. Setting up the TLS connection is quite a bit more expensive than raw TCP, and especially UDP (most DNS happens over UDP). For longer connections, the additional overhead is minor, but for the extremely short DNS messages, I would imagine that a TLS connection per DNS request would be some pretty substantial overhead.

Edit: The page mentions that this allows web applications to make their own DNS requests, possibly looking up things other than A/AAAA records that the browser normally requests.

<comment><USER19> http and rest are not the only ways to reuse a socket. You could just write the packet to the TLS stream, raw, and keep the socket open.

<comment><USER18> Definitely. But then you need to define an envelope to mark where an individual message begins and ends (with UDP DNS, it's a single datagram; with TCP DNS, it's the entirety of the transmission). There are infinite ways to do this, and countless many already specified in various standards (many of which are already implemented in browsers, which is surely the the primary application Google had in mind). HTTP provides one such envelope.

<comment><USER20> > with TCP DNS, it's the entirety of the transmission

DNS Messages have a two-byte length prefix when transmitted over TCP. Multiple envelopes can and often are sent over a single circuit.

</comment></comment></comment></comment></comment><comment><USER21> Pretty cool, DNS as an API:

\- JSON: [https://dns.google.com/resolve?name=doma.io](https://dns.google.com/resolve?name=doma.io)

\- Web interface: [https://dns.google.com/query?name=doma.io&type=A&dnssec=true](https://dns.google.com/query?name=doma.io&type=A&dnssec=true)

</comment><comment><USER22> nice toy, but there are some things to be considered:

1) "secure DNS" is a solved problem 2) DNS is simple 3) responses normally easily fit inside one packet 4) DNS is fast

HTTPS is a slow, wordy and inefficient protocol. Forcing everything into JSON just compounds the problem.

<comment><USER23> > 1) "secure DNS" is a solved problem

No, not in practice. You can easily MitM DNS and nobody is verifying DNSSEC by default. On the current internet, secure DNS just doesn't exist.

<comment><USER22> the mechanism is there, people are not choosing to use it.

That is because security is hard.

This doesn't mitigate MitM attacks, as upstream DNS records can still be spoofed

WE go from a fast, decentralised, resilient and low overhead system, to a centralised chatty and fragile behemoth.

It still doesn't give end to end encryption, its just a slow encrypted proxy.

<comment><USER23> First people need to know about it to use it. Then it needs to actually work and not fail. [https://ianix.com/pub/dnssec- outages.html](https://ianix.com/pub/dnssec-outages.html)

</comment></comment></comment></comment><comment><USER24> HTTP-over-DNS would also be neat :) I think I would be able to get internet access in some airports if I had HTTP-over-DNS

<comment><USER25> DNS-over-HTTPS-over-Tor-over-DNS-over-ICMP is where it's at. None of the three-letter agencies can eavesdrop on your DNS queries now! It might even be faster than RFC 1149.

[https://www.ietf.org/rfc/rfc1149.txt](https://www.ietf.org/rfc/rfc1149.txt)

<comment><USER26> Not if you actually use RFC 1149. You're operating at layer 1 and 2 when you rely on birds.

I'm waiting for the day when RFC 1149 is expanded to incorporate a layer 2 tunnelling protocol. I suspect this issue is not the initial encapsulation but how to extract the original frame without it getting mangled.

</comment></comment></comment><comment><USER27> Why doesn't Google include the entire DNSSEC signature chain in the response? Their current approach to DNSSEC validation seems quite weak. Sure, I can query them and get an answer with AD set, but then I need to trust that they didn't tamper with the response.

</comment><comment><USER28> The "web" is becoming hack upon hack upon hack.

<comment><USER29> Becoming? When has it not been?

</comment></comment><comment><USER30> DNS doesn't seem very well secured against determined attackers. But at the same time I almost never hear about attacks done via DNS spoofing. So I guess it harder to attack than I think.

</comment><comment><USER31> Sometimes I think we should all take the Apple approach to this kind of things and deprecate old stuff and/or make new stuff mandatory.

We could just force DNS extensions to be implemented in most/all client/server implementations.

DNS over HTTPS might be okay and work well, but imho is a (smart?) workaround, not a fix.

Why can't we all set a time window (7.5 years? 10 years? 15 years?) to plan massive RFC/protocols updates with possibly-breaking changes?

Edit:fix grammar (not native speaker of English)

</comment><comment><USER32> What's the purpose of explicitly specifying the "random_padding" parameter? Couldn't the client send any arbitrary unused query argument as padding?

<comment><USER33> I can think of two non-technical reasons: as an explicit reminder to devs about side-channel attacks, and also to guarantee the key "random_padding" will never be used for anything else.

</comment></comment><comment><USER34> Why not DNS over TLS? [https://tools.ietf.org/html/rfc7858](https://tools.ietf.org/html/rfc7858)

</comment><comment><USER35> Shameless plug (again): [https://github.com/pforemski/dingo](https://github.com/pforemski/dingo)

<comment><USER36> Why have you disabled "Issues" on your repo?

<comment><USER35> For now I prefer to communicate through email

<comment><USER37> I find it very annoying when people do this, it makes it very hard to gauge what sort of issues the software has and how the author responds to them.

<comment><USER35> If you find an important issue and document it properly, I will be happy to re-enable issues and add your input there. Github just doesnt provide enough moderation tools there, IMHO.

</comment></comment></comment></comment></comment><comment><USER38> You know, I've had thoughts along similar lines in the email space (SMTP). HTTP is such a fantastic protocol and an amazing amount of engineering effort has gone into it compared to SMTP. I've wondered whether there would be any interest in defining a translation from SMTP into HTTP, with an eye toward eventually deprecating SMTP in the fullness of time.

For example, to send an email, perhaps you just send an HTTP POST request to a canonical endpoint (email.example.com), instead of all the rigamarole that SMTP servers require with a unique text protocol requiring multiple round trips. Have you seen the number of SMTP commands involved in sending a _single_ email? Here's an abbreviated transcript of what it's like to send an email using `telnet`:

      # Wait for banner from server (RT #1)
      220 email-inbound-relay-1234.example.com ESMTP Sendmail 1.0.0; Thu, 29 Sep 2016 19:22:12 GMT

      # Send EHLO and wait for reply (RT #2)
      EHLO example.com
      250-email-inbound-relay-1234.example.com Hello ws-1.example.com [22.214.171.124], pleased to meet you
      250-ENHANCEDSTATUSCODES
      250-PIPELINING
      250-EXPN
      ...
      250 HELP

      # At this phase you should really send STARTTLS and negotiate a TLS connection,
      # but we'll just ignore that for now and proceed plaintext.

      # Specify sender (RT #3)
      MAIL FROM: email@example.com
      250 2.1.0 firstname.lastname@example.com... Sender ok

      # Specify recipient (RT #4)
      RCPT TO: email@example.com
      250 2.1.5 email@example.com... Recipient ok

      # Specify message headers and content (RT #5)
      DATA
      354 Enter mail, end with "." on a line by itself
      Subject: Hello, world!

      Fun stuff
      .

      # Wait for reply (RT #6)
      250 2.0.0 u8U1LC1l022963 Message accepted for delivery

Furthermore, if you skip these steps or front-run them, some servers will consider that suspicious or spammy behavior. (RFC 2920 properly allows this as an extension called pipelining, advertised in the EHLO reply above.)

With full use of SMTP extensions, things are a bit better than I imply but still frustratingly suboptimal. For example, I've run across ISPs who purely for their own load management reasons want to close an SMTP session at the TCP level after an arbitrary number of emails have been sent (N < 100)! Why would they desire that? If we're going to exchange more messages, then it's certainly _less_ efficient for us both to negotiate a new TCP session and TLS session, rather than reuse the one we already have, but such is the practice of email. So message sending often can be as inefficient as this. When sending to some ISPs worldwide it's not uncommon for a single message to take seconds to deliver under normal network conditions.

How about we replace all of that with an HTTP POST to email.example.com, specifying the email headers and content with the POST body, and the sender and recipient as headers or querystring parameters? I think it'd be nice to get there eventually rather than drag SMTP on forever. All of the effort that goes into HTTP clients, servers, and security could benefit the email community as well.

Proper TLS security is still nascent in SMTP -- only because of Google's actions with Gmail and their Safer Email [1] initiative has TLS really come into widespread adoption at all. Today, although a lot of email is _nominally_ taking place over TLS, most clients are not involving any sort of path validation and the connections are susceptible to MITM; and email clients don't specify client TLS certificates nor do servers examine them. If we were to employ it, TLS client certificate authentication could be an effective way to prevent email forgery, e.g., require email from example.com to be sent from a client with a TLS certificate for that domain. This kind of thing would be much easier to achieve in the HTTP world than in the SMTP world. We could also take advantage of HTTP/2 pipelining to efficiently deliver a lot of traffic across just one TCP connection.

We'd still need _most_ of the effort invested into email, such as all of the effort fighting abuse, and mail servers would still need to buffer outbound messages and authenticate inbound ones, etc. (and we'd still need SPF, DKIM, DMARC) but at least it would simplify the foundational and protocol-level work, like what's involved in bootstrapping a new email client or server from scratch. You could write basic code to send an email in a few minutes using an HTTP library in any language. SMTP is pretty well entrenched, however, and the incremental benefit is probably not large enough, so I don't have my hopes up.

[1] [https://www.google.com/transparencyreport/saferemail/](https://www.google.com/transparencyreport/saferemail/)

<comment><USER25> FastMail has been working on something called JMAP [1] for quite some time. It's an HTTP-based replacement for IMAP. Perhaps it could be extended to replace SMTP as well. Then we would have a single, HTTP-based API for all of our email needs.

[1] [http://jmap.io/](http://jmap.io/)

<comment><USER39> I'm not convinced that's a useful generalization. Beyond that IMAP and SMTP do something vaguely related to email, there's very little overlap between the two protocols.

</comment></comment></comment><comment><USER40> DNS-over-QUIC would be a much more compelling technical proposal from Google as a standard

<comment><USER41> Note that although it is not documented, when you query the Google DNS-over- HTTPS service from Chrome, it will usually use QUIC. You can check this at chrome://net-internals/#quic, and will probably see something like this (look DNS/HTTPS/QUIC/UDP/IPv6!):

dns.google.com:443 true QUIC_VERSION_34 [2607:f8b0:400d:c03::8a]:443 10544469510527000173 0 None 2 9 0 9 true

An independent implementation of QUIC (are there any outside of browsers?) would probably work much the same, modulo any changes during the ongoing standardization of QUIC.

</comment></comment><comment><USER42> This won't be overly useful (to me) unless/until the system resolver supports this _and_ I can implement this on my own DNS server(s). Seems like a good idea, though.

<comment><USER43> [https://github.com/wrouesnel/dns-over-https- proxy](https://github.com/wrouesnel/dns-over-https-proxy)

<comment><USER42> I will still prefer the system resolver to support DNS over HTTPS natively, but this option could work.

</comment></comment></comment><comment><USER26> So to resolve a domain to an IP address without using regular DNS they have opted to use HTTPS which really requires a certificate to be signed against a domain via DNS.

</comment><comment><USER44> I think this could be more useful if there was a local client that installs and proxies. E.g., A traditional query to localhost:53 gets translated to DNS- over-HTTPS.

</comment><comment><USER45> I wonder what the performance hit of something like this would be. It seems like the ssl connection would be a bottle neck for the page load.

<comment><USER46> I use DNSCurve, which adds <1ms to latency. That's with X25519 and XSalsa20-Poly1305. Assuming a persistent connection, DNS-over-HTTPS might be similar with AES-NI or ChaCha20-Poly1305. The real speed issue is the number of round trips. DNSCurve is Zero-RTT, and assuming a persistent connection, DNS-over-HTTPS should probably be too at least once it's up and running.

And then consider that lots of pages have megabytes of javascript fetched from multiple sources, big and often unoptimized images, expensive screen redraws, etc.

Modern crypto doesn't affect performance _at all_. Hell, even PQCrypto- encrypted-DNS with 64KB public keys would be fast compared to the modern web. There's no reason to worry anymore about modern crypto affecting performance. It's just not an issue.

</comment></comment><comment><USER47> This is great, but google doesn't need to eavesdrop on us when they compel us to use their avenues for our every action.

<comment><USER48> So, what DNS server do you use? I trust Google's DNS (I use the normal DNS ones, 18.104.22.168 and 184.108.40.206) a lot more than I trust Comcast's DNS servers. I'm sure there are others out there, of course, but 126.96.36.199 is good, reliable, and easily memorized.

<comment><USER49> Comcast is the one sending you the (unsigned, unencrypted) response packets from 220.127.116.11.

You might as well use the Comcast ones.

<comment><USER50> Politically it's a lot easier to stop Comcast from altering through-traffic DNS than it is to stop them from lying in DNS responses and calling it pro- user.

<comment><USER41> And if you use DNS-over-HTTPS to get your answers from Google, Comcast can't modify them.

</comment></comment></comment></comment></comment><comment><USER51> Is there a matrix of X-over-Y implementations? I would assume that we are converging to a fully filled matrix.

<comment><USER52> If not filled, probably full-rank such that all X-over-Y is possible, via-S- via-T!

</comment></comment><comment><USER53> Why do I need dns over http?

</comment><comment><USER54> That's fantastic. Wondering why this hasn't happened before?

<comment><USER55> \- It has happened, see the comment below (openresolve).

\- It doesn't solve the problem, unlike other existing solutions for encrypting DNS.

\- It adds unnecessarily high overhead.

<comment><USER54> Awesome.

There maybe more than one problem.

That's relative to the aforementioned problem.

Cheers.

</comment></comment></comment><comment><USER56> I find it amusing that they chose apple.com for the example.

</comment><comment> tony-allan httpresolver.py implements DNS over HTTPS in a fork of Paul Chakravarti's dnslib. I have it running as a resolver for my Mac using the command:

sudo python3 httpresolver.py

Have a play with [https://bitbucket.org/tony_allan/dnslib](https://bitbucket.org/tony_allan/dnslib)

</comment><comment><USER57> Why is this news? Any protocol can (usually trivially) be tunneled over http(s).

<comment><USER58> I believe the significance is that it's being done, how, and by an Internet giant. There's an impact difference between random person on Github doing DNS over HTTPS and Google deploying it.

</comment></comment><comment><USER59> Great idea! Even more leverage for a DDoS attack!

It is a quicksand this idea, it seems fine until you rely on it and are shaken by attacks that just make your service unavailable with very few computers and traffic. And then you are screwed because we still hardly know howto prevent DDoS except by having a huge bandwidth compared to the attackers. Unless you are a megacorp with huge datacenters everywhere it is a bad idea.

But well Google will never become a monopolistic company that behave assholishly, right? They would never push standards that favors them other the few remaining hosting companies on the internet. Wouldn't they?

<comment><USER50> > Even more leverage for a DDoS attack!

HTTPS already exists and is slightly less vulnerable than normal DNS traffic.

This opens no new DDoS opportunities. The rest of your post is irrelevant.</comment></comment>


Inseparable: The Original Siamese Twins - got-any-grapes https://www.lrb.co.uk/v41/n17/lynne-vallone/for-the-sake-of-the-dollars <comment><AUTHOR> Interesting article. Nice life after all...

Considering I have a (identical) twin, I could be biased.</comment>


Ask HN: What is your ideal personal email setup? - <AUTHOR> I still am working with a central Gmail account (forwarders and aliases from different addresses) and am thinking with the new year coming it is a fitting time to make a move to improve my setup. I've always been happy to pay, but have never found a combination which felt "right".
So help inspire me - What is your ideal email stack for personal email?
Do you have randomised disposable addresses (if so, how do you generate them? Or are you just using a wildcard?), who hosts your mailbox (or do spend the energy to maintain your own?), and how you view your mail? I have wondered about the benefits of moving to a desktop client, but have never found one for Windows which feels good to use. <comment> chupa-chups Anyone got an idea why it appears "Ask HN" topics are posted more than once that often right now?

<comment><USER2> I guess it's a software glitch.

@OP: Are you reposting because you see an error message?</comment></comment>


Ask HN: 5 months and counting waiting for Coinbase customer support. Advice? - <AUTHOR> So Coinbase's disastrous customer service has come up on HN before [1]. But my issue is rather more extreme than a wire transfer that takes a few weeks to go through - I've been waiting for over five months for Coinbase to unlock my account and allow me to access my funds. Since August 20 of 2017 to be exact.
I've never experienced or even heard of such a long wait time for action to be taken on an open customer support ticket and I honestly have no idea how to proceed. Should I start contacting the CFPB or BBB, writing registered letters, etc?
To be clear, I have had contact with various Coinbase customer service reps since August. I also have tried emailing and tweeting at the CEO and Coinbase executives. The refrain is always the same: "We're expanding fast and adding to our customer service team. Your case has been escalated for further review. Please bear with us." I've been patient for months now and am thinking that maybe I'm not following the right strategy - any advice?
[1] https://news.ycombinator.com/item?id=16106793 <comment><AUTHOR> Ok, an update, since I can't edit the original anymore. "Kyle" at Coinbase reached out to me via email: "I'm so sorry for the delay in our response. We were able to clear your account."

I can't imagine that it had anything to do with bad publicity from being on the front page of Hacker News... anyway, I'm glad it was finally resolved. Thanks HN.

<comment><USER4> Sorry you had to go through this.

It's pathetic that nowadays the only way to get the attention of a company is to shame them in a public forum. While I'm not a big social media fan myself, I'm glad it's there when we need it to call out people and companies like this.

This is the only reason that "Kyle" reached out to you, not because they care about you as a customer. It's a shame really.

<comment><USER5> Social media has partially democratized access to public shaming, in the US at least, as you no longer need to know someone at a media outlet. But luck remains an important factor. If OP had posted an hour earlier or later, it could have never broken out of 1 or 2 upvotes on HN, and his issue would not have been solved.

<comment><USER4> I think the fact that (as someone pointed out) Coinbase is a YC had some help as well. No one likes it when the fight starts coming into their own backyeard.

</comment></comment></comment></comment><comment><USER6> It's been over a month for me. My case hasn't been touched, except for one automated "read the FAQ" update. Lost my ETH transaction.

Thousands are having the same issue (lack of support), based on Twitter alone.

Tweeting at the CEO is useless, unless you're someone famous.

The really sad part - with the amount of money they are making ($1B/yr), they should be able to handle support. It's only several categories (account verification, transfer delays, lost transactions) that can be easily parsed/routed, and even answered to, programmatically in 80% of cases.

<comment><USER7> I actually founded a company that does ML-based customer service alongside humans. [https://www.abotlabs.com](https://www.abotlabs.com)

If anybody at Coinbase wants to reach out, I can probably automate 20-50% of your queries with integrations into your backend systems. Email is in my profile.

<comment><USER8> Awesome, I'd love it if you could help Coinbase resolve poor OPs problem swiftly and economically with the warm friendly response of a robotic rejection.

<comment><USER9> Yeah, I'm sure that "instant replies" are exactly what CoinBase customers are longing for. /s

<comment><USER10> They already have a chat with instant replies...that point you to a website with the answer they should have just linked you to when you went searching for the answer. I had to go through this rigamarole to reset my 2FA because my phone had to be reset and I didn't have backups of my Google Authenticator keys. The process went something like this:

1\. Search docs for how to deal with lost 2FA device. Find entry about it.

2\. Docs say, "contact support to blah blah blah" with a link to a realtime chat thing for support.

3\. Ask question in chat thing.

4\. Receive a link to a web page with a description of what to do from the chat bot

5\. Follow those instructions, which involve logging in with a different browser (or incognito) and clicking "lost my device".

6\. Verify identity, etc. etc. which finally gets the ball rolling on fixing the problem, which takes a couple of days, as I think it actually involves a human at this point, though I never actually talked to one.

It wasn't _super_ painful, but it made me think, "What idiot came up with this? Why would I want to talk to chat bot only to have it take me to the web page that it _should_ have directed me to in the first place when I was looking at the documentation?"

</comment></comment></comment></comment></comment><comment><USER11> They seem like a chronic bad actor. I believe small claims court, BBB, CFPB are all valid recourses.

Better still - if you can make this a class action by eliciting similar victims to come forward, you _may_ actually get them to change their ways. Right now it seems like they can simply fuck with you without consequence.

And then there's the irony of coinbase being a middlemen in a market that aimed to remove the middlemen

<comment><AUTHOR> It really does seem like they don't care about the consequences. I was listening to Reid Hoffman's "Masters of Scale" podcast where he talked about LinkedIn simply unplugging their customer service line when they were in the midst of a particularly fast period of expansion.

That's _maybe_ acceptable if you run a social network, but I fear that Coinbase has taken that lesson to heart and applied it to a business where real money is at stake. I'm increasingly concerned that Coinbase will either get sued or regulated out of business before they can give me my funds back - which at this point should be around 2.5k, so not a fortune, but also not inconsiderable either.

I guess I'll look into a lawyer but it bums me out that it has to come that...

<comment><USER12> Wasn't he talking about PayPal? (Also money service)

</comment></comment></comment><comment><USER13> I had to go here before I received any response from the company: [https://www.consumerfinance.gov/complaint/](https://www.consumerfinance.gov/complaint/)

<comment><AUTHOR> Thanks, I've seen this said a couple times online, will go ahead and fill out a complaint.

</comment></comment><comment><USER14> I'm in the same boat. At this point, "growing pains" is not a legitimate excuse for this level of incompetence. I (wrongly) assumed that since Coinbase is based in SF and funded by YC, that they would not be able to get away with this level of negligence. This reflects very poorly on YC and specifically YC leadership.

Serious question for YC insiders: has YC leadership made any effort to advise Brian on this, and how poorly this negligence reflects on YC as a whole, or does no one care because they're getting such a high return on their investment?

<comment><USER15> YC is a VC firm. Why would they care about anything but ROI?

</comment></comment><comment><USER16> Coinbase really needs to suspend their new account creation. AFAIK almost all of the other "reputable" exchanges have gone through periods of not allowing new users so that their support network can catch up.

[https://medium.com/@mseiler1/coinbase-support-is-non- existen...](https://medium.com/@mseiler1/coinbase-support-is-non-existent-and- its-a-big-problem-95f38bed7e2e)

<comment><USER17> What, and turn down the money faucet?

Sure, that'll happen. Coinbase just sends out a quarterly tweet that "hey, we're ramping up support!" and calls it good.

</comment></comment><comment><USER18> After complaining to support that my bank account would not verify after I made a SEPA transfer, I suddenly had my coinbase account locked. A few days later, I got an email from support telling me my account had been locked for security reasons. I wasn't home so I couldn't do anything. The fun part is that, when back at home, I realized that my coinbase firefox tab was still open (after 2 weeks) (I had only 100$ on it, so I wasn't really careful). I was still logged in, and I was able to transfer those 100$ to uphold.

</comment><comment><USER19> I wired in a large amount of money to coinbase on the 12th of January and have yet to see my account credited. I have opened several support requests and call twice only to get the runaround. Anyone else have a similar issue? Did you eventually get credited? Everything was done correctly , confirmed with my bank as well as coinbase's bank

<comment><USER13> That was the sane thing I had happen. I had to file a complaint with the consumer finance bureau. Then my money was returned to the original account with no note as to why the wire transfer was rejected.

</comment></comment><comment><USER20> I faced this too, my coins were locked by Coinbase for more than 3 months (due to mismatch in name and my ID) and I could not reach out to anyone in support, although I submitted requests and placed calls. Their ID verification is fubar, I really don't know how it was deployed.

Their phone lines were always busy and the person on the phone was unhelpful and actually gave me false information that my account would be enabled. It took another couple weeks after the call, for it to be enabled. I will not do business with them again, and urge everyone I know to do the same.

When there are threads about finding their HQ in meatspace [[https://www.reddit.com/r/CoinBase/comments/7majpn/this_is_co...](https://www.reddit.com/r/CoinBase/comments/7majpn/this_is_coinbase_hq_front_door_in_san_francisco/)] to confront them, you know you're dealing with a really shitty business. IIRC their correct address is 13+ Floor, 1 Front St, SF for folks in the Bay Area.

</comment><comment><USER21> I recently had an issue where I'm fairly certain someone in Coinbase's verification process stole my credit card info and started charging it fraudulantly. I was able to cancel the card before any damage was done. I contacted support, got a "we're looking into it" email, then nothing for over a month. Good to know I'm not alone, at least.

With that and these other complaints in mind, what is a HN preferred alternative? I'd still like to buy some ETH/BTC/etc with USD, but am gun-shy on these now.

</comment><comment><USER22> Boy you'll find my story hilarious...

I uploaded a photo of my driver's license for identity verification, and they either use humans or ML to read my name. Suffice it to say, they got the wrong name on my account and I've been unable to change it for months!

Check out this email I got from them! [https://steemit.com/coinbase/@subcosmos/coinbase- incorrectly...](https://steemit.com/coinbase/@subcosmos/coinbase-incorrectly- parsed-the-name-on-my-drivers-license)

<comment><USER23> Lol...they parsed your first name as "Cunt"? That's worth teasing here...you'll get more interest in clicking through to your blog post.

<comment><USER22> My real name is Clinton, so they sorta got it....

Still trying to figure out if its an OCR process, or some human did it. Thought for a while I might have an enemy working there ;)

And its really rather hilarious. All of this ID verification stuff is needed for DHS regulations to prevent money laundering and terrorism.

<comment><USER24> a) probably a human b) probably someone that hates HRC.

<comment><USER25> Someone is definitely having a laugh at Clinton's expense. Funny except it isn't.

<comment><USER22> Story of my life! :p

</comment></comment></comment></comment></comment></comment><comment><USER26> Here's an interesting metric which I think is behind all the support troubles at Coinbase:

Take a look at Coinbase's Alexa ranking: [https://www.alexa.com/siteinfo/coinbase.com](https://www.alexa.com/siteinfo/coinbase.com)

220 - up from around 3000 12 months ago! That is simply incredible. A site like that would get buried in support tickets fast, especially after such growth.

Another interesting metric, they are beating Citibank:[https://www.alexa.com/siteinfo/citi.com](https://www.alexa.com/siteinfo/citi.com)

</comment><comment><USER27> I suggest making a popular post on HN.

</comment><comment><USER28> Hi there, just personal feedback here. I contacted Coinbase on September 14, 2017 because I was locked out because of 2FA and a cell phone I had no access to anymore. I couldn't upload or get any document verified, but a human being at Coinbase helped me and after a few uncertain emails, I was able to gain access back to my 4 years+ old account on September 20, 2017.

I'd say hang in there. With the recent bubble their statement make sense, so try to be patient.

<comment><USER29> Five months is more enough to be continued in a limbo state....

</comment></comment><comment><USER30> Is there a reason your account was locked? Something personally incriminating? For instance sending funds directly to a darknet market, or online casino.

If not, perhaps hire a lawyer.

<comment><AUTHOR> It was locked for a quasi-legitimate reason, but one that should be easily resolvable. I accidentally opened the app while on vacation in Iran and got an automated message from Coinbase about Iranian nationals not being allowed to use their service, etc.

Fair enough. The email simply asked me to prove that I was a US resident by sending in my driver's license and proof of residence (like a utility bill). Which I promptly did. Then nothing.

For the record, I also opened my Bank of America app in Iran and BofA didn't seem to care at all. It's not like I was trying to trade, buy or sell - <USER2> literally just opened the app.

<comment><USER31> I had a similar issue with Venmo—a friend tried to pay me back for a Cuban sandwich, and the transaction was held up because he just wrote "Cubans" as the description. Only in Venmo's case, the issue was resolved mere hours after he sent an email explaining the situation.

I opened a Coinbase account back in college ~6 years ago when they were giving $10 in Bitcoin to anyone who signed up with a .edu email address. I forgot about it until last summer, when I realized that amount was now worth around $160.

I didn't have access to my college email anymore, so having to provide proof of identity was reasonable; having the entire process take a month wasn't. They also do this particularly insidious thing where if they don't respond to your request for two weeks or so, _they automatically close it as unresolved_. They do automatically reopen it if you send another email, but that you have to do that in the first place is dumb.

<comment><USER32> Woah. Venmo parses and makes decisions on the description field before performing the transaction? That's wild. I would have thought that to just be a convenience field for the customers. So Venmo decides what you can spend money on and what you can't? Yikes, I'm happy to not use it regularly.

<comment><USER33> Every payment service provider is required to filter transactions if they offer payment services to consumers. (Part of AML, anti-money-laundering legislation) In essence, there's a set of things that money can't be spent on, and it's their responsibility to take measures ensuring that their customers don't spend (in significant amounts) money on that, and show that these measures are reasonably effective (i.e. that they're not just for show - <USER3> they assist their customers to circumvent their filters, that's a crime) or not offer payment services at all. For some of the wider restrictions (e.g. payments to cuban nationals) it may result in quite wide-catching automatic filters; and it's the choice of the company whether just to block the payment or spend time and $ to have a human look at the payment and make a decision on whether you can spend money on that or not.

If you want to use services that ignore what you can spend money on and what you can't, you literally have to use illegal services - no legitimate company in the western world is allowed to offer that.

<comment><USER32> > If you want to use services that ignore what you can spend money on and what > you can't, you literally have to use illegal services

Cash between friends is not illegal. Venmo, for lots of people including me, just replaces cash for paying your friends back. That's even _their_ #1 example they have on their website for why you might use Venmo.

There is no agency or anyone in charge of asking what I'm spending the money on when I give my friend a $5 for lunch. If Venmo wants to replace that experience, they can't refuse the payment because they think I'm suspicious and expect to keep my business.

I understand the pressure they are under as a payment processor. But the alternative to Venmo to keep payment privacy intact is not illegal, it's just plain old cash.

<comment><USER33> Well yes, that's kind of the point - replicating this part of the experience of paying someone directly in cash is illegal. No matter what Venmo wants it can't replace that (part of the) experience and, more importantly, neither can any of their competitors. So you either keep using cash or (no matter if you pick Venmo or someone else) get a different experience.

Also, don't forget that above certain amounts cash between friends also needs to obey a bunch of reporting rules and can not be entirely private. Simply taking a briefcase of cash from your buddy and leaving it at that _is_ illegal.

</comment></comment></comment></comment></comment></comment></comment><comment><USER34> Since they are ignoring your online requests, have you considered simply visiting them in person? I understand that's not an option for many people but your profile indicates you're geographically close. Bring a lawyer for good measure.

<comment><AUTHOR> I thought about this but decided it could be construed as creepy, or even harassment. I have to imagine that there are some crazy people out there who are mad at Coinbase and it could be taken the wrong way.

I have tried to be as polite and understanding as possible and not get mad throughout this whole process - even when the customer service rep I waited two hours to talk to told me that the mere act of replying to an open ticket causes a _new_ ticket to be created, and then demotes the old ticket to the bottom of the priority list! (That was absolutely Kafkaesque).

But honestly, I have been so disappointed by the utter lack of concern or sympathy among Coinbase's employees. I can follow them on Twitter and watch them gloating about the enormous profits they and their company are making. Meanwhile hundreds, probably even thousands of people are waiting for weeks and months for basic help. It has been a source of significant anxiety and stress for me to be honest.

<comment><USER35> You're being taken for a ride. This company's entire business model is predicated upon holding your money as long as physically possible. They have zero incentive to help you, and there is pretty much zero legal recourse beyond small claims court. I would be standing in their stupid shiny SOMA lobby harassing every single employee I could find until someone got off their ass and made the two keystrokes it takes to fix your problem. This dystopic world of casting humans off as liabilities to be queued in a chatbot ticketing system once you've received their money is really getting old.

<comment><AUTHOR> I mean, I kind of agree with you, but honestly, would you really want to be the crazy guy yelling in a lobby? Or the employee getting yelled at for something you didn't do? I'm not a confrontational or angry person and would far prefer someone who reads this and works for Coinbase to just reach out to me and make it right.

Then again, if another month goes by with no action, I really might end up being the guy marching around with a sign in lobby, who knows...

<comment><USER36> Take a lawyer with you. Mutter "intentional infliction of emotional distress" and a few other phrases s/he may give you.

To me, it sounds like you're treating Coinbase as a friend who's hit a tough patch, rather than as a business.

Requiring them to perform as a business does not make you "the crazy guy yelling in a lobby". It makes you a customer.

<comment><USER35> >Requiring them to perform as a business does not make you "the crazy guy yelling in a lobby". It makes you a customer.

Precisely. The inculcation of the former attitude among the masses has been a huge victory for this wave of monopolistic industries. Companies like Google have effectively trained humans to act like software bugs.

<comment><AUTHOR> Huh, food for thought. I may end up writing a blog post about this whole ordeal, and I think that's an interesting takeaway from it. "Training humans to act like software bugs" in particular is an interesting turn of phrase. Thanks.

Anyway, to be honest -- and this reflects not so much my unfamiliarity with the law but my quasi-familiarity with it, having worked as a legal assistant -- I was actually afraid of bringing lawyers into the mix. At some level, I feared that this newly monopolistic, venture-backed company would be more than willing to see me in court and would somehow manage to win, leaving me with crazy lawyer fees.

It's sad that this was my train of thought, but in retrospect, it's why I took such a weirdly friendly, almost abject tone with them throughout the whole process. I have known and worked for enough lawyers to know that once you open that Pandora's box with a well-funded adversary, things can get unpredictable.

</comment></comment></comment></comment></comment></comment></comment><comment><USER37> Oh hey me too!

First I bought a bunch of ETH. It went up and I went to sell them in November. Coinbase wanted Identity verification. No problem, filled out the form. Forgot a required field during the process and when it refreshed, it knocked my birthday up 10 years! Now they think I'm 16.

On the other hand, it might be a feature because of how much ETH has gone up while my (apparently teenage) self can't do anything about it!

<comment><USER29> Did you mean it has knocked down your age?

<comment><USER38> A 6-year old can't buy ETH? Crypto truly is mainstream.

<comment><USER29> Of course not? Try register an account with a 2012 birthday on Coinbase? Did you even read? I bet not?

</comment></comment></comment></comment><comment><USER39> I tried opening a business account more than six months ago and it's still not verified. I've uploaded files, my driver's license, everything they've asked for... still nothing.

</comment><comment><USER40> Coinbase is a U.S. company. Perhaps a small claims suit (if applicable) or a lawsuit will get their attention.

</comment><comment><USER41> From my personal experience, you have another month to wait… I waited 6 months for a withdrawal to be handled. To be fair, I withdrew to the wrong account number (to Simple, to the old account number with Bancorp), but the bank bounced the transfer and the funds were returned within the week. After that, Coinbase drug their feet for 6 months before I finally got the money right around Christmas time (i.e. I initially withdrew in June).

What bothers me even more than horrible communication is the fact that I converted BTC to USD and withdrew the money because I need the cash at the time (baby + move) and never saw it until much later. Had I kept it BTC–which I would've had I not needed it–that same BTC would've been worth about 8x what I got.

I don't want to scream "foul play" but it REALLY seems that way. There's NO WAY it takes 6 months, including a lot of pointless repeated "Have you checked with your bank? We're so sorry it's taking so long."

So yeah… good luck with Coinbase support. FWIW, Coinbase is the reason I'm done with crypto for good (as currency/investment). It's a minefield of bad actors and greed, incredibly susceptible to foul play and literal criminal activity. I willingly paid more fees with Coinbase because I thought they were a legit business… Nope!

I would normally end this with "…but mileage may vary." Not here. Good luck and godspeed, my friend. o/

</comment><comment><USER42> Whenever you have a real customer service problem, send a written letter, registered mail, demanding a specific action or written explanation why the action cannot be taken, sent to you within 30 days. If it doesn't clear itself up, consider small claims court or regular court. You can claim attorneys fees when you win, but beware of you lose (or if there are actually enforcible arbitration agreements in place.)

</comment><comment><USER43> I had the same experience. I couldn't get them to change my country, I provided ID, but somehow they thought it was not real.

It was over 1 year and I would have bought bitcoins from them if they didn't make this too much of a pain in the ass. Finally, I bought bitcoins from my friends. Lately, I need to sell them and say fuck it, I will create a new account. It worked!

</comment><comment><USER44> I've been waiting 3 months for them to find my $20,000 I wired to Coinbase, Inc in October 27th. During the 1st month I thought it was ok, 2nd month I thought I was crazy but now is unacceptable. It seems that they stole my money.

I'm not crying over some losses, I'm crying over money I wire to buy cryptos but It got lost. Nobody fucking care. They should put their shit together.

I filled a complain with the Consumer Financial Protection Bureau and Coinbase, Inc replied that "they are working in my case" ... hope it help me. BUT Seriously people, stop working with them, you would say ... its ok for me BUT until is not.

</comment><comment><USER45> There's a lot of people here frustrated with Coinbase and a lot of talk about BBB.

I think if you're going to punch, punch hard: If you're in CA, file a small- claims case. If a Coinbase rep/lawyer fails to show, you're likely to win your case.

Then, contact the SF County Sheriff and have the entrance to their office locked until you receive your money back in full. Details here:

[http://www.dca.ca.gov/publications/small_claims/collect.shtm...](http://www.dca.ca.gov/publications/small_claims/collect.shtml)

</comment><comment><USER46> This is pretty terrible support management. In our company, if a case is opened for more than 5 days, the entire team is notified.

If then nobody does anything, the entire department is notified. That never had to happen.

</comment><comment><USER47> My coinbase issues is now going on 4 weeks, they debited a tranasction twice and credited once, leaving a negative balance, where a significant number of >5 BTC just vanished into thin air.

</comment><comment><USER48> Damn, I just opened a coinbase account, thinking they were the only reputable exchange around. Luckily I don't have that much invested. Does anyone have suggestions for competitors?

<comment><USER49> It works fine 99.9% of the time. I know many people who have used Coinbase / GDAX for years without any issues.

You can also try Kraken (they just upgraded but had a lot of site reliability issues before) or Robinhood once it launches next month.

</comment></comment><comment><USER50> I always thought it was weird that when you sign up for coinbase they make it clear they will take a % of your transactions... like a bank! So where is the magic?

<comment><USER51> It's a convenient place for a lot of people who don't want to sign up for more "complicated" exchanges or are less familiar with the whole crypto currency ecosystem to buy into the hype.

Also you can transfer your balance to GDAX for free (it's part of Coinbase and trade there with lower fees)

<comment><USER52> Give Square Cash a shot? Bitcoin support is being rolled out [1]. Full disclosure: I work at Square.

[https://www.bitsonline.com/square-expands-bitcoin-pic- guide/](https://www.bitsonline.com/square-expands-bitcoin-pic-guide/)

</comment></comment></comment><comment><USER53> Man 5 months? I'm on two right now. Still getting idiotic automated responses from their customer support. I ping the ticket every couple of days, and nothing. Been thinking of going the Twitter route.

No way to get in and retrieve the % of a coin that I bought a couple years ago. Quite a bit of a scam to accept money for storage, lock a user out, and then provide no support for getting back in while still taking on new customers.

</comment><comment><USER54> My account at coinbase has been in a stuck status forever and I've contacted support. I never get any responses.

Not sure how they operate with horrid support.

</comment><comment><USER55> I've mentioned this in other threads but I had a very significant holding in ETH (more than enough to buy a car) stuck in limbo for about a week until I emailed them every day about it.

I would say call and be on hold for about a hour (no joke, it was around 70 minutes when I called about a month ago) and talk to them to escalate your case to priority 1. It'll then be resolved in about two weeks.

<comment><USER56> get a linkedin premium for trial and inmail one of the top level executives.

</comment></comment><comment><USER57> I really wish YC had some conditions for helping startups, one of the conditions being "you must offer stellar customer service."

</comment><comment><USER29> Out of the many startups out there, GitHub support is so far the best. Tickets in, within a day (usually 1-3 hours) someone will respond. My questions are usually very general so getting a response in an hour or so is ridiculous for me. Sometimes in just 30 mins. Response is friendly and professiobal. No BS.

<comment><USER58> > out of the many

How many are you talking about, assuming personally tried? Which are these?

</comment></comment><comment><USER59> I had a similar problem where I was stuck in automated response hell for several months. I finally decided to threaten legal action in the support ticket and surprisingly enough, I was put in touch with a human within a few days.

</comment><comment><USER60> Five months is way too long. Email them again, preferably using the email that is linked to your coinbase account. They got back to me within ~3 weeks although a 24 hours turnover would be FANTASTIC IF YOU ARE READING, COINBASE

</comment><comment><USER61> Is this my Kyle? The one that wrote me two months ago and hasn't responded since - If you're out there Kyle - please attend to my customer support request!! What are we to do with coinbase's atrocious support???

</comment><comment><USER62> If you find yourself in a situation like this hire a lawyer and file complaints already, if they're keeping you waiting for 5 months it means they don't care about your issue.

</comment><comment><USER63> IF Coinbase support is reading this - It's been 3 months since my ID validation issue has been submitted. Please respond with a human: Case #3462400

<comment><USER58> Coin base if you're reading this I'm waiting for you to reply here unless you want me to go to another exchange. I'm going to be buying some stuff soon.

</comment></comment><comment><USER64> I've been having similar issue. But mine has been locked for about a month now. Coinbase people. If you're reading. Please help!

</comment><comment><USER65> If you have cash in your account rather than just various coin, you may be able to file a complaint with the FDIC.

</comment><comment><USER66> Maybe I'm just lucky or something, but I've been with Coinbase for a few months now and I've yet to have any issues with them. The biggest issue I have is that their fees are kinda high to transfer anything, I would love a super slow / low-cost transfer option.

</comment><comment><USER67> how many hours are needed to solve outstanding issues? 1,000,000? if each hour costs $20 / worker, that's what, $20 million? Haven't they raised over a billion?

</comment><comment><USER56> get a linkedin premium for trial and inmail one of the top level executives.

</comment><comment><USER68> I've been ignored trying to setup a COinbase business account

</comment><comment><USER69> this has been my experience as well!

</comment><comment><USER70> This!! Coinbase support is so bad.

</comment><comment><USER71> At one point in the next few hours coinbase employees will enter this discussion. They will probably elevate your issue and make sure you are responded to within hours.

This is of course just a measure they take to keep the crowd silent. And it will not help other people with the same/other problems.

Please report them to BBB and other authorities within your reach. Companies should receive no love for this kind of behaviour.

If you can't scale your customer service with demand stop the signups, like binance did. Coinbase seems to be constantly unable to satisfy spikes in demand, such a company should not be trusted with money.

<comment><USER72> > _Please report them to BBB and other authorities within your reach._

The BBB is not part of the "authorities":

[https://en.wikipedia.org/wiki/Better_Business_Bureau#Critici...](https://en.wikipedia.org/wiki/Better_Business_Bureau#Criticism)

[http://money.cnn.com/2015/09/30/news/better-business- bureau-...](http://money.cnn.com/2015/09/30/news/better-business-bureau- millions/index.html)

[http://business.time.com/2013/03/19/why-the-better- business-...](http://business.time.com/2013/03/19/why-the-better-business- bureau-should-give-itself-a-bad-grade/)

[https://www.ncconsumer.org/news-articles-eg/the-better- busin...](https://www.ncconsumer.org/news-articles-eg/the-better-business- bureau-bbb-is-powerless-tohelp-resolve-consumer-complaints.html)

<comment><USER73> This should be a top level comment. Racketeers like the BBB absolutely must not be confused for legit public institutions.

</comment></comment></comment><comment><USER74> make your own coinbase.

<comment><USER75> Could you please not post unsubstantive comments to HN?

</comment></comment><comment><USER76> I have been going over a month with no response on my escalated case with them. I'm locked out of my account and they can't seem to provide any way forward.</comment>