Don't Fly During Ramadan (2013) - <AUTHOR> https://varnull.adityamukerjee.net/2013/08/22/dont-fly-during-ramadan/ <comment><USER2> For what it's worth, practically every brown guy I know goes through the rituals when interacting with US Gov officials. Shave, look as clean cut as possible, and don't stand out. So no opting out of the scanners, no joking at security or immigration, better have backup ID.

I'm not saying it's right that it's this way but it's safer. The officials are not very smart people but they have power, so you just give them what they want.

I'm not going to wage this war for liberty or whatever it is. I'm just going to go on vacation.

<comment><USER3> The security charade is nonsense, there's no doubt but I see hundreds of brown people going through security with zero issues every time I go to JFK.

</comment></comment><comment><USER4> It's sad how much flying has changed since 9/11\. Younger individuals will never realize how much easier it was to get through security. I'm sad at how he was treated and it's something that needs to be changed. It's not like treating anyone badly is going to result in more information.

<comment><USER5> >It's sad how much flying has changed since 9/11.

Sad but predictable in a world with a global movement of suicidal religious fanatics willing to murder thousands of people and cause billions in property damage. It is what is. I miss the old days too, but I wouldn't vote to water- down airport security.

>I'm sad at how he was treated and it's something that needs to be changed.

Does it? He refused the millimeter wave scan, got a pat-down, tested positive for an explosive or poison, and then refused further screening - what should happen at that point? Should he be cleared? Where did the TSA go wrong here?

<comment><USER6> He didn't refuse the scanner, he was given a choice and when his choice was going to get complicated he could no longer switch back to the scanner. He did opt for the scanner on his new flight. But none of that is really relevant to how he was treated. Why deny him a glass of water?

<comment><USER5> >He didn't refuse the scanner

He wasn't detained because he refused a scanner. You know that.

>when his choice was going to get complicated he could no longer switch back to the scanner.

Well ... yeah. What you refer to as a complication was him testing positive for explosives or poison.

>Why deny him a glass of water?

Is that the problem? He didn't get a glass of water?

<comment><USER7> > What you refer to as a complication was him testing positive for explosives > or poison.

You might want to look at the Birmingham Six.

They were from Northern Ireland (and thus automatically suspected of terrorism) and living in Birmingham; they were travelling to attend the funeral of a childhood friend (and he was a terrorist); they travelled on the day a bomb went off in Birmingham; and they played a game of cards on the train.

Those cards were coated with nitrocellulose.

The fragments of nitrocellulose on their hands tested positive as nitroglycerine, and that bit of "evidence" was used to convict them of a crime they did not commit and imprison them for very many years.

[http://www.bbc.co.uk/news/uk-england-12664938](http://www.bbc.co.uk/news/uk- england-12664938)

You shouldn't make assumptions.

</comment></comment></comment></comment></comment><comment><USER8> I set off the chemical detector at SFO once.

I'm convinced it was because I'd been to one of those indoor go-kart'ing places the day before as part of a company event, and wore the same jeans.

Extended screening was not a fun experience. I've always opted out so I'm used to the standard pat down. This was a lot more invasive. I was directed to a private area with two security officers (SFO uses a private contractor, not TSA). Besides a more thorough pat down, my bag was unpacked and its items were swabbed and chemical tested. I don't think the chemical tester went off a second time. The whole procedure took about 15 minutes. It's not the easiest situation in which to remain calm.

But, instead of getting annoyed at the security personnel (TSA or otherwise), I remind myself that this is ultimately the doing of congress and my fellow citizens. And then I send the ACLU another donation.

</comment><comment><USER9> What a horrific story. JetBlue doesn't deserve any high marks for their actions here either.

<comment><USER10> He set off the explosive detector, and didn't provide a good answer to why he set it off.

<comment><USER9> > He set off the explosive detector, and didn't provide a good answer to why > he set it off.

What, short of "I was making a bomb" would be an answer that would satisfy you? It's not like it is up to him to know the intricacies of bomb detectors and their ridiculous false positive rates for certain chemicals, including such terribly dangerous goods as soap.

<comment><USER10> He doesn't know how to talk to security. The primary purpose of security questioning is to establish that you are a safe, non-violent, legal traveler. Of course, security agents can't ask you this directly, so they ask this through proxy questions. Varnull did not understand this, and when asked the proxy questions, he gave vague answers and did not address the primary purpose. When the questions became personal, Varnull became defensive and talked back (the exact opposite of what he should do).

All that really matters here is the discussion with the explosives agent. This was the guy who had the power to 1) waive him on or 2) send him through tertiary screening. The interaction for the whole day was decided in this conversation. I honestly believe Varnull gave very bad answers here. Answering "I don't know" is a very bad answer. Even if he didn't answer the proxy questions, if he established that he was a safe and secure traveler, the security agent would have waived him on and he would have avoided the whole ordeal.

One of the answers he gave was so bad it made me cringe.

> _"Well, I haven't touched any explosives, but if I don't even know what > chemical we're talking about, I don't know how to figure out why the tests > are picking it up."_

After he said this, I'm completely unsurprised he got held up in tertiary screening.

<comment><USER11> So it's the duty of the interrogated person to know how to give good answers to security questions and not the security personnel's duty to ask good questions?

</comment></comment></comment></comment></comment><comment><USER11> Previous discussion: [https://news.ycombinator.com/item?id=6258422](https://news.ycombinator.com/item?id=6258422)

<comment><USER12> That last discussion was a shit show of people one-upping each other in the oppression olympics. It seems like as soon as you compare one persons experience to being not as bad or worse than another persons the entire thread devolves into terrible accusations and comparisons.

<comment><USER13> That second sentence would make a good HN comment. The first one is pointlessly inflammatory; please don't do that here.

<comment><USER12> I'm sorry you feel that way. It's a perfect characterization of how most non- technical comment threads threads go on here however.

</comment></comment></comment></comment><comment><USER14> I have the full sympathy to the guy.

That said I am at loss what is it to do with Ramadan? I have not seen a single statement that his ordeal has anything to do with Ramadan but it just happened during Ramadan. Otherwise this is happening to all walks of life including white dudes (though much much less frequently). Just a catchy title?

edit: my objection is to the title not the content.

<comment><USER15> Fasting is a major part of Ramadan. The whole ordeal took several stressful hours during which he was starved and dehydrated.

<comment><USER16> We wasn't following Ramadan, he's Hindu.

</comment></comment></comment><comment> tuna-piano Do you believe the government entered his apartment? It seems at least somewhat likely. They see the sparse apartment and picture of some religious thing on the wall, and it freaks them out. They take the picture back to their office to figure out what the hell it is.

I'm not knowledgeable about this stuff, but it seems like they could have used a "sneak and peek" warrant, as authorized in the patriot act.

[https://www.aclu.org/other/how-usa-patriot-act-expands- law-e...](https://www.aclu.org/other/how-usa-patriot-act-expands-law- enforcement-sneak-and-peek-warrants)

I kind of think this guy should look into a civil lawsuit against those agencies. Did they violate any of his constitutional rights? Not letting him get food / drink, threatening to hold his bag if he walked away? Was a search warrant attained and he was never given notice, even after the fact?

<comment><USER17> > Do you believe the government entered his apartment?

Yes, I do believe that, because it's plausible, and because they asked him, when facing his apartment building, which side the parking lot is on. Which suggests that someone was there who could verify the answer.

<comment><USER18> To me it suggests that they had someone in the building trying to figure out which unit he lives in.

</comment></comment></comment><comment><USER19> Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety.

</comment><comment><USER20> I've always wanted to visit U.S.A. but coming from a muslim background I'll probably never do it. Just reading the post infuriate me.

</comment><comment><USER21> I have to fly today, from Canada to Europe. I probably shouldn't be reading stories like these before a flight, but I did, top to bottom, transfixed by the details. I hope I manage to make it through airport "security" without any problem. I'll smile, I'll cooperate. Hell, maybe I'll even step into the radiation machine for the first time in my life if I have to (I also always have opted out).

I hate how scary this whole thing is. I fear it's going to keep getting worse.

<comment><USER22> Europe and Canada are friendlier than USA.

<comment><USER9> Not that much friendlier and getting worse every time I fly.

</comment></comment></comment><comment><USER23> Have people really asked for a place to pray while flying on a plane? Why would JetBlue ask such a weird question?

<comment> tuna-piano Definitely, for sure both jews and muslims. The "following instructions from female flight attendants" thing I would guess also isn't out of the blue... maybe the airline has had experience with people not following female flight attendant rules.

<comment><USER7> > The "following instructions from female flight attendants"

There have been a few instances of people refusing to allow a woman to sit next to them. They don't always move themselves, they sometimes insist the woman is moved.

EG, but there are other examples: [https://news.ycombinator.com/item?id=11406112](https://news.ycombinator.com/item?id=11406112)

</comment></comment></comment><comment><USER24> I recently was selected for a more thorough screening at the DFW airport, which included walking through the metal detector twice, having a body scan, the new "universal pat-down" [0], and individual swabbing and x-ray of every item in my bag (everything required to be powered up as well).

I am often selected for pat-downs, despite using the scanner, and I must say the newly implemented pat-down procedure was much more intimate than I was comfortable with. There's got to be a better way.

[0] [http://www.usatoday.com/story/news/nation- now/2017/03/03/tsa...](http://www.usatoday.com/story/news/nation- now/2017/03/03/tsa-rolls-out-new-more-intimate-airport-pat-downs/98713844/)

</comment><comment><USER25> The chemical test positive happened to me too: they swabbed my bag and the machine beeped and I got a free full body massage.

This was when I was flying home from college for summer.

I explained it as "This is the bag I use for school: something must have touched it during chem lab".

I am a coward for saying this, but your objective when flying is to get to point B. So, make it easy on the jack-booted thugs.

You don't affect change by annoying your local officially sanctioned thug. You affect change by voting.

If you want to make a stand, then come prepared for that: knowledge of law + 24 hours to kill.

<comment><USER26> The chemical swab (at least the one they use in Canada) seems to get set off by something in my wife's cosmetics pantheon. An agent made life hard for us on our last trip, almost made us miss our flight, very stressful.

I have heard, can't confirm, that glycerin soap will detect as a "bomb ingredient". Considering how ubiquitous glycerin soap, that's a rather terrible test.

</comment></comment><comment><USER27> I'm an average looking, run of the mill white software developer in my late 30's. I still get massive anxiety about taking air trips because of the hassle and harassment I've received in the past from TSA agents.

I have a hope that the backlash against the recent two failed Trump bans will continue to escalate and we'll see the end of this nonsense in our lifetimes. I think even the people who voted for this administration are starting to think it's absurd.

<comment><USER28> I'm the same, more or less -- middle-aged, boring-looking white dude -- and I also dread encounters with TSA and Border Patrol. Stealing my toothpaste is the least of it. As far as I can tell, the people they hire have the petty- authoritarian mindset of mall security, but with fewer legal constrains on their power.

</comment></comment><comment><USER29> I am Muslim and I've been "randomly" selected at airports before. My advice: smile and be nice as you should be with anyone. Granted you have every right to not comply, when you are being hostile it does not help you get out faster.

</comment><comment><USER30> Discussion on HN from 4 years ago: [https://news.ycombinator.com/item?id=6258422](https://news.ycombinator.com/item?id=6258422)

</comment><comment><USER31> To me the most surprising thing: do people really not know the difference between a Hindu and a Muslim?

They are the 2nd and 3rd largest religious groups in the world.

</comment><comment><USER32> Opting out of multimeter scans: not even once

<comment><USER33> I've opted out every time I traveled prior to the introduction of (opt-in, non-frequent flyer based) Precheck, so 8-10 times per year from 2010-2014(?) and never had a notable issue.

As the other child comment says, rights atrophy if you don't exercise them.

<comment><USER34> If you're traveling with someone you know, one trick to ending the pat down early is to try to embarrass the agent while in a sensitive area. My favorite is "you know, he's only doing this because his girlfriend dumped him and is lonely". ~50% of the time they stop immediately and say "you're good".

<comment><USER35> Embarrassing the TSA agents might work sometimes, but some of them are also known to be vindictive and petty towards anybody who even seems like they might be challenging their authority. Given the possibility, however remote, of accidentally angering a vindictive and petty person who has power over my liberty and/or belongings... I think I'd just shut up and endure the pat-down.

</comment></comment></comment></comment><comment><USER36> You are going to be tracked forever.

</comment><comment><USER37> > _timestamp on the paper: 10:40._ ..... _It was 2:20PM_

So this guy sets off the alarm (swab probably found traces of explosives ), has no paperwork in order (proof of work), and has to wait for 3 hours before it gets resolved.

Last time the HN crowd was enraged over someone who was questioned for 15 minutes...

I was detained overnight, and some of my friends were denied entry to US for bullshit reasons... It is like a different planet.

<comment><USER38> >has no paperwork in order (proof of work)

Oh? I must have missed the law that required people to do be able to prove where they work at all times.

>and has to wait for 3 hours before it gets resolved

 _By this time, I hadn't had any food or water in almost eighteen hours._

Learning to read would be a good start.

<comment><USER37> Did you ever cross international border?

My reading is just fine, read the article. He was 'fasting' before security check. And he should say it is a medical emergency, if he felt like passing out.

<comment><USER13> Please don't create many obscure throwaway accounts; we ban those. HN is a community. Anonymity is fine, but users should have some consistent identity that other users can relate to. Otherwise we may as well have no usernames and no community, and that would be an entirely different forum.

<comment><USER39> I think you're the only consistent identity that I recognize, because you post this a lot :)

I always have some concerns when I see it:

\- Obviously controversial (but not clearly trolling) posts like thr3290's can't be made without potentially endangering the poster (we've seen people fired for public or semi-public remarks e.g. "donglegate"). I feel that this would have a chilling effect on voices that go against the common sentiment on HN.

I for one would not be comfortable using my account to make a comment like that one, which means that with your rules, my opinion would be suppressed (hypothetically speaking - I don't agree wth thr3290).

\- "We ban those" isn't corroborated by any clear HN code of conduct. I (perhaps incorrectly) recall reading one at some point, but I'm currently hard-pressed to find it.

\- It's not obvious to people who don't know you that you're a moderator. Your account doesn't have any clear demarcation, and you don't mention it in your profile.

<comment><USER13> Oh of course, throwaways are legit when the topic is personally sensitive. Some of the best HN discussions happen that way; for example there was one the other day where a couple of throwaway accounts discussed what it's like to be non-criminal psychopaths. Obviously we'd never get that without throwaways. But that is easily distinguished from the users who routinely create throwaways in order to completely depersonalize their comments. The latter is actually an attack on the foundation of HN. Legit throwaways are actually highly personal—often more personal than the main account.

On HN, commenters have a personal identity (which of course can be a pseudonym if you want). If some users want a site where there are no such identities, only free-floating comments with comment IDs, they should find or create such a site and participate there instead. There's room for lots of different kinds of internet forums. HN is just one kind, but it _is_ that kind, and the reason we have moderation, including account bannage, is to preserve it as the kind of site it's meant to be.

<comment><USER39> > On HN, commenters have a personal identity (which of course can be a > pseudonym if you want). If some users want a site where there are no such > identities, only free-floating comments with comment IDs, they should find > or create such a site and participate there instead. There's room for lots > of different kinds of internet forums. HN is just one kind, but it is that > kind, and the reason we have moderation, including account bannage, is to > preserve it as the kind of site it's meant to be.

I don't digest HN this way, at least - I prefer to separate the message from the person writing it. I'm also pleased to note that there are far fewer comment-reviewing/ad-hominem rebuttals on HN than on Reddit, and far fewer 'celebrities'.

On the flip side, I'm aware of some of the downsides of anonymous posting, so I can't disagree with you there.

I'm just afraid that a lot of times that you warn against throwaways, it's towards a controversial post (that's usually downvoted for being unpopular, but not otherwise against the rules of the site). I believe those posts have a lot of value, at least in reminding people that there are other perspectives and that nothing is 'obvious' (and maybe getting them a bit more passionate :) ). I'm afraid of these disappearing, as I've seen happen on sub-reddits that become debate-free echo-chambers.

<comment><USER13> I don't want most of those posts to disappear either. The moderation comments you're referring to are more targeted than that.

<comment><USER39> Fair enough. There's selection bias on my end, and even then I can't find much fault.

Thanks for keeping the gears oiled around here :)

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER40> Or, don't contaminate your stuff with dangerous chemicals before flying.

<comment><USER41> The "dangerous chemicals" you're referring to is bed-bug spray from months ago, that happened to get on his clothes while he was changing his bed sheets. I've seen victim-blaming before, but this takes it to a whole other level. It's genuinely scary that people like you exist.

<comment><USER42> I highly doubt it was the insecticide. It is far more likely that it was some combination of the cleaning supplies used. Many household cleaners can be used in bomb making.</comment></comment></comment>


How Candy Japan got credit card fraud somewhat under control - <AUTHOR> https://www.candyjapan.com/how-i-got-credit-card-fraud-somewhat-under-control <comment><USER2> _If you suspect an order is fraud, don 't go out and say to the criminal "hey, I declined your super suspicious order!". Instead, play dead. Pretend they got you. Tell them "thank you for your order", behaving exactly the same way as if it really was a successful order._

The name of the game is to make things cost more for your enemies than they cost for you. Removing instant feedback is key. Instant feedback is great. Delayed feedback is costly.

This is in large part why most DRM and anti-cheat failures happened. Companies and developers need to think about the economics of what's going on. It's not the side with the trickiest mechanism that wins. It's the team with economics on their side.

(Amateurs: tactics, pros: logistics)

<comment><USER3> Blue Byte did something along the lines of your suggestion with the copyright protection of Settlers III. When the game detected that the DRM was broken, iron smelters would only produce pigs instead of iron.

[https://en.wikipedia.org/wiki/The_Settlers_III](https://en.wikipedia.org/wiki/The_Settlers_III)

<comment><USER2> Not bad, but even that reads like a bit of an FU from the devs. ("Pig Iron?") The best thing to do is to make it definitely seem like it was a bug introduced by the crack. (Maybe James Bond villains giving their secret projects suggestive code names and telling their entire plan isn't unrealistic?)

<comment><USER4> It's important not to disguise any anti-piracy measures as bugs, because pirates (or even reviewers playing pirated copies) will loudly proclaim that the game is buggy, and discourage legitimate buyers. This may have contributed to the closing of at least one development studio (Iron Lore, developer of Titan Quest)[1].

[1] [http://www.quartertothree.com/game- talk/showthread.php?42663...](http://www.quartertothree.com/game- talk/showthread.php?42663-Venting-my-frustrations-with-PC-game-dev)

<comment><USER2> _It 's important not to disguise any anti-piracy measures as bugs, because pirates (or even reviewers playing pirated copies) will loudly proclaim that the game is buggy, and discourage legitimate buyers._

I'm wondering why there isn't a service that lets you search for people encountering your crack-penalty. A really sneaky company would disguise itself as a hacker group, then offer a copy of the game that doesn't have that "bug." (But has another one.)

<comment><USER5> Green Heart Games did basically that. [http://www.greenheartgames.com/2013/04/29/what-happens- when-...](http://www.greenheartgames.com/2013/04/29/what-happens-when-pirates- play-a-game-development-simulator-and-then-go-bankrupt-because-of-piracy/)

</comment></comment></comment></comment></comment></comment><comment><USER6> PM from a fraud detection company here. One thing I didn't see mentioned on this thread is Device ID, which is very common on fraud detection platforms. When a user comes to your website or mobile app, you have access to hundreds of signals from their device. Some like IP address are easy to spoof. Others like whether the user has changed their phone alarm from the default settings are often ignored by fraudsters but surprisingly telling signals (fraudsters don't bother to change from default settings). We wrote an article on some interesting findings recently here: [https://simility.com/device-recon- results/](https://simility.com/device-recon-results/). A good device ID product can not only tell if the same fraudster is accessing your app repeatedly while pretending to be different users, it can detect risky user profiles when they land on your app. Before they even make a payment.

<comment><USER7> Just a thought: have you ever considered that by publishing such red flags for fraud, fraudsters will adopt these "organic" behaviors in order to appear more legitimate? I understand that the idea is to make illicit transactions more difficult and that adopting these "organic" behaviors is more difficult, but automated fraud tools (ie - what most 'script-kiddies' use) also become more sophisticated over time. Regardless, I bet you don't publish ~all~ your fraud detection vectors for that exact reason.

<comment><USER8> I'd be surprised if all of the published vectors are genuine, too, for the same reason :)

</comment></comment></comment><comment><USER9> So it appears that a combination of (1) removing instant feedback (not alerting fraudsters as to the success/failure of their charge) and (2) giving a grace period to review and cancel charges has given Candy Japan some breathing room.

Though it does seem that this requires a manual step (2) before sending charges through, does anyone have experience using a fraud detection API, like Maxmind's minFraud [1] or any other, in an attempt to avoid having to review each charge?

[1] [https://www.maxmind.com/en/minfraud- services](https://www.maxmind.com/en/minfraud-services)

<comment><USER10> >does anyone have experience using a fraud detection API, like Maxmind's minFraud

We tried MaxMind, for our use case it was pretty useless. The feature that sort of worked which we considered using was the geo-location stuff. Our idea was to see how close a customer was to where the goods where to be sent. Sadly the countries we operate in are to small, and IP location is to inaccurate.

As a test we ran a couple of months worth of fraudulent order data through MaxMind, with a success rate of 100%.

The best solutions we found is: \- Block cards not issued in the country where you operate. This shield us from poor credit card security in countries like the US. \- Enabled 3D Secure. This blocks all the amateurs \- Manually call customers ordering for large amounts.

Generally speaking it's very difficult to tell the difference between a fraudulent order and a first time customer.

<comment><USER11> > Block cards not issued in the country where you operate

Please, don't do this. It's so annoying.

> Enabled 3D Secure

Yes, this is a really good idea.

</comment></comment></comment><comment><USER12> I'm guessing this has been asked before, but why not just use a credit card processor that handles all of that stuff for you. Seems like they are in the business of selling Japanese candy, not preventing CC fraud.

Am I being naive here?

<comment><USER13> Can you name a credit card processor that handles all of that stuff for you? Neither the old-school gateways (Authorize.net/etc) nor the new SaaSy stuff (Stripe/Braintree/etc) offer even risk scoring, let alone a comprehensive solution to fraud mitigation.

<comment><USER14> Stripe does offer fraud protection, based on machine learning algorithms using data from their customers.

[https://stripe.com/docs/fraud](https://stripe.com/docs/fraud)

<comment><USER15> Stripe's fraud protection is HILARIOUSLY bad. I'm convinced they don't care about chargebacks; in fact, to get their fee for a chargeback, they need a $500 order.

They don't eat the loss; the card network does.

</comment></comment></comment></comment><comment><USER16> I have a website that processes a fairly small number of monthly credit card transactions, 1-4 per day. However, it didn't take long for the website to be used as a place for requests, mostly from Vietnam, to check the validity of CC numbers. It cost me a lot of money in chargeback fees.

I ended up implementing a system using Braintree to do 1) Request an AUTHORIZATION for the amount 2) If the AUTHORIZATION fails, return the error (sounds like I need to change this part, but how to do it without hurting legitimate users?) 3) Send information, including IP and email address, to minFraud 4) If the minFraud riskScore is >= 20, request a VOID on the authorization request 4b) If the riskScore is low, submit a REQUEST SETTLEMENT on the AUTHORIZATION

This has worked extremely well, but a few still slip through the minFraud check.

Even though Braintree offers it's own fraud checking, I still feel more comfortable with minFraud. I really wish that processors like Braintree would put more effort into fraud detection.

I NEVER have this issue with PayPal transactions. Even if it's fraud, they just reverse the transaction and there's no chargeback fee.

<comment><USER17> Why not just refuse to do business with Vietnam, Nigeria, Russia, and other fraud havens entirely?

<comment><USER18> I am a native-born American citizen living in Russia.

The amount of grief that your solution causes me is significant. I'm a legitimate customer who does nothing fraudulent. However, whole swaths of the internet treat me as if I have leprosy just because my IP address is in Russia.

<comment><USER19> I don't know how to say this without coming off harsh, so I'll say it and ask you to use the principle of charity when reading it.

If the Russian state refuses to stamp out crime that is causing negative externalities, then people should rightly stop dealing with people inside Russia as a logical response.

<comment><USER20> Replace "Russian state" with "African American culture", and I think the problem with this attitude becomes more obvious.

<comment><USER19> Please point me to the representative "african american culture" government apparatus and you'll have a point.

<comment><USER20> Part of the role of a government apparatus is to enforce social norms. Culture plays a similar role. They aren't the same thing, but they do have similar attributes.

Please note that I am not criticizing any governments or culture; I merely wonder why we're OK with nationalism like this, but not racism.

<comment><USER19> > I merely wonder why we're OK with nationalism like this, but not racism.

I'm not appealing to nationalism? "Russia" could be a stand-in for any controlled territory.

For example many businesses that trade online in the US attempt to exclude people from the Eastern District of Texas in their terms and conditions. Why? Because the courts there are very friendly to plaintiffs in patent cases and they'd prefer not to get sued in that jurisdiction.

That district is causing a negative externality to people outside of it, so they refuse to do business with it.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER21> I remember building a subscription system back around 2009-10. Very few of the tools available now existed back then, and things were much less efficient. Or at least that what it seems like looking back. The service targeted competitive gamers (teenagers, early 20s) and I've always suspected that we had to deal with a higher incident of attempted fraud than would be the case with other audiences.

If I never again have to deal with a situation where some kid 'borrowed' mommy or daddy's credit card, I'll die happy. No amount of fraud detection can prevent that situation.

</comment><comment><USER22> Thanks for the insights.

I've been fighting this fight for over 17 years now. The landscape has changed a lot - mostly for the better IMHO. In particular, issuers are taking more responsibility for checking the validity of the cards but some of them are hopeless and there is still a way to go.

Criticise me all you like but I still have a blacklist of countries where I will never send physical goods to (unless they direct deposit the money, for one of my sites).

Not sure if it's relevant for "subscription" model businesses but Stripe and a couple of other providers have an option to charge the card immediately or just get authorisation for the amount. The authorisation is only held for seven days, but I have found that this has often been enough for the owner of the card to notice and cancel the authorisation before the charge happens. I haven't checked but this could also solve the "instant feedback" problem for providers that give it as "authorsied" is less conclusive than "charged" for the scammer.

</comment><comment><USER23> When I worked on an e-commerce website shipping physical goods we would only ship to the customer's billing address for credit card payments. Anyone shipping to a different address needed to call their credit card company to add the address (every credit card company I've dealt with would allow customers to have multiple valid addresses on file), or use a different payment method. We never had big issues with fraud and I don't recall a customer ever complaining about it. I think in 3 years we had 2 chargebacks due to fraud.

<comment><USER24> You do know that some cards allow any billing address right?

<comment><USER23> If it's a source of fraud we never ran into it.

</comment></comment></comment><comment><USER25> Eliminating immediate feedback about failed transactions makes things harder for everyone the fraud detection system identifies, both fraudsters and the many false-positives. And the false-positive rates seem very high, IME; it seems like I and everyone I know has encountered that problem multiple times.

Imagine that you place a legitimate order and they don't tell you it failed; how do you find out? Days later when the order never arrives? That would result in very angry customers.

<comment><USER26> There's nothing inherently bad about very angry customers. It's more about how you handle them and whether you are continuously looking for ways to decrease them in number.

In this case, the idea is these are people who tripped red flags for you, and upon investigation didn't give you any reason to believe they were legitimate orders.

If you're really worried, you can contact them and ask.

</comment></comment><comment><USER27> I really love how open Candy Japan has been with the business on HN, since the beginning. Thanks!

</comment><comment><USER28> We exclusively use PayPal as they kindly cover all of our transaction fees. However, we still experience fraud which creates work for accounting and Customer Service.

A rules-based approach has helped, but we've also been playing around with SiftScience[1] and I've seen it do wonders for some sites, so we'll likely be implementing it. The key problem is keeping the false positive rate down, as we don't want to inadvertently block our legitimate users.

[1] [https://siftscience.com/](https://siftscience.com/)

</comment><comment><USER29> In the article, PayPal it's often mentioned that PayPal is generally disliked.

As an international customer, I prefer PayPal over giving them my credit card details. When entering my CC, there is a big risk that my data gets stolen (is the data truly securely transmitted, stored, and processed?). I know I can request a refund that any time with my bank but that is a big hassle. I have to write them a physical letter, and wait for a couple of days. During that period, my CC is blocked and I they will likely issue me a new credit card (which costs 10€). When paying with PayPal, I can report a fraud online or call them and they have been really quickly in responding (I have once not gotten a product and they were very quick in issuing a refund). Also, I feel way more comfortable using PayPal because I can see that the site I'm entering my information to is actually PayPal, and I have two factor authentication. Before I didn't have a CC, PayPal was the best solution because they would just withdraw the money from my bank account and they merchant would get their money immediately.

I can understand why PayPal is not a good choice for sellers (I've heard stories where PayPal blocked merchant accounts for a few months without giving them their money they had on PayPal, and refusing any new transactions). So, can you explain to me why PayPal is a bad/unpopular choice as a customer.

<comment><USER30> Keep in mind that PayPal leaks lots of your personal information to the sellers, including full street address. Merchants don't even need to opt-in to get it, it's all provided by default for all purchases, even when there are no physical goods involved.

<comment><USER29> And yet 95% of all my purchases require a billing address, even if they we'll never ever send me a letter. Even better, some even check if the billing address is correct (they send it along with my CC# to my bank and my bank will decide what to do).

<comment><USER31> In Europe it's the law that you need to record the billing address (for 10 years) otherwise you can't obey the VAT laws.

</comment></comment></comment></comment><comment><USER32> My understanding is that Stripe is pretty much the de facto solution to get started with credit card payments on your site, and if you're relatively low volume you can review for fraud and manually reject it yourself.

I've set up stripe before, so I have a casual understanding of how it works, but I'm curious what an attacker would be able to do (worst case) if a server I have Stripe payments on gets rooted. Are they only able to charge legitimate customers' cards for the period of time that a payment token is active? Or I suppose they could re-direct the payment page to their own payment page. If they steal the Stripe secret key is there a way they can steal money using it? (other than just bulk testing if they can charge cards)

</comment><comment><USER33> Is there no service that does CC processing and fraud detection already?

I would think it does not make sense for every ecommerce merchant out there to build their own solution.

Bemmu, you say you use PayPal - isn't PayPal also accepting Credit Cards? Don't they do the fraud detection in this case? I would expect them to have a huge advantage. You only see the IPs and other metadata from a few customers. They see millions and should be able to do way better fraud protection.

<comment><USER34> Yep, PayPal is awesome at this. I originally intended to go on a long tirade about how PayPal had dealt with this, but cut it out as the post was starting to get a bit long.

\---

Peter Thiel on PayPal: _" In mid-2000, we had survived the dot-com crash and we were growing fast, but we faced one huge problem: we were losing upwards of $10 million to credit card fraud every month. Since we were processing hundreds or even thousands of transactions per minute, we couldn't possibly review each one - no human quality control team could work that fast.

So we did what any group of engineers would do: we tried to automate a solution. First, Max Levchin assembled an elite team of mathematicians to study the fraudulent transfers in detail. Then we took what we learned and wrote software to automatically identify and cancel bogus transactions in real time. But it quickly became clear that this approach wouldn't work either: after an hour or two, the thieves would catch on and change their tactics. We were dealing with an adaptive enemy, and our software couldn't adapt in response."_

They ended up going with a hybrid approach where their algorithm would flag suspicious transactions, which would then be manually reviewed.

<comment><USER35> I've heard Max Levchin describe Paypal as a "credit card fraud detection system that also accepts payments".

<comment><USER36> This is also where the majority of "PayPal sux!" type posts come from. People who get caught up in the hyper vigilant fraud detection stuff and get their account locked.

I have occasionally wondered how many of those foaming at the mouth tirades come from people who were actually scamming people and are angry that their take was locked away.

<comment><USER37> As someone who went through PayPal hell a few years ago, I'd say there is a _lot_ they could do/have done to improve their customer service without impacting their fraud protection capability. I experienced issues like being bounced between different phone representatives offering different explanations for why my account was locked, a slow and duplicative process of uploading scans of identification documents, etc.. Just saying.

</comment></comment></comment></comment></comment><comment><USER38> What's the best way to do "no immediate feedback" when you're selling something that is instantly delivered? (Site paywalls, for instance.)

<comment><USER39> Do paywalls face as much fraud? My understanding is that industries that provide digital goods or services see a much lower rate of fraud because there's little resale value involved (and the cost of stolen/returned goods is much lower).

<comment><USER40> It sounds like the biggest problem that OP is talking about is people using his service to validate credit card numbers. They don't particularly care about the candy, they just want to know if a number has been cancelled yet.

</comment></comment></comment><comment><USER41> I wrote a similar system for an ecommerce site-

attached session data, "remora data", tracked IP's, (in fact trace routed all IP's looking for suspicious proxy flags like going through Ghana), browser meta data- etc etc. I'm proud of how robust it ended up being. Constantly recursively crunching shipping addresses, CC numbers, IPs, all that jazz and accounts- so if someone tried several different cards their account would be flag, which would flag their IP which would then trickle down the system.

Of course never letting an attempted scammer know the system was on to them- in fact encourage them to keep using more cards and try different combinations so the flagging system would grow over time. Sure we got some false positives, but drastically cut down on repeat scammers. :)

In which case we just encouraged a phone call and solid proof of information for an account override.

It was war! Good article!

</comment><comment><USER42> Not sure if the author tried this, but there are many experts on carding around the internet (the most famous being Brian Krebs) who might give advice for free on credit card fraud countermeasures. The simplest way to find them is to google for presentations at hacker conferences about carding, cyber criminals, credit card theft, etc.

</comment><comment><USER43> What if a real users mistypes their credit card number... your order was successful.

<comment><USER44> You check the card number via the Luhn algorithm, and tell them about it? That's not giving any data to fraudsters.

<comment><USER10> If you at any point have access to the customers credit card number, then your doing something horribly wrong. Unless you're the payment processor.

<comment><USER45> Luhn algorithm can be done client-side - all it needs is the number.

<comment><USER10> Letting a customer enter a credit card and then parsing it on to the credit card processor means that you would need to be some level PCI complainant. You really really don't want to be close enough to the credit card numbers to do something with them, especially client side.

Having the credit card field, where you can access it, means that you become a target for people wanting to inject javascript into your site. Perhaps you're safe, but what about all the third party javascript libraries or tracking/remarketing/tracking script most sites have?

Sorry, it's a really bad idea. Let you credit card processor deal with the that hassle.

</comment></comment></comment></comment></comment><comment><USER46> Hey bemmu, your presentation last year at Hacker News Kansai was really interesting, and I learned a lot. Thanks for putting the time into following up!

</comment><comment><USER24> This article does not solve anything. Only thing I have found working is 3D security request for VISA cards.

</comment><comment><USER47> I use chargebee so much better and cheaper than recurly

</comment><comment><USER48> the problem is credit cards. the should be depricated

</comment><comment><USER49> [http://d.pr/i/x0JD+](http://d.pr/i/x0JD+) vs [http://d.pr/i/16wJh+](http://d.pr/i/16wJh+)

Not sure what the rules are, but I thought it might help.</comment>


China sets up national laboratory for advanced policing - <AUTHOR> http://archive.is/hVDus <comment><AUTHOR> Original paywall article on Financial Times [https://www.ft.com/content/5cc651a4-48fd-11ea- aee2-9ddbdc861...](https://www.ft.com/content/5cc651a4-48fd-11ea- aee2-9ddbdc86190d)</comment>


The most useful Sublime Text packages - <AUTHOR> http://chevonie.com/most-useful-st-packages/ <comment><USER2> git, gitgutter, and sendcode should be on the list. git allows you to add, branch, commit, push/pull, etc. in subilme. gitcutter shows lines modified, added, and removed. Sendcode allows you to send a selected line to the terminal.

<comment><AUTHOR> Thanks for the suggestions. I hadn't heard of those, but they sound really handy. I'll try them out.

</comment></comment><comment><USER3> Sublime really feels like it's dragging its feet compared to applications like VSCode and Atom, which have both shown that you can add value without turning into a bloated IDE.

</comment><comment><USER4> Add the scp/sftp plugin there. Good stuff.</comment>


Show HN: Simple Web service for fetching HTML page title - <AUTHOR> http://www.pagesynopsis.com/

<comment><AUTHOR> Thanks for checking the page, bpfh. I'm not sure what's happening. I haven't tried viewing the Web site on Mac, but I can view it both on Windows and Linux (Ubuntu) with Chrome, FF, and IE8. Can you please try again, and let me know if you still have problem? The Web site (which is running on the same JVM of the Web Service) uses Twitter Bootstrap, and it works from my Android devices as well. Thanks!

<comment><USER2> It's working fine for me on Chrome 20 dev on OS X.

BTW: Use the reply links under comments. :)

<comment><AUTHOR> Thanks, Ashley. I'm new to HN. :) but, I'm a fast learner. ;)

</comment></comment></comment><comment><USER3> [http://www.pagesynopsis.com/pageinfo?targetUrl=http://www.pa...](http://www.pagesynopsis.com/pageinfo?targetUrl=http://www.pagesynopsis.com/pageinfo?targetUrl=http://www.pagesynopsis.com/pageinfo?targetUrl=http://www.pagesynopsis.com/pageinfo?targetUrl=http://www.pagesynopsis.com/pageinfo?targetUrl=http://www.pagesynopsis.com/pageinfo?targetUrl=http://www.pagesynopsis.com)

<comment><AUTHOR> D*ng, LiquidSummer. I've been using this service for almost a year with no problem, and you broke it. :)

It appears that, because it recursively calls it, the call eventually times out. (Google App Engine has this time limit of 10~30 seconds.) I'm not sure if I'll have a solution for this, but I can at least catch the exception. I'll need to look into it further.

Thanks for finding this bug!

<comment><AUTHOR> OK, I figured it out. :) The problem was, we only support HTML pages at this point. The targetUrl you specified did not return a valid HTML page (it's JSON), and the application just returned 404 HTTP status code (since it couldn't find any HTML content), which was by design. (Note that this API is supposed to be used by a program not from a Web browser.) Anyways, it had been a while I actually looked at the code, and it was "fun" to look at the code again. :) I have yet to find a "bug". _grin_

</comment></comment></comment><comment><USER4> I don't get it, is a service for developers to get the page title for a html page, so I must make a request to this service and learn it's api instead of making the request directly to that page and run a very simple regex?

<comment><AUTHOR> Givan, yes and no. Clearly, you're right in that it's one more thing to learn (a particular variant of REST API). But, there can be many benefits of using a Web service like this (or, another app/service/abstraction layer, etc.) in some situations. For example, suppose that you want to get the meta description of a certain Web page using a Javascript (from your own HTML page). The Web page may happen to be large and there can substantial network latency, etc. In many cases, you do not want to do it on the fly every time your page is loaded. You may want to implement a storage or caching layer on the server side, etc. PageSynopsis provides such service "out of the box". It also supports "asynchronous" fetching, periodic refreshing, and so forth. This is a very simple service, but I use it from different apps of mine (and, I don't have to replicate this functionality across different apps). Thanks for checking it out.

<comment><USER5> Why make it a service? Why not open source it and let anyone run it from their machines?

I'm sorry but even for the client side, I'd feel happier with my users making a request to my own server where I can definite my own caching as per my applications needs.

Calling a third party service should be reserved for advertisements, tracking, and queries to proprietary data (e.g. Google Maps).

I'm not disparaging your efforts here, no doubt its a fine service but I'd want to run it myself not have it as a SaaS.

<comment><AUTHOR> True_religion, Great point. As a matter of fact, PageSynopsis is just part of my larger effort.

There are many different ways we can use, benefit from, others' (other developers') work. Traditionally, using a library and linking it into your own code was the primary way to use other people's work. (There are pros and cons.) There have been many different efforts for the last decade or so to make "reusing" others' software "easier". You may recall things like component-based software development, etc., or more recently, certain architectural designs/paradigms such as SOA, and so forth. Open source software is another way in which you can "reuse" others' work.

I have no problem with one or another of these approaches. I use a lot of open source software and I open sourced a lot of my software before (even before open source was considered an important part of the development community). I was a big believer of component-based software development (which never realized).

This is just a different effort. Do you really want to run hundreds of "small" services yourself? Just hypothetically, if you can find (virtually) every functionality you need as a Web Service, do you still need to code it into your own program or run it as your own service? This is a rhetorical question, but I see this as a future. I believer that having a uniform interface (e.g., REST based WS) can make this dream a reality. REST-based Web services have been getting popular for the last several years with wide "install bases". I think we are on a good track (so far).

More to the point, the program part of the PageSynopsis is not that much. Any competent developer can probably implement this in a day (or, for even less) including all extra functionalities. But, why spend a day? And, spend more hours maintaining it, when/if the service were already available? (Also, that's hundred days for hundred developers.) I believe that the real benefit of PageSynopsis (and, other services I'm currently developing) is that, if you choose so, you do not have to worry about anything other than just the "interface". I developed this service almost a year ago, and amazingly it just works for me to this date. (Google does heavy lifting for me.) No more extra jar files I have to worry about. No maven, ant scripts to maintain.

I hope you see that this _can_ be useful.

</comment></comment></comment></comment><comment><USER6> On Tue May 22 20:03:29 EEST 2012, all I get is a page with navigation and a greyish pattern background. Could not figure out what to do with it. This is with Chrome and FF on a Mac.</comment>


Tour of 1985 formal proof of a limit on asynchronous processes (won Dijkstra award) - <AUTHOR> http://hnr.dnsalias.net/wordpress/?p=49 <comment><USER2> Interesting but useless add a maximum time for computation or not requiring all nodes to agree and it's trivial. The logic is still somewhat interesting so feel free to read it but don't forget it's a meaningless result for the real world.

<comment><USER3> That's arguable - you certainly need all nodes to agree in lots of applications. And if you add a maximum time for computation, where do you set the line? Especially in mobile networks, computations can take a wildly varying length of time.

<comment><USER2> Such as?

Note: There are some interesting cryto systems such that X out of N nodes need to agree to do something. So you can send off the blackmail if 8 out of 10 people think you died etc. Because of this you can add a lot redundancy to most systems without causing problems.

Edit: Maximum time might be 50% longer than 80% of your nodes took it does not need to be a fixed number.

<comment><USER3> The impossibility proof actually stands if you require only one processor to decide (this is mentioned explicitly in the paper). So X out of N is just as hard as N out of N.

Some methods for ensuring a total ordering on message delivery require a round of consensus. Google's chubby lock service requires five servers out of five to achieve consensus. Database commit requires (at least) majority consensus if you're using quorums.

You're right to argue that practically this result doesn't _really_ affect anything in the sense that you can fake synchrony with sufficiently large timeouts, but at the same time systems that are using hard core distributed algorithms such as Paxos are highly critical and it makes a lot of sense to be aware of what is possible and what is not.</comment></comment></comment></comment>


Tech Giants, Once Seen as Saviors, Are Now Viewed as Threats - <AUTHOR> https://www.nytimes.com/2017/10/12/technology/tech-giants-threats.html <comment><USER2> The wording of that title is _very_ interesting. It's a perfect example of 'bureaucratic style'[1].

First, the passive voice. This is an article about people looking at tech giants, but the passive voice centralizes the companies. That associates the change with companies, not observers, and also makes the claim seem more objective by downplaying the fact that this is about potentially-inaccurate perceptions.

Second, the missing subject. This goes beyond indefinite pronouns to fully _absent_ pronouns; who's doing the seeing and the viewing? Since the best answer is "writers like me at media outlets like this one", it makes sense that it wasn't mentioned.

Third, the acausal and discrete setup. Things used to be that way, now they're this way, these are just states of being without a transition or source. Lest someone notice that David Streitfeld has built his career promoting exactly this transition, and is perhaps not simply reporting on a change he observed, the title directs attention away from what shaped perception.

And to be fair, it's just a pithy title, and there's a whole article here. (Although many of these approaches continue throughout.) But it's an interesting thing to analyze how the distinction between "people see this" and "this is reality" is blurred so aggressively in so few words.

[1] [https://longreads.com/2017/04/12/the-elements-of- bureaucrati...](https://longreads.com/2017/04/12/the-elements-of-bureaucratic- style/)

<comment><USER3> Seriously, this is the first thing I thought when I saw the title.

> Yes, tech giants are now widely viewed as threats, lots of attention is > invested into having negative valence about technology companies. Why do you > think that is, Journalist For The New York Times?

</comment></comment><comment><USER4> You can't deny that these platforms are in an emergent self-winner-takes-all oligarchy of sorts. Take LinkedIn and Google for instance. LinkedIn allows Google to have full search access to the site and that's beneficial to both LinkedIn and Google. However, if I want to spider LinkedIn to MVP my way to a new application they'll lock me out. In effect, Google has monopoly as does LinkedIn, which owns the data. Because LinkedIn is already free and ubiquitous it benefits from network effects that create a strong competitive moat from new threats. Both companies have a kind of without either engaging in explicit anti-trust behavior and they even reinforce one another's monopoly.

<comment><USER5> "However, if I want to spider LinkedIn to MVP my way to a new application they'll lock me out."

Can you explain how this is different than how it has always been in the non- tech world?

For example: Home depot has deals with various partners to display their inventory and sell their products. But if i want to go into the stores and track the inventory and scan prices myself, they'll kick me out of the store.

You can even make this purely physical if you like, too. If i start a store that doesn't even compete with costco (different target markets), but start recording their prices/etc, they'll also kick me out.

The usual response is "well, linkedin collected a bunch of data from users that they don't own and is now using it to make a business, and won't let me reuse it". So?

That's also a thing that has happened since time immemorial, it's not like databases of this nature are new. They just got easier. Before you couldn't even make a product at all!

What you are saying applies, IMHO, everywhere. It's basically a complaint that existing businesses won't let you co-opt them to get ahead, and may not be willing to partner with you. That's not special to any of the tech companies, or tech, or, well, anything.

<comment><USER6> Attitudes like this is why the promise of the Internet since the early days, limited to academic purposes only, has been lost.

Because you're right - secret backroom deals and corruption are so common as to be _assumed_ in the physical world to the point of non-competitiveness. Say I want to start a home improvement supply store. Well there's already Home Depot, Lowes, and OSH, so unless I have a secret and exclusive source for free lumber, I'd be crazy to even try, given all the deals that Home Depot has that guarantees it'll never die.

So? Is moving non-digital collusion between big businesses to the Internet really the _best_ we can achieve?

Strive for better. Stagnation is bad, tech or non-tech. Everyone's noticed how Google searching's gotten less useful, or that Facebook (for the "olds" that still use it) is more annoying than useful these days. The Internet should be enabling _better_ businesses by promoting competition, not stifling it.

Naive? Intentionally so. (Every freemium startup has an enterprise "contact us" plan, but I choose to believe that's because enterprise customers want someone to talk to over the phone.)

Hopeful? In spades, not bought from Home Depot.

<comment><USER7> > Is moving non-digital collusion between big businesses to the Internet > really the best we can achieve?

Unfortunately, yes! Thats because the Internet is just a tool and those who use it (i.e. us) haven't changed fundamentally since the advent of that tool. So why would you expect a tool to achieve a different outcomes?

If you want different outcomes, let's try changing human beings; more specifically, let's devise ways to mitigate greed, envy and jealousy.

</comment></comment></comment></comment><comment><USER8> From the article: "Their amount of concentrated authority resembles the divine right of kings"

Call me when Apple starts exercising prima noctis. I'm pretty sure Google can't wage war, either, and if Oracle could hang you for theft they would've done so by now. So unless I'm missing something maybe we should lay off the hyperbole a bit?

<comment><USER9> Yes, but they work closely with government - and moreover government intelligence agencies - so government can leverage their help to do these things. There's plenty of evidence this has already happened.

<comment><USER10> [Citation Needed]. Extraordinary claims require extraordinary evidence.

<comment><USER11> [https://en.wikipedia.org/wiki/PRISM_(surveillance_program)](https://en.wikipedia.org/wiki/PRISM_\(surveillance_program\))

<comment><USER9> See project veritas and wikileaks as well.

</comment></comment></comment></comment></comment><comment><USER12> > _Ross Baird, president of the venture capital firm Village Capital, noted > that when ProPublica[click-through link] tried last month to buy targeted > ads for "Jew haters" on Facebook, the platform did not question whether this > was a bad idea — it asked the buyers how they would like to pay._

Clicking through to read that article[1], it's clear that the categories were created by an algorithm rather than a human, and when reported, were removed without fuss. The way the main article phrases it is highly misleading.

The click-through article also says that while "Jew Haters" was a group that could be selected, it was too small to buy a targetted Facebook ad for by itself. They added a few more 'jew-hating' categories, and a few 'Hitler' categories, and the target demographic was _still_ too small. So they ended up adding the category for a small extremist political party in Germany. At this point, the target demographic was big enough to allow them to buy a $30 ad.

Painting this as "Facebook is facilitating the rise of antisemitism just for a buck" is _extraordinarily_ disingenuous.

[1] [https://www.propublica.org/article/facebook-enabled- advertis...](https://www.propublica.org/article/facebook-enabled-advertisers- to-reach-jew-haters)

<comment><USER13> _the categories were created by an algorithm rather than a human, and when reported, were removed without fuss._

I think that's the point:

a) Automatic categorization means offensive categories will be created

b) It takes a complaint to have them removed.

 _The click-through article also says that while "Jew Haters" was a group that could be selected, it was too small to buy a targetted Facebook ad for by itself. They added a few more 'jew-hating' categories, and a few 'Hitler' categories, and the target demographic was still too small._

It is unclear to me why the fact that this particular phrase was too small to buy for means it isn't a problem. The fact is you can target ads based on it, even though currently you also need to buy other groups.

Additionally:

 _The Daily Beast, which briefly ran its own ad campaign to test the company's tools, says Twitter's platform shows 18.6 million accounts "likely" to engage with the word "Nazi," while another 14.5 million users might be drawn in by the N-word. For Twitter, the process seems entirely automated and there appear to be no safeguards in place — The Daily Beast tried a number of different hateful words and phrases and none were blacklisted by Twitter's tools._

[https://www.theverge.com/2017/9/15/16316352/google- twitter-a...](https://www.theverge.com/2017/9/15/16316352/google-twitter-ad- targeting-anti-semitism-racism-facebook)

<comment><USER14> > The Daily Beast, which briefly ran its own ad campaign to test the company's > tools, says Twitter's platform shows 18.6 million accounts "likely" to > engage with the word "Nazi," while another 14.5 million users might be drawn > in by the N-word.

Keep in mind that "engage with" includes everyone who takes offense to them.

> Automatic categorization means offensive categories will be created

This is like saying that an automatic printing press means offensive literature will be created. And rope causes lynchings.

Someone said this in another thread -- "algorithms" are the new "chemicals".

The most absurd part of this isn't that people are astounded that generic tools can be used for specific evils, which has been happening for many years. It's that people seem to _want_ corporations the likes of Facebook to be in charge of making political decisions.

<comment><USER13> It's interesting. On the "Our minds can be addicted" story the HN consensus seems to be 'yes and it is a problem'. See [https://news.ycombinator.com/item?id=15421704](https://news.ycombinator.com/item?id=15421704)

Yet transfer the same issue to this context and it suddenly becomes a free speech thing.

<comment><USER14> Because it's two sides to the same coin. The problem isn't which decision Facebook makes. It's that Facebook, like governments, should not be in charge of this.

<comment><USER13> So who should be in charge of it?

<comment><USER14> Nobody is supposed to be in charge of it. A central planning commission is not a thing that should exist.

<comment><USER13> I guess the point is that Facebook has a responsibility to stop this proactively, not just make money off it until someone complains.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER15> >"[...] Russian interference"

The amount of cognitive dissonance and double think one must embrace to read, not an op-ed, but news article in the NYT.(1)

I don't even support Trump; I oppose him, but I'm not willing to indulge in the groupthink here. Maybe there was interference, probably even, but how can we be sure when the stories we are being fed keep falling apart? Just another in a long string of "just trust us" claims from the Deep State?

1 - [https://theintercept.com/2017/09/28/yet-another-major- russia...](https://theintercept.com/2017/09/28/yet-another-major-russia-story- falls-apart-is-skepticism-permissible-yet/)

<comment><USER16> You don't support Trump, but you're willing to swallow the notion that the United States has a "deep state" unironically? Come on. Go find me the mukhabarat or other secret police in the USA.

<comment><USER17> "Deep State" is another name for bureaucracy. Bureaucracy is a state within a state and its main purpose is to protect itself.

[https://www.youtube.com/watch?v=VveTsyjFlNA](https://www.youtube.com/watch?v=VveTsyjFlNA)

</comment></comment></comment><comment><USER18> Why can't Tech Giants just deliver, you know ... tech?

Why do they need their prying eyes on our data?

In the old days of the internet, companies provided the hardware, and universities designed the protocols (which were federated), and ran the software.

<comment><USER19> It seems their tech doesn't pay their bills quite as well as advertising?

<comment><USER20> It certainly doesn't help when people don't give a shit.

Billions use the service that Facebook and Google provide without much of a care about how their data may or may not be used.

It's hard for me to blame Google/Facebook when we voluntarily sold our information to them and continue to do.

</comment></comment></comment><comment><USER21> Captains of industry become robber barons. The same thing happened with Microsoft, AOL, and Oracle.

<comment><USER22> How AOL?

<comment><USER23> That's a pretty far reach re AOL.... However, AOL went from being a small, scrappy upstart service provider to being the 800 pound gorilla that wielded increasingly significant media power, in just the span of 5-7 years. One moment they were subservient to the classic media powers, smaller than a mid- size magazine publisher. The next, they were lording over the media powers as a larger, potentially more powerful corporation worth $220 billion with tens of millions of subscribers (and it sure looked like they were going to get much larger). In the media world, AOL was just starting to become as feared as Microsoft was broadly when they purchased Time Warner. That completely shook the media landscape. This is mostly forgotten now, because that position lasted for only a few years. AOL at its peak, was starting to near Microsoft's financial position circa 1995-1996 or so. Their stock went from $7 to $175 in two years from 1997 to 1999. Their revenue went from $425 million in 1995, to $4.77 billion four years later ($762m in net income, with $1.1b in cash from operations) - nearly unbelievable growth for anything consumer Internet related at the time. Just as they arrived at burgeoning juggernaut status, it all began to unravel.

<comment><USER24> Not entirely related, but to comment on how big AOL was: I once heard that AOL sent out so many CDs that more than 90% of all CDs being produced in _the world_ were for AOL

<comment><USER25> There was a period in the late 90s where every other box of cereal had an AOL CD taped to the box.

</comment></comment></comment></comment></comment><comment><USER26> I was hesitant to trust a direct competitor of the Tech "giants" about how dangerous they are.

But ten minutes ago, the Google app store recommended that I install Firefox Focus that is a direct competitor of Chrome and that, by blocking ads, may hurt Google main source of incomes. Beat that, non-tech giants!

</comment><comment><USER27> All centralized power structures will transform into threats. The future of information technology will be in decentralization/anonymity... not centralization and always-public models.

<comment><USER28> _The future of information technology will be in decentralization /anonymity..._

That's what they promised us back then: "The Net interprets censorship as damage and routes around it." Now, instead of Usenet we have Reddit, instead of email we have Google and Microsoft, and instead of bookstores we have Amazon. Even Bitcoin is centralized.

<comment><USER29> How is BTC centralized? Someone did decent research on this: [https://news.21.co/quantifying- decentralization-e39db233c28e](https://news.21.co/quantifying- decentralization-e39db233c28e)

<comment><USER30> You can get people representing >50% global mining power in the same, small room.

</comment></comment></comment></comment><comment><USER31> Nytimes sure is posting a lot of literature talking smack about SV

</comment><comment><USER32> Pyramid schemes?

</comment><comment><USER33> and their use is purely optional.

<comment><USER9> I don't understand why so many people feel the need to chime into conversations with these types of comments.

"There's lots of rapes in these neighborhoods at night" \-- well women don't need to be wearing suggestive clothes or walking around without males

"There is illegal surveillance" \-- well I don't have anything to hide

"There are a bunch of companies who are arguably degrading the fabric of society" \-- that's not my experience

"A problem exists" \-- it doesn't apply to every person

<comment><USER34> People who organize self-righteous outrage mobs to ban whatever is "degrading the fabric of society" this week have a habit of doing more damage to society than whatever it was you thought you were protecting it from.

When self-righteous outrage mobs believe they have moral authority and are drumming up support for authoritarian interventions is when it's _most_ important to challenge them forcefully. Even if an intervention is necessary in the end, it should be the product of a healthy debate and not an outrage mob railroading through its initial whims.

<comment><USER35> How is "but it's optional" a forceful challenge or a healthy debate?

<comment><USER34> It isn't - it's lazy and inarticulate - but pokemongoaway is complaining about the general theme of people challenging the scope or severity of a problem.

There is a pretty significant difference between "$villian is doing $bad_thing to people" and "$villian is providing people the option to do $bad_thing to themselves and they are taking it." That's worth pointing out, particularly when $bad_thing is to read opposition news.

<comment><USER35> It's nowhere near that clear cut.

[http://www.radiohamburg.de/Nachrichten/Deutschland-und- die-W...](http://www.radiohamburg.de/Nachrichten/Deutschland-und-die- Welt/Panorama/2017/Oktober/Es-ist-wieder-soweit-Langenscheidt-kuert-das- Jugendwort-2017)

One of the "unwords" nominated for 2017 is "sozialtot". That's "socially dead" as a synonym for not having a Facebook account. As for Google, when everybody has their email at google I can craft my packets by hand, Google will still slurp them up. But oh, it's all optional, that goes without saying so it has to be said all the damn time.

> particularly when $bad_thing is to read opposition news.

You don't even know if "and their use is purely optional." refers to even one word more than the headline. If it does, you don't get to pick and chose that conveniently. The article also contains sentences such as

> All of them are making decisions about who gets a digital megaphone and who > should be unplugged from the web.

Where does people doing something to themselves even figure into that? We're still at that part where someone blamed the victim and you're contorting to excuse that as something noble at heart, if lazy and inarticulate.</comment></comment></comment></comment></comment></comment>


Prince Andrew and Jeffrey Epstein Full Interview - BBC Newsnight - sahin-boydas https://www.youtube.com/watch?v=AKQi3wzNFGQ&feature=youtu.be <comment><AUTHOR> This is off topic for HN. Have you read the site guidelines recently?

[https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)

<comment><USER2> "Off-Topic: Most stories about politics, or crime, or sports, unless they're evidence of some interesting new phenomenon."

Yet the story about the NBA executive stealing money fails all three strikes and it's at 120 points and going strong...

<comment><AUTHOR> I don't know if it's a new phenomenon but there's enough interesting detail in that story to make it on topic for HN, in my opinion, plus the thread quality supports that interpretation. Of course these are all judgment calls.

Prince Andrew on Epstein is guaranteed to produce a flamewar, especially because it overlaps with the celebrity gossip genre.

Epstein stories have been discussed in detail on HN ([https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...](https://hn.algolia.com/?dateRange=all&page=0&prefix=true&query=epstein%20points%3E10&sort=byDate&type=story)), and "royal denies wrongdoing" is not significant new information: [https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...](https://hn.algolia.com/?dateRange=all&page=0&prefix=false&query=%22significant%20new%20information%22&sort=byDate&type=comment)

<comment> sahin-boydas You have 100% bias here.

This video pretty is interesting. It reached 700k views in youtube in very short time. It is also very unique. Maybe it is not interesting to a fan of Epstein. The interview has elements that no interview until now has. Ex watch btw 19-25:00. They are way less non interesting links about Epstein that you didnt flag.

2) Also u block this video way faster than you can watch the whole interview. Did you watch the full interview before flag this link? Without watching the whole interview how you can decide it is not good enough.

Just leave it to the hn community . unflag the video lets see how community responds...

<comment><AUTHOR> If YouTube views mattered here, Pewdiepie would be on the front page. Please read the site guidelines: [https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html).

<comment> sahin-boydas Off-Topic: Most stories about politics, or crime, or sports, unless they're evidence of some interesting new phenomenon. Videos of pratfalls or disasters, or cute animal pictures. If they'd cover it on TV news, it's probably off- topic.

Daniel,and yet this interview is the new evidence. And this interview has more interesting parts than many articles that were posted in HN about this subject.

<comment><USER3> "Interesting new phenomenon", not "new evidence [in a mainstream news story about a celebrity scandal]". They're very different concepts.

Dang isn't saying it's not a big/important story; it's just not on-topic for HN. The guidelines are clear and long-established on that.

There's the whole rest of the internet for discussing mainstream news scandals.

</comment></comment></comment></comment></comment></comment></comment><comment> sahin-boydas The Duke of York speaks to Emily Maitlis about his friendship with Jeffrey Epstein and the allegations against him. Subscribe to our channel here: [https://goo.gl/31Q53F](https://goo.gl/31Q53F)

In a world exclusive interview, Newsnight's Emily Maitlis speaks to Prince Andrew, the Duke of York at Buckingham Palace.

For the first time, the Duke addresses in his own words the details of his relationship with convicted sex offender Jeffrey Epstein, who took his own life while awaiting trial on sex-trafficking charges.

In 2015, Prince Andrew was named in court papers as part of a US civil case against Epstein.

The Prince, who is the Queen's third child, also answers questions about the allegations made against him by one of Epstein's victims, and discusses the impact of the scandal on the Royal family and his work.

<comment> sahin-boydas Why is this down voted? This is writing by BBC</comment></comment>


I had five customers sign up on my first day. Healthcare startup - <AUTHOR>

Last week I launched my healthcare startup and had five customers sign up on the first day. I posted ads on craigslist that led to the site along with Google Adwords (one signup from Adwords and four from craigslist). I like the ROI on craigslist a lot more :).
I'm currently mechanical "turking" the backend of the site and finding imaging providers for the patients myself (along with getting a discount for an available slot).
Long of the short, I'm running into this problem. I've plateaued on my customer signups. Does anyone have any good thoughts on how I can find more patients to sign up for this service. If I can prove my hypothesis that patients come to me for high priced medical scans, I'm in business.
Here's the link to my site: www.opendoorio.com <comment><USER2> Your landing page is not good enough. What does the map have to do with anything? What about opendoorio implies medical scanning? I probably wouldn't go get medical imaging from a company called opendoorio. Maybe Open Door Imaging. I also think you should list the type of scans you can help with (this helps with SEO and also give customers an idea what you're talking about) My first question was do you mean xrays or MRIs? If you actually have some customers that were quoted $X price and you got it to them for less than $X price use that as a case study (*results not typical). Have you looked into adwords?

What you're doing is actually fairly common ([http://www.shoemoney.com/2008/11/04/making-money-with- local-...](http://www.shoemoney.com/2008/11/04/making-money-with-local- affiliate-programs))</comment>


Ask HN: Vim/Emacs users, how do you deal with non-qwerty layouts? - <AUTHOR> To all the vim and emacs users, but also any other editor with some sort of keyboard shortcuts, how do you use your editor with non-qwerty layouts?<p>Specifically, for vim, do you press 'i' for insert mode, wherever 'i' is on your layout, or so you map the letter in the qwerty position of 'i' to be your go-to-insert-mode key? Do you use 'ctrl-x ctrl-f' to open a file on emacs with your layout's 'x' and 'f' or the letters in the qwerty 'x' and 'f' position? <comment><USER2> I use the Colemak layout since a couple of weeks back. I'm also using Emacs with Evil mode (i.e. Vim bindings). I have thought about remapping "hjkl" for navigation, but haven't yet done it. Using the Colemak "hjkl" is not _completely_ unnatural, but the habit of the qwerty positions for these characters is pretty deeply rooted.

So no remappings so far.

<comment><USER3> I've been a Colemak Vim user for several years now (5+? Can't remember).

When I started out I remapped the movement keys to give a more qwerty like layout. Eventually I decided to revert back to the standard Colemak layout.

The main reason was that I use vi movement keys everywhere that I can and whilst it was possible to remap hjkl in the shell (readline based apps can be remapped via ~/.inputrc) it's IMHO easier to adapt to the standard Colemak placement, then they'll work everywhere you do.

One thing that I do remap is <C-e> which is on home row, to provide a better ':'

map <C-e> : imap <C-e> <esc>:

If you remap anything in Vim you should know what you're loosing. In this case default <C-e> scrolls the screen down by 1 line and I think I can live without that to get to command mode quickly. It makes :w so fast especially when combined with Caps mapped to control and <C-m> as an alternative to the return key (provided as standard by the terminal)

</comment></comment><comment><USER4> Emacs with dvorak is almost more natural than with qwerty. C-x, C-c using the left pinky for control and the right pointer and middle fingers for x and c (respectively) feels much better to me than using the left hand in a chorded arrangement like in qwerty.

There are others though I'd have to think for a bit longer to list them all. In many cases my hands just seem to flow better.

NB: I was a touch typist with QWERTY (got to about 60wpm) before switching to Dvorak (peaked around 120wpm, around 100wpm these days). I do not attribute the increase to Dvorak specifically, but to literally not being able to see what letter I was pressing so I truly become a touch typist.

</comment><comment><USER5> I currently use azerty layout and learned vim on it. There is no big changes compared to qwerty at least for letters.

Qwerty is more reliable for development with more ease to reach special characters.

<comment><AUTHOR> aha. thanks for the answer. so when you do :wq, you press the azerty 'q'?

<comment><USER5> Yes, of course

</comment></comment></comment><comment><USER6> I've been using Dvorak with Emacs for more than ten years. No remapping, the key bindings are fine as they are, in many ways even better than with QWERTY.

</comment><comment><USER7> I type on dvorak and use vim. I've not changed the vim keybindings at all. So when I want to switch to insert mode I hit the "i" key where it is on the dvorak layout. In qwerty terms, I hit the key where "g" would be.

</comment><comment><USER8> All the operating systems, since 1984, have let the user configure his keyboard layout. Therefore since 1984, on all the computers I've used, I've used the US-QWERTY keyboard layout.

Ie. this is a non-problem, solved since 1984.

<comment><AUTHOR> I know. I'm asking more to get some opinions on the choice people made. So only people using non-qwerty should offer answers depending on their use.

</comment></comment><comment><USER9> you can change keyboard language in any OS. as of keycap labels, i couldn't care less about what they are like. developers touch type anyway. it's a non- issue, really</comment>


Why are butterflies colored? (Interference) - <AUTHOR> http://www.webexhibits.org/causesofcolor/15A.html

<comment><USER2> tl;dr: [https://www.youtube.com/watch?v=x4I9mmd-2Rc](https://www.youtube.com/watch?v=x4I9mmd-2Rc)

</comment><comment><USER3> We prefer to be called Butterfly-American.</comment>


Looking for an UI & Graphics Designer - <AUTHOR>

We're an online travel company looking for a designer to join our founding team.
The team is striving to build an Apple version of online travel -- a site that's fun, engaging, and easy to use for oft-dreaded trip-planning.  Really something where the user's process is the focus, not the end goal of booking tickets like most travel sites out there today.  More visual communication, information organized by how relevant it is to how you travel, a push of travel ideas (most sites already expect you to know where you want to go), game-type tools.  We're focused on people our age who have a good enough understanding of technology that they expect more, especially of the travel arena since it's one of the main fun things we do.  Why should that fun only apply to the period on the road only, rather than the whole process of figuring out all the interesting options out there and sharing your travels once you return?
Given our goals, we really want a designer to be part of the founding team to drive this vital piece of our vision.  Right now we are in garage start-up mode and building a demo facebook application as well as the main site prototype.  During this period, we're looking for someone to join us part-time.  The plan is to raise funds after we have those pieces built, so at that point, we'd ideally want all the team members to go full-time.
I think it's a compelling chance to take the reins and build an innovative user-focused product.
If you're interested, email me Christen (at) thumbble.com.  I'll also be at Startup School this Saturday, so give me a tap on the shoulder.
FYI, we are based in SF. Check out our recently started tumblelog (thumbble.tumblr.com).  (But don't break into it.) <comment><USER2> Hi my name is Roger Mettler and I am the managing director of www.travel- here.com. Kindly let me know more about your open position and contact me at firstname.lastname@example.com

</comment><comment><USER2> Hi my name is Roger Mettler and I am the managing director of www.travel- here.com. Kindly let me know more about your open position and contact me at firstname.lastname@example.com

</comment><comment><USER3> "(But don't break into it.)" LOL!</comment>


Box Art Brut: The no-rules design of early computer games box art - <AUTHOR> https://worldwritable.com/box-art-brut-6fad75d971e1 <comment><USER2> All those and no mention of the classic "Forth on the Atari: Learning by Using Forth"? [http://www.globalnerdy.com/2007/09/14/reimagining- programmin...](http://www.globalnerdy.com/2007/09/14/reimagining-programming- book-covers/)

</comment><comment><USER3> I disagree with "no-rules design." As a kid, the one rule was that after seeing the box art, you would be thoroughly disappointed the first time the game loaded and you saw the actual graphics.

<comment><USER4> Heh, the article author seems to point out the same thing!

> And while there were no real rules yet, there was one agreed-upon > convention: graphics were primitive and were never to be shown on the cover.

</comment></comment><comment><USER5> The best "WTF" box art I've stumbled across is for a platformer-ish thing called Extreme: [http://www.worldofspectrum.org/pub/sinclair/games- inlays/e/E...](http://www.worldofspectrum.org/pub/sinclair/games- inlays/e/Extreme_Front.jpg)

You get to play as that guy in the last level, apparently.

</comment><comment><USER6> One of my prized posessions

[http://www.proweb.co.uk/~matt/Elite.jpg](http://www.proweb.co.uk/~matt/Elite.jpg)

I wish I knew it was going to be prized before I didn't take care of it !

<comment><USER7> I've seen the Borg cubes, but I'm glad to see spacecraft built in the shapes of other Platonic solids.

</comment></comment><comment><USER8> I played "Odyssey: The Compleat Apventure" as a grade school kid. Looking back on it, I think the guy at the Pittsburgh computer store was thinking "sucker!" when my dad was checking out with it. It was done using Apple "shape tables" instead of proper sprites, so getting caught in a whirlpool would cause you to "spin" with the very flashy animation consisting of 8 frames. And the ones at 45 degrees were ~sqrt(2) times too large because of how shape table "rotation" worked. (Or didn't work)

</comment><comment><USER9> I've taken up painting in the past few months - digging into art history some and aesthetics, as I try to understand the nature of the thing I have undertaken. It really causes me to reflect on the intertwingling of art and culture; the mentalities that produce an imaginative image and the image giving seeds to the mind.

Perhaps, these are simply images that reflect on the artist's view of what the buying society would appreciate; and thus we can infer a variety of things about the buying society.

</comment><comment><USER10> I might need to commission a repainting of the Computer Foosball box art.

</comment><comment><USER11> How about the 90s, when boxes came in all shapes and sizes. I loved collecting them, and conversely (as I worked retail), I loathed stocking them.

</comment><comment><USER12> Thumbs up for the Lode Runner screens!</comment>