Can Facebook be replaced? Let's invest $100,000 - <AUTHOR> http://calacanis.com/2018/04/20/openbookchallenge/ <comment><USER3> If anyone reading this undertakes this challenge, it would be a mistake for you to focus on privacy despite the recent headlines. The problem is that privacy, something that few people care about (as evidenced by the lack of impact all of this has had on Facebook usage), is not a selling point. People have something that serves their needs for social networking purposes, and that something is Facebook. The only way to beat them is if you offer features that help serve their social networking needs _better_ than Facebook and in a way that is so compelling that it would be worth it for an average user to make the switch.

Most people don't buy a $100K+ Tesla to save on gas or save the planet. People buy them because they are amazing cars. Similarly, people won't switch social networks because you offer better privacy. They'll switch only if you make an amazing social network.

<comment><USER4> Also people are already switching, Facebook degraded itself to a event calender and a lot of social activity wandered off to more closed environments like chat groups which get popular again due to media enabled chats (telegram, Wechat or also Slack and Discord)

IMO trying to replace Facebook is the wrong direction. Seems most people totally forgot that we actually should not care what our ex girlfriends neighbour is eating today and can't imagine a world without a central social network.

IMO we already have more than enough badly done MySpace clones. It's time we put our egos aside and move on

</comment></comment><comment><USER5> It's my opinion that we should try to build a social network on e-mail. The social network is just a new e-mail client or a web front-end looking like the social networks we already know today (Reddit, Facebook, etc.). The challenge is to write a new e-mail client / wrap the back-end such that most people don't realise that they use e-mail.

Of course there are technical challenges like that e-mail is a very old protocol and for some use cases quite a bad fit. But we should have created new standards for e-mail2 instead of creating a plethora of incompatible messaging formats.

I hope that the privacy problems of Facebook is a wake-up call for many people and that we can reclaim e-mail as THE standard for messaging.

<comment><USER4> Email and the associated protocols are a painful nightmare. Nobody in their right mind would build a platform based on a broken protocol.

<comment><USER6> Are they? An application leveraging email for its transport layer could easily use standard email libraries, and social networks are little more than mailing lists with a different interface.

<comment><USER4> I am not aware of any 'standard email' libraries that actually work with the majority of edge cases.

Whatever someone builds around email. It will be full of work arounds and 'temporary hacks'

</comment></comment></comment></comment><comment><USER7> This is the wrong approach, in my opinion. For a product in a relatively new space, getting a good team together and showing traction makes sense. For something like this, it is putting the cart before the horse. To the extreme.

Beyond anything else, what I'd like to see is a plan. And mostly, a plan for cracking the network monopoly that facebook has. Maybe the new thing will start as a "facebook helper" that allows users to easily scrape and manage facebook data, and allows you to post/contribute to multiple networks at once. Eventually it can allow people to transition away from facebook gradually, but in the meantime, it gives you extra power on facebook and most importantly, doesn't dump you in some isolated network where you suddenly have five friends rather than 500.

<comment><USER8> I agree. Likewise, the VC model is part of the problem, including the unreasonable returns they expect - because they're making so many bets, so they don't really have to believe or understand why an investment will succeed; one of the most difficult parts will be putting together the initial team, and then growing the team, which in this situation requires a buffer of money - along with a strong vision being honestly lead, without attempting to bank on hype.

I've been evolving a plan and strategy over the years to address these problems, unfortunately it's all mostly on hold while I try to organize more stem cell injections to heal chronic pain I have; our healthcare systems aren't adequate in dealing with uncommon scenarios either.

</comment></comment><comment><USER8> "What are you looking for?

We don't want to tell you what to build, we want you to come up with your own ideas. Keep in mind, that while ideas really matter, Zuckerberg has shown us, execution matters more."

I think what Mark taught us is that we need to know the person in control before backing them, and their ability to execute (or fuck over the brothers etc) is probably the worst indicator, although is liked by VCs - as well as the idea of "growth at all costs." That helps reduce their own personal risk, offsetting the real cost to the rest of society.

</comment><comment><USER9> Better invest some bucks in open bounties for Diaspora* to close the gap and even to develop useful new features: [https://www.bountysource.com/teams/diaspora](https://www.bountysource.com/teams/diaspora)

</comment><comment><USER10> Admirable enthusiasm, but I beleive this is a legal problem not a software/product one. The network effect can only be broken by fashion or laws requiring completely free movement of users and all their data among competitors for ALL online services.

</comment><comment><AUTHOR> If you want to help, here's the social network plan that has many comments thanks to HN folks:

[https://github.com/joelparkerhenderson/social_network_plan](https://github.com/joelparkerhenderson/social_network_plan)

Comments welcome here or on GitHub or email me firstname.lastname@example.com.

<comment><USER8> I've been thinking through this problem for awhile, 7+ years.

Re: Funding - One I'd add to the list is to lobby government to provide $X annually per citizen that gets allocated to the user's choice to pay for their social network platform of choice; this would have to be tied to specific rules/guidelines. E.g. mandatory tax money that the person distributes how they want. Whether this will lead to the desired outcome, I'm unsure - <USER2> might still just want to give their money to Facebook or a platform who takes that money + still does less-than-good or less-than-desired behaviours, requiring regulation and oversight, costing taxpayers anyway. It might also incentivize private dollars to be more willing to invest in platforms if there's that money per-user that would be available.

Another I'd add or that's not explicitly stated is to create enough value that people - or enough people - are willing to pay; this ties into freemium model or subscription model.

I think the solution is, as you list, is a mix of different funding sources.

Investment should likewise not solely come from the VC model, it should come from a combination of sources: \- From government -- if you can't convince a government to invest, then why not? \- From philanthropic -- who will have a longer horizon than traditional VC, and who will hopefully require a higher burden on evidence that the leader(s) are good people. \- From traditional VC -- who can benefit by reducing risk from the other funding sources, and to leverage the experienced VC's network and resources.

Also, brand names.

Facebook is brandable, Diaspora - I'm still not sure I pronounce it properly. App.net was a good attempt, a little more brandable than Diaspora - at least with technologists, however not necessarily consumer-friendly; their mission and fight, similarly to how Evan from Snapchat pushed back against what was essentially Mark bullying (sell to me or we'll copy you); ~7 years ago I wrote a blog post after Fred Wilson suggested I turn a comment into its own post, related to The Independent Web - and the requirement that that will require sharing, which means not being greedy, and not trying to capture 100% of value; [http://mattamyers.tumblr.com/post/2903098250/the- independent...](http://mattamyers.tumblr.com/post/2903098250/the-independent- web-how-can-it-work)

Another competitive advantage: differentiation. Copying Facebook doesn't give anything to people that they don't otherwise have.

Whenever I see discussion about people creating a competitor to Facebook, they miss out on these two staples - differentiation and branding.

I've been evolving my own ideas and plans, multiple platforms to create an ecosystem, however I've been struggling with chronic pain the last few years - and finding doctors locally to do continue the simple stem cell injections I was getting (and that 100% were healing the pain) has proven difficult due to incompetence in the system; I've come to realize that doctors are selected for their memorization skills (via tests), and not for critical thinking skills. The pain primarily disrupts my executive function and decision making, and so this has lead to me almost being paralyzed - but more unfortunately dependant on other people who haven't been competent or available enough to do the work of finding a willing doctor for me. What confuses people is I can reason and storytell still, not really any decision making required when simply stream of consciousness writing, otherwise I find myself stuck in routine I had before I was introduced to the pain in my body. I can ramble on forever, until mentally exhausted anyhow - and then I ground again slightly to feeling the pain more clearly. Actually I wrote about how I reconnected with the pain in an HN comment yesterday, if curious in a simplified version: [https://news.ycombinator.com/item?id=16894072](https://news.ycombinator.com/item?id=16894072)

The brand name for one of two main platforms I have been evolving my plans for is ENGN, pronounced engine. There's a story of how I evolved to that name, my focus is fading now though, so won't share it now. Randomly writing long comments pretending people will care as a mechanism to give meaning and feel connected to people more than I currently can in real life; I can't really participate in emotional bonds/relationships with emotion as the added stress is another variable to manage with the pressure the pain puts on my system.

I honestly don't know if I will find a doctor to heal the pain within a timely manner - have already been at my wit's end, however I don't want my life's work to disappear, so I have it written to give my domain names, etc to Elon Musk - as he's the only most obvious holistic thinker that wears his heart on his sleeve, and does his best to think through things will affect everyone; the current condition and lack of organization for my plans would likely be describable as a clusterfuck, so the domains and logos may be the only thing really usable for him/the team he'd hopefully put to work if I'm not around to execute on it myself.

Clearly I got a second mental wind, though it's getting cooler outside now and the hunger signal is telling me/directing me to get food now. Thanks for reading, internet stranger, if you got this far.

If I had the focus/concentration and self-direction/executive function ability, I'd go through all of the social network plan repository and comment on it all from my perspective.

<comment><AUTHOR> Thanks Matt! I added your article link and related info to the repo: [https://github.com/joelparkerhenderson/social_network_plan/c...](https://github.com/joelparkerhenderson/social_network_plan/commit/19e7d799c008fb447be4359ed81815a40715addc)

<comment><USER8> Cool.

</comment></comment></comment></comment><comment><USER11> The replacement for Facebook is likely already being used by many people, perhaps even yourself. You just don't know it yet. ;)

<comment><USER12> Agreed. So then what are the _most active_ online communities today that aren't Facebook/Google/Twitter/LinkedIn?

At first cut I think of Telegram, Signal, Discord, Snap, WeChat, Line (East Asia), KakaoTalk (Korea). Maybe HN.

<comment><USER11> Reddit! It's a sleeping giant.

<comment><USER5> No! It's email! See my opinion piece above about e-mail the new social network.

Reddit and other social networks could have been implemented using e-mail as a back-end.

<comment><USER11> You're right! Although email is already more popular than Facebook. ;)

<comment><USER8> So the user defaults to trusting their email host/server for their privacy, data safety, security, etc? And the users who connect to that user (their data will be sent to the email host as well) will need to put their trust in them as well. Is that the only concern?

Have you thought through what the other positives or potential negatives are of using email?

</comment></comment></comment></comment></comment></comment><comment><USER13> There's a bunch of existing Facebook Alternatives. How about putting some of this money into one of those? Improve the migration process and the UI and the non-tech-user-friendliness, on the front and back end - can you get setting up a node on one of these to be as easy as, say, installing Wordpress?

<comment><USER13> (And make it as easy to keep up to date as WordPress, too. My Mastodon instance needs updating but first I have to stare at a Git client and figure out how to merge all my tweaks with the latest version.)

</comment></comment><comment><USER14> There are already tons of Facebook competitors. But most of them miss the point.

For example, Diaspora really misses the mark. You go to their homepage it emphasizes freedom and controlling your data and doesn't once mention the thing people care about in a social network... people.

Most people don't care about privacy except nerds like me and most of you. They care that they can view the latest adorable photos of people kids and pets and message all their friends.

For that point most tech people care about those things too. Which is why, for example, even though I have been aware of Facebooks issues for years I am still on there. My friends and family are there.

The first thing they ask is "can I connect with the people I care about on this site." If the answer is "not yet" then most people won't join.

</comment><comment><USER15> There's already a bunch of vigorous FB alternatives. I'm personally familiar with the Fediverse and Secure Scuttlebutt and they both have a growing and active userbase. Be your own entrepreneur, take some social risk, and join these networks. If you want to spend money finding them, then put up feature bounties, or marketing bounties to make marketing campaigns for these networks.

</comment><comment><USER16> There are lots of models, but getting people to actually switch, that is the issue.

</comment><comment><USER17> 2, 3, and 5 seem to be problems that only occur at scale so it seems odd to focus on solving these in the beginning when the nascent social network wouldn't be big enough to even have a breath of these symptoms.

</comment><comment><USER18> We have been here before, resulting in Diaspora*. What is different this time?

<comment><USER19> Nothing. Replacing Facebook is a perpetual tall poppy fantasy; that was the case before the privacy abuses of the last several years.

I watched the exact same thing obsess the tech world and Silicon Valley in particular, for over a decade, regarding Windows. Windows never got replaced, instead the ground changed under it, an inflection opened up new opportunities (which created nothing more than a duopoly in iOS + Android for two other giants). That's exactly what will happen with Facebook. Five or six years from now, they'll be doing a hundred billion dollars in sales, they'll be larger than ever before, and more profitable than ever before. Some day the ground will shift under them, opening up a big opportunity, and it'll require a technology shift. Then we'll probably just get another tech giant or three dominating the new thing, rinse and repeat. This is all extraordinarily predictable. The easiest thing of all to predict? Decentralization will perpetually continue to fail as a mass-consumer premise. Decentralization is the ultimate tech fantasy, and the greatest demonstration that engineers very often have a poor understanding of typical consumers. Nothing has had more thought & effort put into it, with fewer results to show for it, than decentralization for mass consumer products/services, over the last 15-20 years.

</comment></comment><comment><USER20> The question isn't "can Facebook be replaced" as much as it is "why haven't alternatives already succeeded?"

I'm thinking of Diaspora* in particular.

<comment><AUTHOR> For Diaspora in particular, this archived article goes in depth. "What happened to the Facebook killer? It's complicated." (2012-10-02)

[https://web.archive.org/web/20121009223506/https://motherboa...](https://web.archive.org/web/20121009223506/https://motherboard.vice.com/2012/10/2/what- happened-to-the-facebook-killer-it-s-complicated)

Excerpts:

* The team of four young kids had little real-world programming experience.

* The team found themselves crushed under the weight of expectation.

* The first release, on September 15, 2010 was a public disaster, mainly for its bugs and security holes.

* Google+ imitated Diaspora core features such as circles, and invested lots of money, but still failed.

* The team ran low on money, and VC interested waned.

* Sadly one of team members suicided.

<comment><USER21> here's a direct link:

[https://motherboard.vice.com/en_us/article/pggg3z/what- happe...](https://motherboard.vice.com/en_us/article/pggg3z/what-happened-to- the-facebook-killer-it-s-complicated)

</comment></comment></comment><comment><USER22> Dupe of [https://news.ycombinator.com/item?id=16633986](https://news.ycombinator.com/item?id=16633986)

<comment><USER23> Not really. This was posted 2 days ago where that HN post was 30 days ago. You can't even comments there anymore.

</comment></comment><comment><USER24> There is a group of people in our Open Source community that is getting together to build a Facebook replacement, and mentioned this $100K prize. Open invite to anybody interested in wanting to join their team :) I myself am too busy working on the underlying libraries for it.

None-the-less, here is our progress:

[https://d.tube/#!/v/marknadal/lanz4e6z](https://d.tube/#!/v/marknadal/lanz4e6z) (update 1, idea)

[https://d.tube/#!/v/marknadal/gfqglxvd](https://d.tube/#!/v/marknadal/gfqglxvd) (update 2, accounts)

[https://d.tube/#!/v/marknadal/ganoayt8](https://d.tube/#!/v/marknadal/ganoayt8) (update 3, private messages)

Here is the docs for the End-to-End Encryption library (a wrapper around the Browser's Native WebCrypto API)

[https://github.com/amark/gun/wiki/SEA](https://github.com/amark/gun/wiki/SEA)

<comment><USER25> I think that approaching this as a technical problem isn't the best approach. Unless the business questions are answered (how does one make a billion user social network that makes enough money to keep the servers running without the mess facebook created), the code doesn't really matter that much. Making a social network is easy. Making one that sticks and satisfies this criteria is much harder.

<comment><USER24> Very true, and is kinda a sad reflection of us/me/people-in-general. I still use Facebook, because its easy conveniences outweigh my frustration. :/

So what do we do? SSB is pretty good, and I think the Beaker guys are working on one too. They require you to download/install to your desktop though, which I'm fine with, but I don't think consumers will bother with.

<comment><USER13> They'll probably bother with downloading an app to their phones and tablets, though. Beaker's desktop-only. So's Scuttlebutt. Half the world doesn't even _own_ a desktop.

Get this stuff running on phones. Figure out how to cram a server into a single iOS/Android app along with the client.

</comment></comment></comment></comment><comment><USER26> lol, try _at least_ $100M spread among 10 promising teams before they start coding. Building a better facebook _with traction_ for free to get $100,000 at 6%... This is completely ridiculous.

</comment><comment><USER27> i feel like some sort of mass commitment by potential users to actually use a new site would be much more valuable than any monetary investment. obviously that's a lot harder to bring about.

</comment><comment><USER28> I have nothing interesting to add, other than its interesting and good these conversations are happening.

</comment><comment><USER29> Just donate $100,000 to HackerNews.</comment>


Ask HN: Please advise me on liability insurance and on finding a lawyer - <AUTHOR>

I have a CA single-member LLC through which I perform Ruby / Rails / JavaScript consulting for a couple of clients (income of around $100k / year).  I also run a couple of web properties through the LLC that are based around aggregated content and mashups.  Combined they make about $15k-$20k per year from advertisements.  Finally, I have a couple of new projects in the works, all also through the LLC.
I have recently heard that LLCs don't offer as good liability protection as I had previously thought.  I don't currently have liability insurance.  If I run my LLC responsibly (separate bank account, everything in the company's name, etc.), will it shelter my personal assets in the case of a lawsuit?  Should I have liability insurance, and if so, what kind?  I have liability from consulting, and from my web properties which could be candidates for copyright infringement or deep linking lawsuits, although I haven't had any problems in the four years of their operation thus far, and I run them in good faith.
It seems like I should talk to a lawyer, or at least a good insurance agent.  Does anyone have recommendations on how to find a good, but affordable one?  Any specifics in / around San Francisco? <comment><USER2> You're a busy bee :)

An LLC is not ironclad but enough for most needs, you are getting in to an income range where a full 'inc' is probably smart (tax wise too!).

Talk to a lawyer, but don't be too worried about the insurance unless you are really exposing yourself to a specific liability (such as being responsible for a customers data).

Regular corporate liability insurance should be enough for almost all cases, you may want to add an insurance for corporate legal assistance on to that (in case you ever get sued).

If you want your personal assets to be secure and you are married one simple way is to put all the assets in the name of your spouse (not such a good idea if you ever get divorced...).

The way I found my lawyer while we ran an office in Toronto was to ask friends that also ran businesses in the same town for a good reference.

good luck!</comment>


Dad gets $22,000 data roaming 'shock' from Fido - <AUTHOR> http://www.cbc.ca/news/canada/british-columbia/story/2013/03/01/bc-rogers-roaming.html <comment><USER2> settled for $500, not bad.</comment>


Ask YC: How do I get Started Making Games in Flash? - <AUTHOR>

I've got a couple cool ideas for simple web games.  How do I get started learning to code them up?
I'm a strong programmer, just never used Flash before.
One idea I have if you're curious is you're a local Police director and you have to set up speed traps and cameras to make the most revenue.  Sim Speed Trap? <comment><USER2> I'm currently working on a flash game of my own. I didn't want to pay $700 for CS3 (or even $250 for flex builder,) so I'm doing so using only free tools.

The flex SDK is located here: <http://www.adobe.com/products/flex/sdk/> It looks like the documentation there is quite good, though admittedly I haven't used it much. Any text editor would be fine; I am currently using SciTE with these options files: <http://arthurdick.com/projects/as3/>

Regarding graphical stuff, SVG graphics can be embedded [http://livedocs.adobe.com/flex/201/html/wwhelp/wwhimpl/commo...](http://livedocs.adobe.com/flex/201/html/wwhelp/wwhimpl/common/html/wwhelp.htm?context=LiveDocs_Book_Parts&file=embed_082_6.html)

I haven't attempted any complex graphics creation yet, but one program I'm looking into is Inkscape: <http://www.inkscape.org/>

I'd highly recommend the Tweener class for animations. I only recently discovered it, and it has made my life much easier: <http://code.google.com/p/tweener/>

<comment><AUTHOR> What tools are you using exactly? What generates the flash files?

..Actually maybe start over at the begininng :-) I have no idea how flash works or how one makes it.

<comment><USER2> The flex sdk contains a program called mxmlc, which is what I use to compile actionscript into the flash swf files. I did a search for an introductory guide, and found one I remember from when I was starting out. It's for the Windows version of flex, but I think it's pretty obvious what needs to be modified if you are using a different OS. <http://www.senocular.com/flash/tutorials/as3withmxmlc/>

</comment></comment></comment><comment><USER3> From my experience so far doing <http://www.rocksolidarcade.com>

A few people in this thread have said to, but do NOT buy Flash. Trust me on this. If you're a programmer, you won't be able to use the IDE - it's just not up to scratch. It's great for doing animation and such, but for structured code writing games more significant than pong, you'll want to use Flex.

The Adobe Flex IDE is pretty cool, however, the new version which I feel is worth getting is still in beta. Flashdevelop is fine for the most part. Flashdevelop + Flex is all you need to create .swf files.

<comment><AUTHOR> So you recommend I start with FlashDevelop? I'd prefer to develop on Linux though, is there a linux alternative? Maybe Scite + flex like Riffplay mentioned?

<comment><USER3> Oh, definitely - I'm just saying Flex is the way to go, any editor (that you like) will do. I use Flash Develop but I'm (increasingly) neutral on that. :)

Though you might want to try Adobe's Flex Builder alpha on Linux. The Windows version was rock solid, but apparently the Linux version is further behind (I haven't tried it on Linux). It's based on Eclipse so it's a memory hog (slightly uncomfortable even on my c2d 3.16ghz + 4gb), but the debugger, profiler, visual editing tools etc are top notch.

<http://labs.adobe.com/technologies/flex/flexbuilder_linux/>

Since it just uses the command line compiler, you can migrate to another editor when it gets released non free (or buy it).

</comment></comment></comment><comment><USER4> At the risk of stating the obvious:

1\. Obtain Adobe Flash CS3.

2\. Pick up a couple books like _Adobe Flash CS3 Professional Classroom in a Book_ and _ActionScript 3.0 Game Programming University_.

3\. Read, learn the Flash time line paradigm, and experiment with the examples in the book.

4\. Code, test, and distribute your new Flash creation.

5\. Profit!

<comment><AUTHOR> Obvious is what I'm looking for. That and tips the YC crowd has learned.

</comment></comment><comment><USER5> I'd take a look at Flex and BlazeDS- They're two OSS releases from Adobe (Form. Macromedia) that allow you to come at Flash development using a traditional IDE (Eclipse) rather than the animation-style timeline that the Flash MX environment uses by default.

Flex and BlazeDS are free and Open Source, and worth a look.

<comment><AUTHOR> So I don't need to buy CS3?

Can you still do graphical stuff with those environments, EG animated cars, etc for my speedtrap game.

<comment><USER6> Flex is for data, Flash is for graphics. (I haven't tried Flex.)

You're going to need a way to create the graphical assets for your application, and as far as I know that means Flash - especially if you want vector graphics.

The Flex SDK is free, but you have to pay for the GUI builder.

I tried going "completely" open-source last year for a project with the FAMES (osflash.org) stack. It was a pain, but it had its benefits (mainly an actual IDE). It was still just for ActionScript, too - need flash for any kind of remotely complex graphics.

</comment></comment></comment><comment><USER7> You need CS3, unfortunately.

You can try to do it with free tools (I did) but your game will ultimately be second-rate.

<comment><AUTHOR> How do you mean? What happened to you?

</comment></comment><comment><USER8> The Flash IDE is very important on setting up graphics properly. There is a lot of functionality to be gained from the timeline. Program in whatever you want: Flex, FlashDevelop, Eclipse + FDT plugin etc, but you still want your symbols in the library to be able to be accessed and updated/edited easily.

Flash developers know quite a few tricks to get stuff to act as intended, so I would highly recommend a book on flash game design. I read one a few years back and it helped a lot with the intricacies.

</comment><comment><USER9> \- Get CS3. You would waste more time figuring out how to get the stuff done using free tools. Plus you might not be able to avail use of adobe's help lists/groups. Your time is valuable.

\- Instead of trying to create from scratch, get .swf/.as files for some free/open source flash game and hack your way through. With your strong coding skills, it would be a lot easier to hack through an existing piece of code.

</comment><comment><USER10> If you are a strong programmer, go with Flex Builder trial, later you can ditch it for a basic text editor like Textmate and use the command-line compiler.

Dive into some Flash Game Programming books and Actionscript 3 books and look at free tutorials online.

The thing you'll have to figure out is what tool to draw your "sprites".

</comment><comment><USER11> If you do want to play with free tools, try haXe and swfmill.</comment>


Why fake news is so darn shareable and facts so hard to believe - <AUTHOR> https://medium.com/@ipsita/trust-in-news-3c9afc15d3a1 <comment><USER2> Paywalled. Oh, the irony.</comment>


How to travel from China to Taiwan using Google Map - <AUTHOR>

1. Open Google Maps
2. Click "Get directions"
3. Type "China" as your starting point
4. Type "Taiwan" as your destination.
5. Read step 48(Warning:not everyone can follow this step)
LOL! <comment><USER2> New York to Paris is the classic one. They took it down though (big frowny face)</comment>


Let's Encrypt Overview - <AUTHOR> http://www.cryptologie.net/article/274/lets-encrypt-overview/ <comment><USER2> FYI, if you don't want to install the official Let's Encrypt client on your production server, I created a simple python script that will automate the ACME process for you. It doesn't have to run on your server, and it doesn't ask for your private keys.

[https://github.com/diafygi/letsencrypt- nosudo](https://github.com/diafygi/letsencrypt-nosudo)

The only thing that has to be run as sudo on your production server is a simple python one-liner that temporarily serves the required file. The script prints out this one-liner so you can copy and paste it into your server's terminal, then kill it when the challenge is done.

<comment><USER3> How is this different from/superior to Let's Encrypt's built-in "standalone authenticator"? [0]

[0] [https://github.com/letsencrypt/lets-encrypt- preview/blob/mas...](https://github.com/letsencrypt/lets-encrypt- preview/blob/master/letsencrypt/plugins/standalone/authenticator.py)

<comment><USER2> The standalone authenticator still requires (1) installing/running the letsencrypt client on your production server, (2) letting it run as root, and (3) letting it access your private keys. My script requires none of these things.

</comment></comment></comment><comment><USER4> This is a lovely and very clear summary!

Two notes, which I also sent to the author:

* Renewal does work already, it's just not documented anywhere. There is a script that can check when your cert is a specified amount of time from expiry, get a new cert, and subsequently deploy the new cert by updating symlinks. This mechanism works now, if the script is run from cron.

* You can use the client on a machine that doesn't have Nginx or Apache, it just won't be able to _install_ the resulting cert. But the client's standalone mode can obtain the cert and save the associated files in the current directory. (In this case, they also won't be enrolled for automated renewal by the renewer script.)

<comment><USER5> How would it work on for instance App Engine, where you can't really run a script on the server? I guess you'd have to manually do the validation step, but will it do any of the other steps automatically still?

<comment><USER4> Depending on the nature of the control that you have over the site, you might need to get the hosting provider to do it for you (some of them are probably going to integrate Let's Encrypt) or you might be able to make the changes manually to prove control of the domain.

If people think of useful integration features for particular platforms, we can take patches, or those platform developers can write their own clients. :-)

</comment></comment></comment><comment><USER6> >One of the common one is to upload a certain file at a certain address of that domain.

I wonder if this can be socially engineered/tricked to gain a certificate for someone else's domain. Like, I've seen at least one service (Majestic Seo) that asks you to upload a document to your domain to get certain services. Now that this (will soon) exist, any such service that someone uses can generate a cert and MITM the site.

Also, if they're verifying over http, couldn't _anyone_ just mitm the verify connection? Well, anyone with access to any computer along the route between Let's Encrypt and whatever domain they want.

<comment><USER7> I guess that's why they will probably not use HTTP for the verification. Why would they? The client already generated a certificate and sent it to Let's Encrypt, they can already use TLS.

<comment><USER6> But you don't know that this is the client. If all you're trusting is the cert they already generated, how do you know it's not an attacker?

<comment><USER7> You're right, I did not think this through…

</comment></comment></comment></comment><comment><USER8> Question: is the X.509 system set up in such a way that one of these issuers could give me a _free_ code-signing cert, or a _free_ CA cert for signing client certificates?

Because, as far as I understand, the answer is no: signing certs have no sense of signing "for an origin". If a CA issued me a CA cert, I could use it to create a signed cert for microsoft.com. Which seems nonsensical.

All I want is to get issued a CA cert that lets me sign arbitrary things _within my domain 's scope_. Basically, the X.509 equivalent of a DNS NS record, delegating responsibility for making assertions about that domain (and only that domain) to "my" CA. Why is that so hard?

<comment><USER9> _> Why is that so hard?_

It's hard because for the longest time (e.g. between 1995 and about 2010) nobody really cared about SSL. It was a box you ticked when implementing a login form or a credit card purchase page. So the infrastructure was neglected, progress was lethargic and generally everything bitrotted.

This can be seen quite clearly in the state of OpenSSL, in the number of exploits in TLS stacks that started appearing in recent years once academic attention was focused on them, etc.

The feature you want is called name constraints and for the longest time was not really implemented anywhere. So that's why CAs don't do it. Also: this would be a highly niche feature and CAs, like any businesses, weigh up implementation cost vs potential market size and risk when choosing what to support.

That doesn't mean it will never happen. It could, now there's a lot more focus on the SSL infrastructure in the wake of Snowden.

<comment><USER10> Also, openssl didn't (or doesn't) appear to care about high-reliability software engineering and the IETF TLS Working Group didn't care about producing a minimum-featured spec that is not overly difficult to implement, maintain and support in the real world. Instead, TLS has become a kitchen- sink, feature-hoarding, experiment-in-production jambalaya.

</comment></comment></comment><comment><USER11> I love that the author of this article actually got out a pen and paper, drew out that diagram and photographed it. Great summary, looking forward to using this service!

<comment><USER10> Give it a few minutes, someone will make an OCR to ASCII art app.

</comment></comment><comment><USER12> Does anyone know when exactly it will be released? It says Mid-2015, and it's almost past that.

<comment><USER13> I'm really excited about this project, but a lack of steady updates and communication on release date are really hurting it. Hopefully they release soon and make this a moot point.

<comment><AUTHOR> They just released a blog post about generating the certs. That means they are getting their. From looking at the code they have most of it in place, they just lack a few features, and testing. IMO it shouldn't take too long now. The first commits date from october of last year.

</comment></comment></comment><comment><USER14> We are desperately looking forward to this being available so we can SSL all our dev sites and still be able to test them on our phones (which are a bit hard to get one's own CA cert onto).

<comment><USER15> It sounds like Lets Encrypt is going to require a site to be publicly available for them to give out a cert for it. They'll tell you to put a certain file at a certain location to demonstrate that you control the domain.

So unfortunately it'll only help with your dev sites if they're available on the public internet.

<comment><USER16> No, that is only one of the _four_ methods of proving domain ownership; see the ACME protocol specification:

[https://letsencrypt.github.io/acme- spec/#rfc.section.6](https://letsencrypt.github.io/acme-spec/#rfc.section.6)

<comment><USER4> However, the methods described there that don't involve a domain validation step all specify prior ACME usage; that is to say that at least the first time you get a cert from an ACME CA with policies akin to those described here, you must always complete a DV step with DVSNI or Simple HTTP (which do require a publicly-visible server with a publicly-visible domain name).

<comment><USER16> What about the method in section 6.4: DNS? That certainly does _not_ require either a prior ACME usage or a publicly-visible server.

<comment><USER4> That's a good point.

I don't expect the Let's Encrypt CA will be willing to help keep servers (or certs issued to them) a secret -- for example, the certs are likely to be published in Certificate Transparency! -- but you're right that the ACME DNS challenge doesn't require the server to be publicly accessible and doesn't even require the underlying subject name to exist in the publicly-visible DNS.

</comment></comment></comment></comment></comment></comment><comment><USER17> Interesting but will there be a way to generate the certs and download them myself versus running an application as root on my servers? I would much prefer not to run their application as root on my servers :)

<comment><USER12> Alternatively, it could have a non-sudo mode that would give you the certs and configs in a directory and tell you where to copy them (or generate a simple, five-line bash script to copy them).

<comment><AUTHOR> [https://github.com/diafygi/letsencrypt- nosudo](https://github.com/diafygi/letsencrypt-nosudo)

<comment><USER12> Very nice!

</comment></comment></comment></comment><comment><USER18> I'm a bit confused on the issue of certs because I've heard that they don't work for subdomains, so can anyone tell me:

If I get a cert from someone like letsencrypt for a domain I control, for example "xyz.com", will that same cert also work for "wiki.xyz.com", "blog.xyz.com", "someotherthing.deepdomain.xyz.com" and so on?

I'm interested because I use jwilder/nginx-proxy and then have a docker container for each of my webapps, each connected to a different subdomain (video, music, rss, vm, desktop, files, etc).

<comment><USER3> There are several ways to resolve this issue:

1\. Get a separate certificate for each subdomain. Let's Encrypt makes this feasible since the certs are free and require a minimum of human overhead to obtain.

2\. Get a single certificate that covers each subdomain by using Subject Alternative Names, which are currently supported by Let's Encrypt.

3\. Get a wildcard certificate for "*.xyz.com". Let's Encrypt does not support this and I do not think it plans to, at least not in the initial release.

The main question is - is the set of subdomains known before-hand, or is it highly dynamic? If it is fairly stable, then options 1 or 2 will work well for you; otherwise, you probably want option 3.

Choosing between option 1 and 2 usually depends on the details of your infrastructure and your threat model. For example, are all these subdomains served from the same server or different servers? If it's the same server, you might be more inclined to use 1 cert for all of them (option 2) since it will be easier to manage. Do all the domains have the same threat model? For example, what if you run blog.xyz.com on one server and billing.xyz.com on a separate, hardened server. In that case, you would want option 1 because if you used the same cert on both servers, obtaining the private key from the less-secured blog.xyz.com server could be used to attack traffic for billing.xyz.com.

<comment><USER18> This is just for my home system, so that I can access everything via https without that annoying ssl cert warning. It's all run from a single server in the closet. I have an nginx instance facing outside, with http redirecting to https, and then each individual app accessed based on what subdomain you used (rss.xyz.com to get to my rss reader, vm.xyz.com to access my virtual machine management console, etc). At the moment I have 7 webapps running, and am in the process of adding an 8th.

The subdomains are somewhat dynamic, since I'll add more whenever I add a new webapp to the server.

<comment><USER3> In that case, sounds like you probably want a wildcard. Also, if this is just your home system and you are the only person who needs access to these machines, why not use a VPN instead? Makes more logical sense, easier to configure, and you can do more than just webapps.

<comment><USER18> Oh I have a VPN set up already. This is mostly so that I can access certain things from, say, a friend's media center or computer.

</comment></comment></comment></comment></comment><comment><USER13> I saw in an earlier thread that wildcard certs won't be supported at first, but possibly in the future. An additional comment was made that wildcard certs wouldn't be necessary once the cert issuing/renewal process is automated.

My question is: wouldn't wildcard certs be faster if the behavior on your site skipped around different subdomains? One certificate for all vs individual certs for each subdomain. I may be way off, I'm a novice when it comes to SSL/TLS handshake so please correct my ignorance.

<comment><USER8> Maybe the question is wildcard vs SAN certs. With automated cert issuing/renewal, they could theoretically talk to e.g. Cloudflare's API to get your DNS records, if you're with them, and then regenerate a new SAN cert containing exactly the subdomains you really have whenever that list of subdomains changes. Which is _probably_ more secure in some way I don't understand.

You're right about the "just using a bunch of separate certs" solution being slower, though, especially with HTTP/2 (which, because of origin combining, uses exactly one real socket _per TLS cert_.)

</comment></comment><comment><USER19> This is a really useful breakdown of Let's Encrypt and its scripted process for procuring certificates. It's ironic though that cryptologie.net is not run over https! They should use Let's Encrypt.

<comment><USER6> [https://www.cryptologie.net/article/274/lets-encrypt- overvie...](https://www.cryptologie.net/article/274/lets-encrypt-overview/)

They should use HSTS and redirects, though.

</comment></comment><comment><USER20> It would be nice if they offered certificates for S/MIME signing + encryption too.

Edit: sed "s#g/e#g + e#g"

<comment><USER21> It took me a moment to realise that wasn't a sed command replacing "MIME signing"(???) with "encryption".

<comment><USER20> Ha! I didn't even notice that as I was typing!

</comment></comment></comment><comment><USER13> Good question from the page's comments- will this work for different sites run on one server? I'm thinking of all my side projects that have sites up, they're all run off the same $9/month Apache server. Can I get individual certs for each domain run off the server?

<comment><USER22> Yep, that should work fine. You'll just need to do the validation process for each domain.

</comment></comment><comment><USER23> Does anybody know how this handles multiple domains and multiple domains on one IP?

<comment><USER4> You can get certs that are valid for multiple domains, using subjectAltName (SAN). The client can request multiple names at once and the resulting cert will be valid for each.

</comment></comment><comment><USER24> Has anyone tried a ruby client library implementation yet? I've looked at the spec and it's pretty complicated. I'm not sure I'll have the time to devote to it unfortunately.

<comment><USER12> Why rewrite it? What's wrong with the current implementation?

<comment><USER24> The current implementation is fine for people running nginx servers with a single domain, but for anyone trying to engineer this via a web application for more than one domain, this is not sufficient for proper tooling.

<comment><USER12> Oh, you mean an actual gem? I see. I hope the current implementation is importable from Python, as well.

<comment><USER24> This python script is informative:

[https://github.com/diafygi/letsencrypt- nosudo/blob/master/si...](https://github.com/diafygi/letsencrypt- nosudo/blob/master/sign_csr.py)

A good start for trying to figure out the workflow.

</comment></comment></comment></comment></comment><comment><USER25> Can someone explain why the CSR is exchanged over https? The whole point of a CSR is that an adversary can't fake it and get a key that works for you and the adversary.

<comment><USER26> The CSR is signed by the key that is going to be used for HTTPS on the website requesting a certificate. If the CSR wasn't transmitted over HTTPS, since the Let's Encrypt CA has no idea what your key is, a network adversary could replace your CSR with one containing an attacker-controlled key.

</comment></comment><comment><USER27> So now that you can even get EV certs for free, what does this mean for the SSL Cert industry? Are they quaking at the knees or do they not care?

<comment><USER28> This github issue explains why they won't deliver EV certs : [https://github.com/letsencrypt/lets-encrypt- preview/issues/3...](https://github.com/letsencrypt/lets-encrypt- preview/issues/342)

</comment></comment><comment><USER29> As I understand they use HSM for signing certificates. What will be if they destroy HSM? How they can continue to operate?

<comment><USER30> HSMs can typically duplicate keys to other HSMs (though usually only other HSMs from the same vendor). All of the Let's Encrypt private keys are stored on multiple HSMs.

<comment><USER31> Anyone know what HSM vendor they are using?</comment></comment></comment>


Dumb people don't know they are dumb. Is there a simple explanation for this? - <AUTHOR> http://www.overcomingbias.com/2008/11/all-are-unaware.html

<comment><USER2> Always run your web app past the dumbest person you can find (or a few).

As DA once said:

"never understimate the ingenuity of complete fools"

They will find errors, bugs and dead-ends that would never have occured to you (or your semi-savvy testers) in a month of Sundays :)

<comment><USER3> I'm a crass elitist and I'm not sure you want to accomodote complete fools in all situations.

<comment><USER2> Of course you do - maybe not as end users... but it a fool (sic) can use your app then anyone can.

Rule 1 :)

</comment></comment></comment><comment><USER4> Dunning-Krueger's findings are, unfortunately, overly generalized (perhaps because people overestimate their abilities to accurately draw inferences). In fact, the bias exists for very smart people as well: Dunning found that 94% of professors consider themselves above-average.

Re breily: compared to other professors. (thanks!)

<comment><USER5> Above-average compared to other professors or compared to the general population? I haven't read anything about their findings but I'd imagine 94% being above average compared to the general population would be on the low side.

<comment><USER6> Compared to other profs. From his homepage:

"First I am interested in why people tend to have overly favorable and objectively indefensible views of their own abilities, talents, and moral character. For example, a full 94% of college professors state that they do "above average" work, although it is statistically impossible for virtually everybody to be above average."

<http://www.psych.cornell.edu/people/Faculty/dad6>

<comment><USER7> -1000, 100, 100, 100, 100, 100, 100, 100, 100, 100, 100

average of entries 0, 10 of 11 entries above average

I'll bet that the typical college prof believes that a small fraction of her "peers" rate -1000 or worse.

<comment><USER8> "above average" in this context usually means median, not mean - i.e. "in the top 50%"

</comment></comment></comment></comment></comment><comment><USER9> Way to misinterpret the article...

<comment><AUTHOR> I didn't misinterpret.

"Dumb people don't know they are dumb" is an idea I think most of us hold (or held before reading this). [insert reference to pg essay/xkcd here]. This article discusses that idea.

The second sentence of the title suggests there is more (or less) to it than we previously thought.

A more accurate title ("All are skill unaware") would be harder to mentally classify. I thought the idea in the blog post was important enough that a small amount of inaccuracy was justified.

<comment><USER10> Next time, please don't inject bias in the headline. The title should have been "Overcoming Bias: All Are Skill Unaware." Luckily, on this site we have comment sections for each article where we can...comment.

<comment><USER11> I would argue that the (overcomingbias.com) after the link is fine to convey what blog the article is on, and the title should just be "All Are Skill Unaware".

But that's just a nit, and I do generally prefer a poster-bias-free headline.

<comment><USER10> Oops, the extra title bit must be my SEO talking :^)

</comment></comment></comment></comment></comment><comment><USER12> This post proves the article's point, unfortunately.

</comment><comment><USER13> I skimmed over the original article (Burson et al '06) to decode "noise and bias model":

The authors found out that on easy tasks less skilled people overestimated their performance while more skilled people estimated correctly that they did ok.

On hard tasks more skilled people underestimated their performance, while bad performers correctly estimated that they performed poorly.

In other words, on easy tasks everybody thought they were doing ok, on hard tasks everybody thought they were doing badly.

Thus it seems nobody did any metacognition; people of all skill levels just assessed task difficulty. On easy tasks "smart" people happened to be correct, on difficult tasks it was "dumb" people turn.

</comment><comment><USER14> I've thought about this a lot. I really don't think it's possible for someone to comprehend what it is like to be someone of substantially greater or lesser intelligence. Most smart people think that dumb people are just like them but maybe not quite as good as math, or maybe just mentally lazy. Most dumb people think Barack Obama is just like them but a more polished speaker.

The exception being noted geniuses like Einstein, who most people view as demigods that are so rare as to be nearly fictional.

</comment><comment><USER15> I imagine that the optimal level of confidence would require us to over- estimate. What possible advantage could one gain by being very realistic about one's own skills? In a zero-sum game of two equally capable players, will over-estimation of skills enable a beneficially higher appetite for risk and exploration?

Of two independently tested players with one's "IQ" higher than the other, will the "dumb" one calibrate his skill level improperly after the same amount of exposure in a game where a player is pitted against AI with different skill levels?

It seems to me that people who spend more time validating their smarts or questioning it more would naturally arrive at more fine grained understanding of their ability.

Also, what does the inter-country variation suggest? [http://www.google.com/trends?q=am+i+smart%2C+am+i+dumb&c...](http://www.google.com/trends?q=am+i+smart%2C+am+i+dumb&ctab=0&geo=all&date=all&sort=0)

That may mean nothing, but google trend speculation is fun :)

<comment><USER16> Realism about your own skills, if coupled with realism about others' skills, might encourage you to build a stronger team earlier. The point of the article is that "you should listen to those you disagree with instead of writing them off as idiots." Overestimating your own abilities makes it less likely you will listen.

<comment><USER15> True, but you could also talk about aggregate skill estimation of a team as a whole, and what they should do when another team (or the stock market) disagrees with them. Realism would be nice to arrive at, but say I hope to build a better mousetrap. How do I realistically estimate my chances in this endeavor?

<comment><USER16> Another team is different from the stock market. In an economic competition you have a number of opportunities to gather data from customers, prospects, non-customers, and competitors customers. The key step is to assume that you have something to learn from your competition. In the case of the better mousetrap you would be looking for folks with a mouse problem who are unsatisfied by current solutions, these are "non-customers."

</comment></comment></comment></comment><comment><USER17> I see the point. It's a loaded statement though.

I can agree that those who believe they are above everyone else are more than likely to be bigger fools than those around them. But I find it hard to believe that essentially giving everyone the benefit of the doubt is the most "intelligent" thing to do.

Not trusting every one to have competency doesn't equate to being "dumb," in my opinion. If so, then why do companies give competency tests? Why don't they just assume anyone applying for a job "gets it."

Maybe I'm missing something here. I sure hope not, for the sake of being pegged the fool.

</comment><comment><USER18> Surrounding yourself with people who are smarter than you is easier if the person doing the hiring is dumb.

</comment><comment><USER19> because they are dumb.

</comment><comment><USER20> i like french fries.

<comment><USER10> Dammit. Upvoted because it's near the lunch hour...

<comment><USER2> nearer dinner time here :)</comment></comment></comment>


Facebook Referred to Kids as Young as Five as "Whales" for Its Monetized Games - <AUTHOR> https://www.usgamer.net/articles/facebook-unsealed-documents-whales-mobile-games <comment><USER2> [https://news.ycombinator.com/item?id=18995823](https://news.ycombinator.com/item?id=18995823)

</comment><comment><USER3> Where in this article (besides the headline) does it say Facebook "Referred to Kids as Young as Five as "Whales""?

The article does say "the average age of Angry Birds players on Facebook was five years old" but includes no evidence of Facebook calling five year olds "whales".

It also includes a separate recorded incident (chat logs) where two Facebook employees referred to a 15-year old as a "whale" and refused a refund, but 15 is not 5.

<comment><USER4> > _but 15 is not 5._

What is the relevant difference in this context?

<comment><USER5> A 15 year old could be working in many places - probably at least has a functional understanding of value for money based on past experiences, a 5 year old almost certainly doesn't.

<comment><USER6> A child is a child.

<comment><USER7> Why do we try children as adults for certain crimes?

It's just a magic line. 17? No consequences. 18? Full adult.

<comment><USER8> _It's just a magic line. 17? No consequences. 18? Full adult._

Complete fiction. Minors being tried as adults happens all the time. It all depends on how heinous the crime is.

<comment><USER7> I was missing a ? Mark in there. Other two posters figured it out. Will edit for you.

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> This feels like it should be "obviously illegal", in the same way that it's illegal to market casinos, or loans to children, and illegal to market fast food to children in many countries.

Given this, the only reason this is able to happen is because it flew under the radar for some time and then governments take time to legislate. By the time it actually becomes illegal, there could have been years of exploitation.

How do we solve this? Assuming that governments are slow moving (there can be benefits of this), and assuming that there will always be people with more flexible morals who will happily build these products, how do we create a society where this can't happen?

<comment><USER10> You have to have a focus on strong families. If the child has parents or guardians who are aware of what they're doing and will stop them from doing it then there wouldn't really be a problem in the first place at least with five year olds

<comment><USER11> Are you sure it's wise to put the onus solely on the parents? Some kids are born into families with crappy parents. Are they to be exploited at the whim of whatever corporate goal is out there due to their bad luck of having crappy parents?

It's more reasonable to say that parents ought to be on top of things and recognize that not all of them are. Thus it's best to have other safeguards in place. Like make Facebook liable for its exploitive behavior.

<comment><USER12> In this case (or the online casino case GP was suggesting), the parent should keep his/her credit card safe. How this not the parent's responsibility?

<comment><USER13> Here's the scenario :

      Kid asks parent if she's allowed to buy 10$ worth of gaming stuff
      Parent agrees, enters cc info, which is stored by FB without any warning
      Games are designed in a way that you just click some cuddly icon without even realizing that you spend real money

That's not just only the darkest of patterns it's also geared towards vulnerable kids. Intentionally and by design.

In my book we're slowly in executives should wind up in jail territory when it comes to this evil carbunkel of a company without any morals, whatsoever.

<comment><USER14> > Kid asks parent if she's allowed to buy 10$ worth of gaming stuff

So, stop right here. The solution is for parents to take a look at what their kids are playing and refuse to let them play F2P stuff. Mine aren't allowed anywhere near F2P games for the very reasons you outlined.

If you let them play F2P games, you know that inevitably the "pay" part is going to rear its ugly head repeatedly, even with perfectly-implemented controls that prevent the kid from taking your credit card for a ride. Every damn day they're going to ask you to buy that stupid in-game currency. Just say no before it ever starts. Otherwise, good luck.

<comment><USER11> The solution is for all parents to be aware of potential for dark patterns and to put the onus on them to refuse to let their kids play F2P games? It would be nice to live in a society in which the government doesn't view actions that Facebook engages in as something every parent ought to be aware of. Caveat emptor works in some cases but not all of them. Your diligence in this situation is not something every parent has the foresight or willpower or knowledge to do. What Facebook did was morally reprehensible. There aren't other parties to blame in this case.

<comment><USER14> > The solution is for all parents to be aware of potential for dark patterns > and to put the onus on them to refuse to let their kids play F2P games?

The pattern is very simple. If the game has an in-app purchase along the lines of:

* Buy 10 gems: $0.99

* Buy 50 gems: $2.99

etc. then it's F2P garbage. Get rid of it. Take the five minutes to see what your kid is playing.

Otherwise, you're asking to ban these games altogether or make them 18+. All because it's too much trouble to see what they're actually doing with that iPad you throw in front of them.

<comment><USER11> I do not wish to live in the type of society you appear to be comfortable with. I hope your view does not prevail.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER15> > "The Reveal reports that in one of the unsealed documents, two Facebook > employees are recorded discussing whether or not to refund a child—whom they > refer to as a "whale"—who racked up $6,545 in charges from a Facebook game."

I mean they aren't wrong. A person who spends that much money on a game would most certainly be considered a whale. Jesus, I've spent a lot of money on a game like Hearthstone but nothing close to 6.5k!!!

<comment><USER16> A five-year-old is certainly not capable of understanding the significance of such a decision, and it's disgusting to exploit such weakness for large sums of money.

<comment><USER3> The person in that incident was fifteen, not five.

<comment><USER17> We're told frequently that 18-22 year olds are incapable of understanding the implications of their college spending and the associated debt. Is a fifteen year old supposed to be more financially savvy?

<comment><USER18> Worse than that: most adults (in developed countries) don't understand the law of 72 (doubling time) yet own multiple compound interest debts (credit cards)

</comment></comment></comment></comment></comment><comment><USER19> This type of predatory behavior has been happening for a long time. When I was about 9 years old, my brother and I bought Link's Awakening on Gameboy. On the back of the booklet that comes with the game was a line that read, "Need Help? Call this number" with an 800 phone number listed.

We had access to the home phone and wanted to beat the game. So of course, we called the number a few times to get hints on how to beat hards parts of the game. This was before the internet where you could just lookup a walkthrough online.

You can imagine my mother's shock when she received a $200+ charge on her phone bill for a phone number she had never heard of. Apparently the cost of the call was about $5/minute.

We got yelled at and we weren't allowed to call the number anymore after that. I'm proud to say we still be the game though.

<comment><USER20> 800 numbers are toll free. Was it a 900 number?

<comment><USER21> Actually, not all 800 numbers are toll free. Just another dark pattern.

<comment><USER22> You sure about that? [https://www.fcc.gov/consumers/guides/what-toll-free- number-a...](https://www.fcc.gov/consumers/guides/what-toll-free-number-and- how-does-it-work)

<comment><USER21> Perhaps they've finally made it illegal, but I remember plenty of complaints from people about 800 numbers that were scams that charged to your phone bill when you called them, even if accidental. I remember being surprised at the time because I thought all 800 numbers were free by design.

</comment></comment></comment></comment></comment><comment><USER23> I've never played games on Facebook, but I did once discover that, after I purchased a game on Android for my son, he was able to make in-app purchases without authorisation. Turns out Android didn't require re-authorisation for half an hour after making an authorised purchase, which can make sense in some situations, but is a terrible idea with in-app purchases for an app you just bought for your kid.

Fortunately they quickly refunded the money. I pointed out I wanted explicit authorisation for every purchase, and I think that's what Android now does.

<comment><USER24> Android is great for refunds compared to iOS.

If you uninstall an app before 2 hours after install you get an automatic refund.

<comment><USER25> Do you mean, you get a refund just by performing the uninstall action; or that on request a refund will be allowed?

</comment></comment></comment><comment><USER16> Any current Facebook employees care to chime in on what makes this company worth your time as an employee in 2019?

<comment><USER26> Facebook employees are not all scheming about the best way to target 5-year- olds. Just like any company (including 90s Microsoft!) for every one executive working out how to maximize business value at the expense of everyone else on earth, there are a couple directly complicit engineers, and a hundred engineers that mainly work on improving server uptime so that Joe Schmoe can catch up with his highschool friends, or so Grandma can use a computer (in the case of 90s MS).

Any company employing over 1,000 people is almost guaranteed to be involved in something evil because of the corruptibility of mankind, but you can't just assume that every single person is a direct contributor. Another similar example would be how you can't blame every individual American citizen for the various crimes the CIA has been running around the world committing, because there really are only a few Americans who have any connection to those things. This is true despite the fact that Mother, Apple Pie, the CIA World Factbook and the assassination of third world government officials are all technically part of the same institution.

You might counter with, if people can claim innocence even though they are part of a guilty organization, what's the motivation to improve? The answer to that is that the moral calling of Americans isn't to all leave America until the CIA gets shut down, it's to stay and stubbornly assert their morals until things improve. Evil leaders would much rather have a slightly smaller but completely obedient workforce than they would a larger, more skilled but unmanageable (in evil directions) one.

<comment><USER27> What a bunch of BS relativism. So every organization over 1000 people is equally evil? As Bill Maher said, working for HBO is not the same as working for Monsanto. And for who have been following, working for Facebook is like much more like working for Philip-Morris than its like working for HBO. And spare the nonsense about our collective guilt for the CIA. Those of us who vote (and vote against the fascists) have no reason to feel guilty.

<comment><USER26> > _As Bill Maher said, working for HBO is not the same as working for > Monsanto._

Replacing your own personal morality with the average morality of the organizations you are a part of is a trap, because you could also be way more evil than average. In fact, the most vile schemers at HBO might be worse than the most vile at Monsanto; and they could justify themselves by saying, "I can't be vile, I work at HBO, and HBO is not vile on average."

The best person at the NSA was probably Snowden while he was planning his defection. It's Snowden's actions that count for his judgment, not the morality of the NSA on average. If all NSA employees were traitors to the American people then Snowden would be one too! Obviously, only the NSA employees that do their jobs are traitors to the American people. There is more opportunity for heroism at Facebook because people could put their jobs on the line to defend what's right.

By no means am I justifying complicity, I'm saying that there's more opportunity to become a hero of the revolution in a terrible country than in a great one.

To use your fascist example, just because someone came from West Germany doesn't mean that they were members of the Statsi, and even if they were members of the Statsi, they could have been (and I would say they would have a duty to be) agents of the people working to undermine it from within.

<comment><USER28> Maybe the maligned FB research app was implemented as a clumsy clone of Onavo by such an agent of the people, working to undermine Facebook from within.

Never thought of it this way... because it's bloody ridiculous.

If FB has been infiltrated by so many "agents of the people", they're doing a pretty crap job at improving it.

<comment><USER26> > _If FB has been infiltrated by so many "agents of the people", they're doing > a pretty crap job at improving it._

Granted, my "revolution CIA the people NSA morals evil" language makes it sound kind of silly, but what I'm really talking about is the more mundane pushback that workers can achieve when asked to go beyond ethical boundaries. You don't know whether any individual Facebook employee is working in the right direction or against it, because although they might not be "plotting the people's coup, undermining the New Statsi from within," they might be gently pushing for more realistic improvements.

</comment></comment></comment></comment></comment></comment><comment><USER29> A lot of people in this thread seem to be making a Thermian Argument[1]:

> The diegetic argument aims to dismiss criticism at its core, suggesting that > there aren't any problems with a text provided controversial elements are > internally consistent with the rest of the story world. In slang terms, this > could be referred to as The Thermian Argument. In the sci-fi classic _Galaxy > Quest_ , the thermians don't understand fiction as a concept. It doesn't > exist in their language, and thus they see all texts as historical > documents.

Yes, "whale" is industry slang/jargon for a high spending account. It is also _fiction_ that was made up by the gambling industry. As such, the term doesn't have any intrinsic meaning; it gains meaning from how it's used. Using a made- up definition as if it had a specific intrinsic meaning doesn't justify bad behavior, but it does revel some of the speaker's ethics.

[1] [https://www.youtube.com/watch?v=AxV8gAGmbtk](https://www.youtube.com/watch?v=AxV8gAGmbtk)

<comment><USER30> You're looking into it way too much. This has happened every single time the term "whale" has been used in any article pertaining to gambling in the past couple years. This has nothing to do with ethics. Every industry has its overloaded words/phrases that outsiders would be confused upon first hearing. This is why context is of paramount importance (something that's often lost in mediums that are ripe for hot takes, like Twitter).

Don't try to turn this into something it's not.

</comment></comment><comment><USER31> This outrage culture is getting to be a bit much.

Anyone who's worked in gaming knows that "Whale" is a term to refer to high spenders that are several deviations from the norm.

A 1-year old racked up $10k in bills on a game where people normally spend $30? Whale. Period.

That's not unreasonable at all because the 1-yr old is in-fact a high spender several deviations from the norm.

Does any of this mean the game was explicitly marketed to 1-year olds? No.

Is it possible that the parent racked up the $10k in bills and blamed it on their kid? Entirely.

Have at it HN.

<comment><USER32> It reveals the attitude that pervades among these companies towards children that have been duped into spending via dark patterns and addictive games.

You're making an argument that since the word is consistent, everything is fine and dandy, but the meaning of the word hardly changes the situation here. Not everything is about outrage, there are legit disturbing points this article makes.

<comment><USER33> Forget for a moment that they're calling children whales.

They've normalized calling _people_ whales (and dolphins and krakens and...). They've dehumanized their clients; made it easier to not feel concerned that people are dropping hundreds or thousands of dollars on intentionally addictive video games.

<comment><USER34> Most high-dollar industries have clients that are referred to as whales (gambling, forex, stock exchanges, crypto markets). Facebook didn't normalize it. It's a term that has been use for years.

The fact that the word "children" part of the discussion is a side-note. They're high-dollar spenders (whales).

I don't understand the outrage about the term "whale" here.

I do understand outrage about the targeting of underage gamers though.

<comment><USER33> > Most high-dollar industries have clients that are referred to as whales > (gambling, forex, stock exchanges, crypto markets).

And that makes it OK to refer to people (often those with addiction problems) spending money they don't have on videogames as whales? To target them explicitly with psychological tactics to get them to spend even more money?

I disagree. It's dehumanization. It's morally wrong. Am I in a bubble for thinking such actions are wrong, or are others justifying their own immoral behavior in thinking "well, it's their fault for playing the games and spending the money"?

<comment><USER34> Who are you disagreeing with? I never said it was "okay". I just explained the term. Check it out: [https://en.wikipedia.org/wiki/High_roller](https://en.wikipedia.org/wiki/High_roller)

Facebook, by nature, is a dehumanizing company. They have over 1 billion user accounts...

As someone who works for a software company, I have never considered it my responsibility to check whether a user is "spending money they don't have" on my product. How is that tenable?

I've also never targeted underage users - before you throw me under that bus for no reason, as well..

</comment></comment></comment></comment></comment></comment><comment><USER35> The only Facebook "thing" my daughters are getting (until they are independent enough to decide for themselves) is PyTorch.

<comment><USER36> React isnt a terrible thing either.

<comment><USER24> Or GraphQL

<comment><USER37> Or OSQuery

</comment></comment></comment></comment><comment><USER38> So the parents are the real "whales." The kids are just having fun.

</comment><comment><USER39> So essentially, when you used the credit card one time, facebook remembers it for future purchases and doesn't ask confirmation? Kind of like amazon's "one- click" option?

<comment><USER40> Yes. You can go into settings and remove it easily though.

<comment><USER41> Not good enough. As an "Opt-out" with no password required, there will always be cases of unintentional purchases. This is obvious. IMO a company should be obligated to give refunds if their default settings are this way.

Reducing the barriers to payment this way does 2 things. * Consumers are more likely to impulse buy. This can affect everybody, but severely affects people with low impulse control who can't manage money. * Consumers are more likely to unintentionally buy.

Both are taking advantage of people.

It would be nice if there were consumer protections similar to "Explicit Consent" in the GDPR. I.e. Explicit Consent should be required when purchasing something.

<comment><USER40> > Reducing the barriers to payment this way does 2 things. * Consumers are > more likely to impulse buy. This can affect everybody, but severely affects > people with low impulse control who can't manage money. * Consumers are more > likely to unintentionally buy.

This should be solved by easy and simple refund system (for example, like the one that Valve has). Not by taking away ease of use for people who know what they are doing.

For example, I hate when Steam asks me for CVV number periodically when I buy. If they asked to retype the whole CC number every time I would be less likely to even buy some of the games I want to play.

</comment></comment></comment></comment><comment><USER42> If even the developers of highly sucessful games come to the conclusion that whaling is basically exploiting a few psychologiaclly gameable people against their best interest. Even worse if happening with minors. Not all companies are in the position to address that but we should applaud the ones that do:

[https://www.clickerheroes2.com/paytowin.php](https://www.clickerheroes2.com/paytowin.php) [https://news.ycombinator.com/item?id=15737008](https://news.ycombinator.com/item?id=15737008)

In the long term, only extending and enforcing retail restrictions and legislation to the digital markets are the way to stem this ethically abusive behaviour at least when it comes to children.

</comment><comment><USER43> No it didn't, but hey clickbait's fun, right?

</comment><comment><USER44> What Facebook has been doing should be kept on check. Private data of teenagers for the past 3 years, targeting children less than 10, someone should really sue Facebook and slap Mark's face

</comment><comment><USER45> I have always wondered who is clicking on ads. Do not look further. Kids and.... babies!!! I have seen so many parents and nannies letting babies hours per day on youtube. It is scary.

<comment><USER46> It is scary.

Besides ElsaGate... even when the "programming" isn't suggestive insanity, it's still garbage. It's never high quality well thought out content with a message or positive vision of what children should be seeing - it's a pig and dog sprite in roughly "animated" cars and replaying the same couple sound effects. The exact polar opposite of say Mr Rogers content.

But hey, free babysitter!!

</comment></comment><comment><USER47> "Whales" is a common industry term for a high spending account.

<comment><USER48> A common dehumanizing term. You can understand why people take offense to that being applied to children.

<comment><USER47> Not really, it isn't an offensive term inherently. It's just a lot easier to say than "the XXth% percentile of customers by spending" or "customers who spend Y% more than the median" or whatever else. The exact definition varies by organization. Identifying and attracting whales is a big part of a successful sales program.

The fact that an analogy is drawn to an animal may be dehumanizing in the most literal sense, but it does not seem offensive or carry a negative connotation on its own, as the term 'dehumanizing' implies. If it indeed dehumanizing as the term is actually defined, then what you're saying is that discussing the spending characteristics of a customer somehow deprives said customer of individuality (the definition of 'dehumanizing' in its non-literal sense, where it carries the negative connotation). But how else can you describe various cohorts of prospective customers except to describe traits like spending behaviors?

This just seems like overblown outrage and much ado about nothing, fanned by how fashionable it is to go after Facebook these days.

</comment></comment></comment><comment><USER49> I'm a little unclear. If the account is owned by the parent and the child is using it to play the game, how does FB know it was a child?

Did the specific employees cited learn from the lawsuit and then make the "whale" comment or did they say this and have the knowledge that it was a child before the lawsuit?

 __\--Edit-- __

It looks like from the chat logs that the employees had the information that it was a child.

</comment><comment><USER50> Not sure what these articles are trying to get at. Honestly we have some article against Facebook, Apple, and Amazon just about every day from some news outlet claiming the company is so horrible or terrible. I'm inclined to think this fake social justice focus is driven by big tech eating the media's ad revenues.

</comment><comment><USER51> The irony of this is that there is another group of people that "lol" at Facebook employees and call them whales as well. Just because you make a lot of money at a multinational advertising firm (lazy win) doesn't mean you're the smartest person in the room. lol indeed!

</comment><comment><USER52> In poker whales are rich unskilled players who drop a lot of money on the table

</comment><comment><USER53> Just a thought. What if facebook had fake accounts on hacker news to up and downvote new items. Would hacker news be able to identify it and if so would they let the rest of us know?

<comment><USER54> Highly doubtful that could be detected.

Here's some interesting research on that topic

[https://www.reddit.com/r/netsec/comments/38wl43/we_used_sock...](https://www.reddit.com/r/netsec/comments/38wl43/we_used_sock_puppets_in_rnetsec_last_year_and_are/)

</comment></comment><comment><USER55> source discussed previously: [https://news.ycombinator.com/item?id=18995823](https://news.ycombinator.com/item?id=18995823)

</comment><comment><USER56> Wouldn't this fall under all those rules about tracking children / those notices on kids sites that ask someone's age so they can stop tracking them?

</comment><comment><USER57> I have grown so accustomed to Facebook scandals every other day that I think have become desensitized to these kinds of news :-(

</comment><comment><USER58> This outrage is ridiculous when compared to mobile micro-transactions. Get off your high horses.

</comment><comment><USER59> I thought whale was a term used by far-right for fat people like Amy Schumer and Lena Dunham?

<comment><USER60> Completely different context. You're not wrong, but the usages are not connected.

</comment></comment><comment><USER61> Doing customer support for one of the big app stores, you will encounter adults spending hundreds or thousands of dollars on play-to-win in-app purchases and subsequently blaming it on their child to get a refund on a daily basis.

</comment><comment><USER62> At YouTube they must be called "gold mines" then.

</comment><comment><USER25> Isn't 13 the minimum age for Facebook users?

</comment><comment><USER63> I had anarcho capitalists tell me all they want from the government is enforcing contracts. Being a developer and mathematician I brought up edge cases right away: can a five year old sell themselves into slavery for a lollipop? I was kidding, but if you extrapolate, this comes close. Thankfully our society doesn't let kids incur debts like that.

Dark patterns and contracts of adhesion make the idea of "personal responsibility" in contracting a bit quaint. That's also why smart contracts may have problems in the real world - in the real world we have forgiveness and mitigating arguments.

Thanks to Privacy.com we can actually have some personal responsibility.

</comment><comment><USER64> Is this 2011? How is this news?

</comment><comment><USER65> Zuckerberg is so full of crap. He's still the same creepy person he was in college, but now he has a money printing machine.

<comment><USER66> No, you've got him all wrong. Zuck is sorry about all of this. He's said so since 2003, also in 2006, and in 2007, and in 2008 (four times), also in 2010... it goes on to this day. He's incredibly and perpetually sorry for being a total scumbag: [https://www.wired.com/story/why-zuckerberg-15-year- apology-t...](https://www.wired.com/story/why-zuckerberg-15-year-apology-tour- hasnt-fixed-facebook/)

Related note: when my 3-year-old says he's sorry, but keeps punching his sister, we put him in time out.

</comment></comment><comment><USER67> How do you justify working for facebook at this point? Between stealing money from children, selling and abusing your user's data, and allowing your users to invite a literal genocide, where does the "good" come from?

</comment><comment><USER68> Facebook. Yes, they are evil. Most of us always knew. But this flood of news items lately, isn't this just mass hysteria?

<comment><USER69> > Facebook. Yes, they are evil. Most of us always knew. But this flood of news > items lately, isn't this just mass hysteria?

If Facebook is "evil," then _not_ having a flood of news items is just giving them a pass on their behavior.

</comment></comment><comment><USER40> > asks their parents for their credit card info

Are parents really that stupid to tell them?

<comment><USER70> No kid would ever go through mom's wallet without asking right?

<comment><USER40> There's a difference between "asking" and "going through wallet". They should put "going through the wallet" then and not "asking".

</comment></comment></comment><comment><USER71> What the hell is wrong with an employee of Facebook who laughs at a kid who wracks up thousands of dollars accidentally on their parent's credit card?

What sort of mentality is going on at Facebook where this can be seen as acceptable not to refund them?

<comment><USER72> It's probably part of their metrics and counts against them come review time. Just a guess.</comment></comment>


Top most promising Estonian startups for 2013 selected - <AUTHOR> http://kaljundi.com/2012/12/29/top-10-estonian-startups-to-watch-in-2013/

<comment><USER2> I would also add few names: <http://browserbite.com> \- browser compatibility testing, <http://fortumo.com> \- in-app mobile payments, <http://edicy.com> \- simple websites for small businesses</comment>


Show HN: Node.js HTTP client for creating fast and scalable applications - <AUTHOR> https://github.com/puzzle-js/puzzle-warden <comment><USER2> Seems really useful for building large-scale web crawlers.

<comment><AUTHOR> We are using it with micro frontend solution. HTTP is quite hard to scale on load. As we can't use rpc communication because of our container orchestration system, we will continue to use Warden. It helps us a lot.</comment></comment>


Android Income Report - <AUTHOR> http://droid-blog.net/2012/02/04/android-income-report-9-january-12/

<comment><USER2> It's very interesting to see data like this, but in other ways it's a bit disheartening when I compare his install numbers to my own efforts. I've put a few apps that I feel are unique into the Android store, but it feels like throwing a pebble in the ocean. Nobody notices. Anybody have advice on how to get visibility? I've sent app review-requests to the various Android sites, but I know they're inundated and I've never had any response.

<comment><USER3> I have taken a look to your free and paid applications and they are promising. In fact, you seem to be doing quite a number of sales of your "Social Media Ticker" application. It seems that you are lacking behind in free applications. I can give you some free advice based on my own experience developing applications for the android market.

First, I see you have published one free app a wednesday, and another a saturday. In my experience free applications launched friday night have better exposure than midweek. It can deepen on the application, but usually when I launch or update a friday night I get better results all the weekend than launching any other day. It might be the case that there are less applications in the new category to compete, my theory, most updates happen in working days.

Secondly, there is no way of knowing what the users want in advance. It seems they are not interested in saving pictures to the SD card or settings a screenshot as a wallpaper. I believe your abstract photo painter is a fun application with bad marketing. You can benefit from a name with more grab. It could even be doing too much: too many effects, too powerful. You could potentially advertise just one effect like "warhol-ize your friends", but make it easy. Social might help you: share your patenting on Facebook. Tweet it. whatever… at least, change the icon. A smiling female showing your effect can be a good idea. Even the "mona lisa". But your current icon looks awful.

About Android market SEO. You have long descriptions describing what your application does, which is good. Try to check if there is keywords related to your product on mobile search. This could increase your installs. A good starting point is the adwords keyword tool. You can set the results to only mobile. And don't use generic words on the name of the application unless you are king of the hill. Users searching for wallpapers are not going to notice your "Wallpaper Share" among the ton of results.

<comment><USER2> Thanks a whole lot for taking the time to check my apps out. That's about the only feedback I've ever gotten, and I'll see if I can incorporate your suggestions. I tend to throw the apps out into the store, send out a few emails and social-posts and then sit back and wait. I need to iterate to see if I can make significant SEO changes when the current descriptions aren't getting the job done. As an engineer, I realize I suck at marketing.... sigh...

</comment></comment></comment><comment><USER4> Thanks for posting these!

I just launched my first 2 apps in the Android Market today (a DJ application called DJPad, currently only for tablets, free and paid versions). DJPad's been in the WebOS app store for about a month so I was planning on doing a similar income report for my first month (spoiler: not great ;) )

Have you looked at all at Airpush's advertising platform? I google'd Admob and it came up as an ad on the search results. It was easier for me to implement Airpush at this point since my app is 100% NDK with just a Java wrapper for launching it. Integrating Airpush was just adding the airpush library and launching the service in my onCreate().

They offer some interesting advertising verticals like ads showing up on the notification screen or home page instead of in the app. Kinda spammy but probably effective if you want to advertise and your app does not get long engagement.

<comment><USER5> Please do not Airpush. Users hate it and apps are almost guaranteed to get one-star reviews because of it.

<comment><USER4> Thanks. At first it seemed like a great idea (instant integration, better payout)...

Until I installed my app and experienced what they consider advertising. A cloned google search icon called "search" on my home screen that brings me to some scam site? woah. I'd be embarrased to tell people to go get my app, so I don't think it's worth it.

Time to switch my app's free version to AdMob.

</comment></comment></comment><comment><USER6> So you can count on each of your Android users generating less than $0.0027 in revenue for you?! (Actually, I guess it's even less if you factor in the existing customers.)

THAT ANDROID'S A DAMN FINE PLATFORM!!</comment>