Show HN: Page progress with bookmarking - <AUTHOR> https://github.com/jboyer87/page-progress

<comment><USER2> Goodbye, back button. Goodbye, history.

<comment><AUTHOR> Thanks for pointing this out. I hadn't realized that it does this. I'm thinking of a way to fix it. I appreciate the feedback.

<comment><USER3> I made something similar for wordpress: [https://github.com/zackify/WProgress](https://github.com/zackify/WProgress) I was going to add a bookmarking feature. To fix your problem just store the scroll position in localstorage?

<comment><AUTHOR> I've changed the way that bookmarks are handled. It now waits until an element is clicked before updating the hash in the URL. Once that has been done, the page (and position on the page) can be bookmarked/shared/etc.</comment></comment></comment></comment>


The real estate web is a mess. We want to fix it - <AUTHOR> https://homeapp.co/blog/preparing-for-lift-off <comment><USER2> I had great hopes, and then you burned them :(

"We believe the first step for such a company is to build alliances with the industry's professionals." From my perspective, agents are the problem, not part of the solution. From what I can see, you've built a website generator targeted at the real estate market. A listing 'showcase' is nothing new. Yours is nicer, great.

What do you see as the 'mess' you are cleaning up?</comment>


HaiKu Error Messages - <AUTHOR> http://www.authorware.com/humtext.asp?Hum_ID=105

<comment><USER2> This is seriously old, and still good. But maybe there should be some new ones, for a more modern time.

        We have your data
        safe inside our server farm.
        At least... we used to.

</comment><comment><USER3> I'm trying to think where this first appeared, was it Salon? 5 - 10 years ago?

\-- EDIT --

It was Salon: <http://archive.salon.com/21st/chal/1998/02/10chal2.html>

Feb. 10, 1998, jeez I'm old.</comment>


Ask HN: Anyone know why Twitter's initial page load has become so slow? - <AUTHOR>

I don't remember when I first noticed it but it has been on the order of months that anytime I navigate to twitter for the first time, there is an abnormally long load time. I was wondering if anyone else has noticed this and I was curious about what could be the cause? After the initial load, the site is as fast as usual.<p>I know they made a big deal about switching from Rails to Java but that was a couple years ago, I believe. Is it possible they moved to some front-end framework that requires a large initial payload to be delivered? I'm actually doubtful of that as it would have to be enormous to cause the type of delay I experience. I am a total dunce when it comes to security but I've wondered if it has to do with some kind of slowdown as a result of not handling SSL "stuff" well? This has been bugging me for a while now, so I thought I'd ask you fine folks if you've observed the same thing. <comment><USER2> I've experienced this too, and I imagine that the latency has to do largely with the process of loading data from different shards into the cache.

This post from a few years ago notes that Twitter used to store the most recent posts for your timeline within their Redis cluster, and MySQL was used for long-term storage. If your account was not active within the cache, then they needed to reload your timeline info. from long-term storage.

[http://highscalability.com/blog/2013/7/8/the-architecture- tw...](http://highscalability.com/blog/2013/7/8/the-architecture-twitter-uses- to-deal-with-150m-active-users.html)

I'm guessing that this is where the bulk of the latency is coming from, since subsequent page loads on different devices don't exhibit the same degree of latency.

<comment><AUTHOR> I actually do remember something about that also. But, I've also noticed it when I open an incognito tab, so I'm just going to their landing page and not signed in.

</comment></comment><comment><USER3> If you check the network tab when you visit twitter you'll notice that the payload for the core twitter assets aren't that big, so you can scratch that idea off.</comment>


If It's Important, Don't Hack It - <AUTHOR> http://insideintercom.io/if-its-important-dont-hack-it/ <comment><USER4> The tricky part is getting people to understand what really drives their business and at the right level. It's not even just picking the right metrics, it's understanding them enough to take action on them.

My metric for metrics is to track things that will change your behavior. If a metric changes and you don't, then it's a pointless metric.

I've seen many companies track reasonable metrics, only to do nothing about them when they change. They just try to "do more" of whatever they were already doing.

Doing the right things with the right metrics is not a skill that everybody has and not everybody can learn.

<comment><USER5> This is true. Also beyond these problems, I am going to say something else.

Marketing is not the result of a few actions. It is and should be something woven into _all_ business activities. It should be part of your email signatures, participating on social networking sites, etc. All of the little things build up and the thins which really help with building a presence.

There are legitimate marketing hacks but they don't involve tricking users. They involve living and breathing marketing, and realizing that building your business means a billion _little_ marketing hacks, not a few big ones.

<comment><USER6> Best thing I've read on HN in a while.

</comment></comment></comment><comment><USER7> This is why the the Silicon Valley high-growth game is so strange.

In a normal company, the metrics would center around, "Are we making money?" "What sort of things point to us making more money?"

In the SV game, it's "Are we attracting attention?" "What sort of things will cause us to get more attention?"

<comment><USER8> > _In the SV game, it 's "Are we attracting attention?" "What sort of things > will cause us to get more attention?"_

It's not particularly strange if you break down the business models that dominate the SV ecosystem. These companies you speak of are merely procurement channels. Think of them as oil drills that suck up as many attention spans as physically possible. And largely they are all competing with each other to strike the next big oil well. Not unlike the oil industry they put massive amounts of capital into the discovery and refinement of such oil wells. The likes of Facebook, Google, etc are simply refineries who sell this attention (refined by analytics and insight) off to the Fords, Coca-Colas, etc of the world.

<comment><USER9> That's a solid analogy. Thank you.

</comment></comment></comment><comment><USER10> I hate when apps ask to post to Facebook or Twitter on my behalf. It's uncomfortable and puts the user in an awkward position. Great article, hope some of these companies take note!

</comment><comment><USER11> This article is right.

But, what's the point of articles like this?

Few people are so stupid that they believe moving some number is the same as doing well. There are lots of times when moving some arbitrary number is rewarded, and we know that humans respond to incentives. It's perfectly logical, and even the best strategy in some situations.

People who pull tactical games like this might be able to get by, or do well, or become captains of dying industries, but fundamentally we can probably agree they are assholes. Plenty go along because they are playing the junior edition same game with the junior edition of the same strategy. When there isn't a risk of repercussions, or when they feel like they have a chance to gain credibility, or whatever motivations big smart apes really act out of, they loudly laugh at and mock the asshole; because of the hurt they feel at wasting the part of their life that was spent doing something so obviously worthless, and because of the shame and regret of compromising themselves, and because it's a good move.

Some people have real problems. Some people don't get enough food to eat. Someone could say that it's a form of privilege to have problems like "I don't believe in my job". It almost certainly is.

Somewhere in some country where people die of things that people just don't die of other places, there are people officially working on things, and money being spent, all kinds of activity done because someone feels like that is their best strategy, and the people involved know it's stupid and pointless and a waste, and they know there are people suffering that could suffer less.

It's easy to play along. It's easy to play a strategy that maximizes personal outcomes. In fact, the people at the top almost certainly got there by playing such a strategy. It seems likely that it's an evolutionarily stable strategy, despite the implication that a lot more suffering is going to happen.

<comment><USER12> I wrote the piece, it seems to have been very well received.

I've read your 5 paragraphs and I can't really understand what you're saying.

<comment><USER11> I'm saying that your advice is pointless, because nobody who could benefit from your advice chases a metric because they don't realize the things you say in the article. The things you say are obvious, and anyone who doesn't find them obvious is so profoundly stupid that there are thousands of basic skills they lack besides the one your advice corrects.

They chase metrics because they are in a situation where moving those numbers does something. In the case of the startup you mention, they could use the user count graph to raise money, which is probably what they were trying to do.

I go on to say that doing things like moving a metric for its own sake is really an example of deceptive signaling, which is pervasive in human affairs. On the way I point out the fact that deceptive signaling is often performed by a team of people, and many of the team members or employees actively work on such things despite having to grapple with moral reservations, and I talk about that for a bit, and point out they are not really innocent, but are acting primarily out of self interest.

Next, I talk about how many or most of the major problems in the world are due to resources being wasted because someone calculates that they can benefit more by using those resources to engage in deceptive signaling than by helping people, and they have many accomplices that recognize what is happening but assist anyway.

Finally, I point out that this is likely a dominant strategy, so there is almost no way to become powerful or remain in power except by engaging in such activities (using available resources in the way that maximizes power rather than any other consideration, such as preventing starvation), and I close by expressing my regret that this is so.

</comment></comment></comment><comment><USER13> This article is dead on the money. I think this comes back to people having a hard time discovering the value that their product offers customers.

They may hear that 2+ invites, and 3 projects 'activates' the customer - <USER2> they don't truly understand what that means and why that provides value.

I have noticed that with some of my clients too, and other entrepreneurs I talk to.

That's one of the reasons I am starting to write more about discovering/understanding value.

The first such post is 'Redefining MVP to Minimum Valuable Product'[1] because I think that's a perfect place to start - plus it is where I have been noticing this issue pop-up more and more in my work.

I think the entire industry does need to take a step back and really start re- evaluating the way we analyze/discover value. It feels like it has been lost with everybody trying to go too fast and 'hack' everything.

[1] - [http://5kmvp.com/blog/2013/09/17/redefining-mvp-minimum- valu...](http://5kmvp.com/blog/2013/09/17/redefining-mvp-minimum-valuable- product/)

</comment><comment><USER14> I'm glad that I know a good term for "false proxies" now. It seems to be a problem that comes up all the time in wildly different contexts. I sometimes call it "painting a banana yellow", but that doesn't necessarily convey the meaning to someone unless I've previously explained the analogy.

</comment><comment><USER15> [Google+ growth-hacked their way to 170 million users,...]

It is just like a math expression: Google+ growth-hacked.

If "Yahoo!" can be inserted in this sentence, it would be funnier.

</comment><comment><USER16> Is this the correct use of the term "Growth Hacking"? I thought it was a person who works on side projects to increase their personal development outside of work.

As far as the meat of the article, I feel like this is spot on. The challenge I think is that a lot of people, including PG, have said they want to see 10%+ growth [1]. Customer acquisition is a very easy thing to hack if you know how to play the social game, but in the end, it comes down to product.

[1] - [http://www.paulgraham.com/growth.html](http://www.paulgraham.com/growth.html)

<comment><USER17> _Did you laugh at the bill hicks routine about marketers killing themselves when you were a teenager, but now want to take that highly paid SV position without an existential crisis? Have we got the job title for you!_

</comment></comment><comment><USER18> Misleading title.

<comment><USER19> _Intriguing_ title.

</comment></comment><comment><USER20> "Had Google+ focused on a metric of "Users who choose to go to Google+ and share at least 2 updates per week", they would have focused their efforts on delivering value to users rather than popups that drive numbers."

The Google+ foundation is all there -- they already focused on that: it really is the foundation of a brilliant social network, and I prefer it purely given that they don't decimate photos by the horrid overcompression that Facebook does. Their problem now is purely a network problem in that people don't see the point of sharing updates there given that many of the people they share them with aren't there. I fail to see how this example supports what they are saying whatsoever.

<comment><USER21> OT My recollection of the G+ scenario is that they stunted it themselves - <USER3> whatever reason. By the time the people I knew actually had access I'd lost interest in waiting for my friends to show up. They arrived to find that after a month nothing was going on and they lost interest. I'm not sure how it's doing these days but it felt like a massive missed opportunity.

<comment><USER22> Completely agree with this. Me and some other friends were legitimately excited for Google+ when it was released as beta but couldn't get an invite. By the time it went public nobody cared enough to fill out a profile.

<comment><USER23> Dont worry, if you use gmail, youtube, or android you already have a profile ready for you.

This idea of shoving everyone into G+ as your default google sign-on and identity is pretty controversial. Most everyone I talk to about it finds it annoying. So they went from being exclusionary to being almost mandatory. Not sure what the long term plan is here. Google probably doesn't know either. They rushed a facebook clone for their own reasons and now here it is, a virtual ghost town.</comment></comment></comment></comment>


YC Winter 2008 Hopeful Looking for 3rd Co-Founder / Lead Developer - <AUTHOR> http://sfbay.craigslist.org/sfc/eng/433062324.html

<comment><USER2> _"... You will be provided with a complete set of product specs at the outset as well as a rough initial design, which you can choose to use or discard ..."_

A complete set of specs? Hard one to fill if you have no say in the design or idea. Is the idea going to change?

</comment><comment><AUTHOR> the product specs are for the 1.0 version (minimum feature set) the product has a huge amount of growth in version 1.5, so a co-founder can still add a ton of value. Also, we are flexible, if you come with great ideas and suggestions we will go with whats best.

<comment><USER3> are both existing cofounders non-technical? (looks like one of you has good css + javascript knowledge or just css?)

rephoria looks like a decent idea and the design was done really well - I like the name too

the only question I have in my head is: how are you going to beat Yelp or even Insider Pages? I could be wrong but it seems like you guys are going head to head with them. Either that or u remind me of an old company called planet feedback

<comment><USER2> _"I could be wrong but it seems like you guys are going head to head with them"_

Scared of competition?

Lots of good ideas have competitors but the ones you should be worried about are the ones you don't know about. I'd rather be just competing with myself making it better than anything I could think up myself than just competitors.

<comment><USER3> "Scared of competition?"

more like curiousity - Yelp is that good (to me at least)

It's like saying you're building a better search engine than google</comment></comment></comment></comment>


PSA: cp -r behaves differently on linux and macOS - <AUTHOR> https://jamesroutley.co.uk/tech/2017/07/20/psa-cp-recursive.html <comment><USER2> Huh, maybe that was the original inspiration for the equivalent behavior in rsync.

> A trailing slash on the source changes this behavior to avoid creating an > additional directory level at the destination. You can think of a trailing / > on a source as meaning "copy the contents of this directory" as opposed to > "copy the directory by name", but in both cases the attributes of the > containing directory are transferred to the containing directory on the > destination.</comment>


Startup Lendoor Aims to Use Crowdfunding for Small-Business Loans - <AUTHOR> http://dealbook.nytimes.com/2014/10/29/start-up-lendoor-aims-to-use-crowdfunding-for-small-business-loans/

<comment><USER2> Not surprised to see Krane's take on crowdsourcing getting mentioned in NYT. She's found a niche that most crowdsourcing websites ignore: Good old fashioned loans.

Seems to me everybody focuses on donations or equity financing.</comment>


Ask HN: How does WEP cracking work? - <AUTHOR> I downloaded the BackTrack 4 LiveCD and ran it on my own router using the instructions in a couple Youtube videos and online guides.
I understand the basic principles: * find interface and AP info * dump all packets sniffed from target AP * run fake authentication attack * use ARP request replay to generate IVs for cracking * crack collected packets once you have enough
I understand HOW to do it, but not how it works. I don't understand why I have to do a fake authentication attack, or what kind of packets aireplay-ng -3 generates and why they're useful, or how the crack itself works at the end.
Can anyone shed a little light on the process? The pages I've found only detail how to do it, not why they work, and the Wiki pages I've found are too in-depth to be grokable. <comment><USER2> WEP uses the RC4 cipher. The RC4 cipher generates pseudorandom bytes to XOR (mix) with your data to create the encrypted data. It generates these using an algorithm that "shuffles" the numbers 0-255 around in an array.

The initial arrangement of this array is derived from the key, by what is called a Key Scheduling Algorithm. In certain cases, this key scheduling algorithm can be worked backwards from the output of RC4 (the pseudorandom data) (if you can figure out enough about what the state of the array is) to get the key.

It is not secure to use the same key twice when doing symmetric crypto, so an Initialization Vector (just some extra data that is different for each message) is usually combined with the "key" to create a new key for each message. The IV is not a secret and usually sent along with the message in plaintext since you have to know the rest of the key anyway. However, in RC4, certain IVs cause working the Key Scheduling Algorithm backwards to be much easier.

All of the fake-auth attacks, deauths, and whatnot that aircrack does are for forcing machines on the network to generate more packets, because that increases the chance a packet will have a "weak" IV.

[http://en.wikipedia.org/wiki/Fluhrer,_Mantin_and_Shamir_atta...](http://en.wikipedia.org/wiki/Fluhrer,_Mantin_and_Shamir_attack)

<comment><USER3> To expand more on this great answer; the point of the deauth attack ans so forth are designed to generate a large number of IV's with which to work on.

The idea is that you can use weak IV's (as described above) to attack the subsequent bytes in the encryption key. The important thing to know is that the next byte cannot be definitively calculated - you can only calculate a possible value. The reason a lot of weak IV's is needed is so you can perform the same attack multiple times - at which point the correct byte value will appear much more often than any other value.

(incidentally; the theory behind it is actually pretty simple but you do have to be up on your encryption terminology for it to make sense on first reading :) when I learned all this from scratch it took me ages to get my head round it)

</comment></comment><comment><USER4> This appears to be a good read on the topic: [http://www.wifiplanet.com/tutorials/article.php/1368661/8021...](http://www.wifiplanet.com/tutorials/article.php/1368661/80211-WEP- Concepts-and-Vulnerability.htm)

Hope that helps

</comment><comment> jc-denton Can't u google it urself?

</comment><comment><USER5> Why is this here?

<comment><USER6> Look at the name, its called Hacker News.

<comment><USER7> Yeah, Hacker News NOT Cracker News , we create stuff, we don't crack stuff.

<comment><USER7> care to elaborate the downvotes?

<comment><USER8> I downvoted you because you are drawing a meaningless distinction. "We" crack lots of stuff. The methodology behind cracking WEP is interesting, accessible, and worth understanding. It's a perfectly appropriate topic.

</comment></comment></comment></comment></comment><comment><USER7> DaemoXI , I knew you were a new user just by reading your question. This is called hacker news, NOT cracker news. You should read the Guidelines or look around (front page) to see what the site is about.

<comment><USER9> And you in turn out yourself as a clueless interloper with your ninnying prescriptivism!

ESR's edicts on nomenclature hold no sway over this community, nor really any other. His attempt to parlay any negative implications onto the word 'cracker' have only ever been taken seriously by affected noobs.

<comment><USER7> Thanks for your elaboration, I don't know what you are exactly talking about but I respect your views.

<comment><USER10> ESR = Eric Stephen Raymond.

Wikipedia: <http://en.wikipedia.org/wiki/Eric_S._Raymond>

Here's the "How to Become a Hacker" essay that contain's ESR's definition of a hacker vs. a cracker:

<http://catb.org/esr/faqs/hacker-howto.html></comment></comment></comment></comment>


Guns Censored by Emoji Police, Apple and Microsoft - <AUTHOR> http://www.thememo.com/2016/06/20/emoji-rifle-emoji-gun-feminist-emoji-politics/ <comment><USER2> I don't understand how companies can reconcile the fact they want free and open internet where people can express their thoughts and ideas yet make moves to actively restrict expressiveness. When has expression become a bad thing?

<comment><USER3> What can you express with a gun emoji that you can't express better with words? Emojis are jokes/toys/punctuation. They're not a way to express actual ideas.

<comment><USER4> Look at people using them and you'll see they do express actual ideas.

</comment></comment></comment><comment><USER5> Honestly, I would prefer if emojis in general weren't part of the unicode standard at all. I don't use them, and when others use them in communications with me I find them distasteful. And putting them into Unicode has created a battleground for completely-unnecessary conflicts like this one. If people really want to send each other pictures of olympic sports, can't they just send actual images?

<comment><USER6> _If people really want to send each other pictures of olympic sports, can 't they just send actual images?_

Right now emoji is the only way to send content-addressable images in-band.

Extending the character set is probably not the best way to do it, but might be the least-worst. Everything else gets very tricky very fast.

An alternative can't use fonts to work around the need for a parser somewhere in every GUI stack ever. And that's in addition to figuring out about where and how the images get stored. Is there is an image set to be implemented as a matter of compatibility, is the image embedded in a multipart message wasting bandwidth when the same pictograph is used in more than one message, or is now a connectivity expectation to render otherwise readable-offline material?

<comment><USER7> I kinda feel like this is the sort of thing that would be ideal for a separate, non-unicode standard, like a markup language:

<emoji="smiling face" attr="skin-color:yellow"/>

It seems like a nasty hack to include pictures of things as code points, since they don't really share much in common with linguistic characters other than that they hold some semantic value.</comment></comment></comment>


Ask HN: What are the worst possible side-effects of net neutrality legislation? - <AUTHOR>

We see a lot of posts about the need for network neutrality legislation. Warning that if it is not enacted we'll see things like raising the barrier to entry for startups, content gardens, billing content providers for access to consumers, etc.
While I find these issues compelling and worth worrying about, I'm also curious about some of the possible downsides of enacting net neutrality legislation.
What do you think are the worst plausible side-effects or unintended consequences enacting net neutrality legislation? <comment><USER2> Net neutrality would give regulators significantly more power over how ISPs operate their networks. Due to regulatory capture[0], we can expect those regulators to advance the interests of entrenched players over potential newcomers.

So the biggest costs are probably Bastiat's "unseen" [1] costs. The things that could have been but never will. We may be helping lock in the ISP industry of 2014 as a permanent status quo.

I would argue that net neutrality is a shortsighted compromise. Instead of trying to make the monopolists be slightly less bad, we should be legalizing real competition for them.

For example, if the goal is really to improve service and reduce costs, we should be campaigning to legalize municipal networks at least as hard as people are campaigning for net neutrality. Why is net neutrality getting attention and these other barriers aren't? Because there are big commercial interests who benefit from net neutrality.

[0] [https://en.wikipedia.org/wiki/Regulatory_capture](https://en.wikipedia.org/wiki/Regulatory_capture) [1] [http://bastiat.org/en/twisatwins.html](http://bastiat.org/en/twisatwins.html)

</comment><comment><USER3> The main problem is likely to be cost. Net neutrality sets a minimum quality level for Internet service and there is a certain cost to provide that level of service. If you can't afford that then you don't get any Internet access at all.

This usually comes up in rural areas (cf. Brett Glass) or the developing world. In the Android One announcement it was mentioned that people in India are probably not willing to pay for metered data to download OS updates, so they would just never update unless Google pays for the bandwidth, which is what they are doing.</comment>


Exposing Yourself to Positive Black Swans - <AUTHOR> http://jdmoyer.com/2010/05/20/exposing-yourself-to-positive-black-swans/ <comment><USER2> It's actually from May 2010, so for all I know has been posted here before. But I thought it was quite good. The story that goes with this section (below) is particularly good but I just don't want to quote such a huge chunk of it. If you want to read that much of it, check it out for yourself.

Excerpt:

 _Create/Invent Exactly What You Want

If you can envision something that doesn't yet exist, something you have a distinct need for, then you may be on to something. If you can create it — whatever it is — and use it to positive effect (enjoyment, efficiency, whatever) then you might have something that could really take off.

Paul Graham discusses how this idea relates to technology startups in this essay, but there are ways to apply it beyond starting a company, or creating a product or service. Following your own taste, rather than what you imagine other people will like, is also the best way to proceed in artistic pursuits. This might sound obvious, but most entrepreneurs and artists don't apply this principle. Instead, they pander to what they believe the public wants, or what they believe will be a commercial success. This strategy might slightly increase the odds of mild success in the short-term, but it will squash any chance of wild, break-out success (black swan success). For that, you need to invent (or create) for yourself._</comment>


Heyzap (YC W09) adds option to pay game developers with Bitcoin - <AUTHOR> http://venturebeat.com/2013/04/07/heyzap-adds-option-to-pay-game-developers-with-bitcoin/#gSieQebq936MTvkV.02

<comment><USER2> Could someone explain why anyone would be foolish enough to pay in bitcoins right now given its meteoric rise over the past few weeks?

<comment><USER3> If you are sure it will keep going up at this pace, why not take everything you own, sell it, and invest in (or: speculate on) Bitcoin? That's not a rhetorical question.

Personally, given its volatility, it doesn't make much sense to me to hold much in Bitcoin outside of what you plan to spend relatively immediately. It could go up or down by 50% overnight - not a great store of value, either way.

<comment><USER4> Some don't mind volatility as long as (a) the long-term expected gain is positive; and (b) the return is uncorrelated with more traditional investments.

</comment></comment></comment><comment><USER5> Ah, so _that's_ an indicator of where verbalist's comment[1] was coming from about "developers wanting to be paid in Bitcoin"

<https://news.ycombinator.com/item?id=5508031>

</comment><comment><USER6> Definitely interesting, and more options are (in most cases) a good thing... the best application of this that's immediately obvious to me, though, is for financially successful devs/shops to mark one of their games for bitcoin income and use it as a test case.

I do hope, though, that it's not presented to small shops as being the same as [insert traditional currency here]; while it's certainly our own responsibility to be careful how we're paid, glossing over the realities of Bitcoin could end up with busy or otherwise inattentive devs accepting something that's just not the sure (or at least predictable) thing they need in terms of payment.

</comment><comment><USER7> Unfortunately most users are annoyed by services like Heyzap and Openfeint. Ironically, Game Center seems to get out of the way the best, but is still pretty superfluous for a default app on a mobile operating system.

<comment><USER8> Exactly. It bugs me how much these types of services are making the front page of HN, considering that they only undermine video game quality for the sake of profit.

</comment></comment><comment><USER9> I wonder if you set a price amount in bitcoin or it just does a conversion between BTC and USD (or some other currency).

If you set a price in BTC then if there is a drop in value, you might find wake up the next day and find that lots of people took advantage of that as a way to dump their BTC and managed to buy your $10 game for $1.

<comment><USER10> usually you can pick but most people pin their btc prices to their own local currency for convenience.

<comment><USER2> This is interesting because I think this is the biggest vulnerability for bitcoin. So far as people continue to peg bitcoin to their own currency, it will continue to be thought of as a speculative opportunity and will face insurmountable deflationary pressure.

Bitcoin needs to hit a tipping point in the density of merchants offering bitcoin transactions, such that the general population can free themselves of thinking of bitcoin as it relates to USD or EUR, and instead how the price of a good or service in bitcoin relates to _other goods and services_ they can consume with bitcoin.

</comment></comment></comment><comment><USER11> I'm surprised so many people in the tech community have fallen for this Ponzi Scheme.

For example, many heard about "some guy bought a $25 pizza with 10,000 bitcoins", but no one has thought about what this means. It means someone now has that 10,000 "coins" (which is close to 2'000,000). This also means someone had this amount (and possibly much more).

And, finally, no one questions who posseses the first "coins".

That's why the creator is anonymous.

Just my 2 cents.</comment>


Bill Gates demos Xobni - <AUTHOR> http://www.gaborcselle.com/blog/2008/02/bill-gates-demos-xobni.html <comment><USER2> What's in a name? I just registered the backwards spelling of rotator, kayak, and racecar.

<comment><USER3> Reminds me of a funny video of Weird Al spoofing Bob Dylan by singing only in palindromes:

<http://youtube.com/watch?v=Nej4xJe4Tdg>

</comment></comment><comment><USER4> This is great news for Xobni. Was there an actual crowd, though, at the Office developers conference? (Just curious about the interest of developers to work with MS products - I know I personally wouldn't want to.)

I guess the bottom line now for MS seems to be that they are "desperate" about the future and have a large pile of money to invest - which could be a good thing for developers and acquisition targets.

<comment><USER5> About 1000 according to this article: [http://www.computerworld.com/action/article.do?command=viewA...](http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9062058&intsrc=news_ts_head)

</comment></comment><comment><USER6> Anyone from Xobni care to comment on how this came about? Crack PR firm? VC connection? Angel investor who is Linked-in to Mr. Gates?

I've learned that what appear to be serendipitous events usually take a HEAP of backroom planning.

<comment><USER7> Xobni are one of the chosen startups on the Microsoft accelerator program. Pretty simple. That & a great, usable product which is making the lives of their users much much easier.

<comment><USER6> I fear the former point is relevant, the latter is not.

Geez I'm getting grouchy in my old age.

<comment><USER7> Perhaps your judgement with age is the thing which has changed, you haven't even proposed why the latter argument is invalid?

How can you argue that Outlook without Xobni is better than Outlook with Xobni. Outlook is so bad that any minor improvement which changes the user experience of a product which hasn't changed in 10 years is a positive one.

Obviously we aren't talking about the magnitude of the positive change which will increase as xobni improves its product. Surely its existence is sufficient to warrant the acceptance that its a step in the right direction.

I would conjecture you don't even use xobni, or for that matter outlook ;)

<comment><USER6> I fear I didn't make my point clearly. I didn't mean to malign Xobni at all -- it sounds like an excellent product.

What I was attempting to point out is that the excellence of the product is often unrelated to what gets coverage by bigwigs.

But I am also guilty of not using Outlook on any regular basis.

</comment></comment></comment></comment></comment><comment><USER8> Foreshadowing of a buyout?

<comment><USER9> I'm curious how big the "offer the Xobnis couldn't refuse" would have to be. They're the YC company I think has the biggest commercial potential because it looks like something businesses would pay for. Many (many) other YCs look like M&A targets for bigger companies.

<comment><USER10> Sadly, here's another possible trajectory - (1) MS "partners" with Xobni; (2) Xobni busts a hump for two more years getting some corporate adoption; (3) MS introduces "MS-obni", an inferior yet similar product; (4) corporate IT departments everywhere dump third-party Xobni for MS version; (5) Xobni dies a bitter and lonely death.

I don't mean to be a downer, but if I was a Xobni guy, this would keep me awake at night.

<comment><USER11> Large corporations always try to buy you before they try to bake their own. The risk is smaller.

I wouldn't start worrying until I said no to an offer from Microsoft.

<comment><USER12> I think you are blatantly ignoring the entire history of Microsoft.

<comment><USER13> Do you have any evidence?

Microsoft buys tons of companies, including those competing with internal products. LookOut is a great example, and one that's relevant given the current discussion of Outlook plugins.

</comment></comment></comment></comment></comment></comment><comment><USER14> now i know why MS didn't manage to compete with Google. They still have their focus on desktop.

Thats ok. It's better for web startups.

Bill Gates used YouTube too before Google buy it, but MS went with creating their own video site..

</comment><comment><USER15> I just love watching him smile whenever he says Xobni! Woohoo!

</comment><comment><USER16> Wow, congrats guys!

</comment><comment><USER2> Coolest news ever.

</comment><comment><USER17> Great news!

</comment><comment><USER18> Here's a way Microsoft could begin to redeem itself and be a genuine force for good in the world: start a whole division dedicated to finding truly innovative startups with useful products and _buy them_. Then have another division that nurtures them.

That would be cool. God knows MS has the cash to do this, and it would inspire (more than ever) people toward innovation.</comment>


Edit My Ex – Remove Your Ex from Your Photos - <AUTHOR> https://www.editmyex.com/ <comment><USER2> The photos in the "Our Work" are fake. See the analysis of the second example

[http://fotoforensics.com/analysis.php?id=6db59a852d8a806a8c4...](http://fotoforensics.com/analysis.php?id=6db59a852d8a806a8c42422992c099a192442725.254646)

[http://fotoforensics.com/analysis.php?id=52e7e3eb6a9165b2dac...](http://fotoforensics.com/analysis.php?id=52e7e3eb6a9165b2dac2d5aaac10c716cb85f4e3.184593)

The "lines"around the persons are a clear sign that they just got an image of an empty beach and photoshopped the two persons.

(I couldn't find the original photos. Perhaps they took the photos, but I suspect that they are stock photos or something similar. Bonus points for finding any of them.)

The other two examples in the "Our Work" section have a similar signs of been fake.

<comment><USER3> Yes, it is a stock image, but i think the guy is actually on the picture:

[https://www.tineye.com/search/52e7e3eb6a9165b2dac2d5aaac10c7...](https://www.tineye.com/search/52e7e3eb6a9165b2dac2d5aaac10c716cb85f4e3/)

</comment></comment><comment><USER4> This reminds me of that black mirror episode where blocking someone in real life blurred their faces in pictures and memory. Doesn't seem like a very helpful thing to me. Sure it's hard looking at pictures and having those memories, but, if there's pictures, there was probably at least some good memories. I always just try and focus on those while looking at such pictures. Shit happens, good and bad, editing pictures(or altering memories) doesn't change this. It might suck that pictures can bring up bad memories but removing the person from them won't change your memories and I doubt it'll make you forget you were there with that person.

</comment><comment><USER5> Alternate product name: Yezhovify (cf. [https://en.wikipedia.org/wiki/Nikolai_Yezhov](https://en.wikipedia.org/wiki/Nikolai_Yezhov))

</comment><comment><USER6> While I am, generally speaking, appalled, I could imagine scenarios in which the ex was, let's say, violently abusive, and it might be justified. "We're not here to judge, we're here to Photoshop", is an awesome slogan. Also, awful.

</comment><comment><USER7> Challenge for HN: Build this using neural networks :)

</comment><comment><USER8> see also: Eternal Sunshine of the Spotless Mind [https://www.imdb.com/title/tt0338013/](https://www.imdb.com/title/tt0338013/)

</comment><comment><USER9> £6.99 for a photo? That's too steep. I guess this can be automated.

</comment><comment><USER10> Lol.Hilarious.</comment>


The Young and the Economically Clueless: Millenials vs. Their Own Interests - <AUTHOR> http://www.wsj.com/articles/the-young-and-the-economically-clueless-1455924699 <comment><AUTHOR> (paywalled)

excerpts:

"These young (Sanders/Trump) voters seem not to realize that the economic policies they find so resonant are the least likely to promote the growth and the social mobility they desire. ..."

"The underemployment rate... for young adults below age 30 is 60%. The overall employment-to-population ratio of 77.4% for those in the prime-of-working-life 25-54 age bracket translates into 1.5 million jobs below the 20-year average."

and

"The college graduate living in his parents' basement and working a marginal job to service a student loan is by now an archetype of the Obama era. And while the headline unemployment numbers are down, and the administration congratulates itself on a tepid "recovery" that was almost exclusively dependent on Fed-engineered financial-asset inflation, there is every reason to be skeptical about the health of the labor market. The labor-participation rate languishes at its lowest level in 40 years..."</comment>


Voyager 40th anniversary posters - <AUTHOR> https://voyager.jpl.nasa.gov/downloads/ <comment><USER2> [https://voyager.jpl.nasa.gov/downloads/#gallery- infographics...](https://voyager.jpl.nasa.gov/downloads/#gallery- infographics-2)

That is awesome. Only wish it didn't crop out current voyager 1 & 2 locations. And included Pluto for old time's sake.

<comment><USER3> The top part isn't to scale, so including current positions out past the planets in that wouldn't be very meaningful. They're on the bottom edge along with Pluto though!

Label for those numbers is a bit tiny at the left, they're millions of miles.

EDIT: Though I see it's got New Horizons headed on a trajectory to Pluto, it's just from ~2008 so it hadn't gotten there yet.

</comment></comment><comment><USER4> I had one of those printed up (the Grand Tour one). It looks absolutely beautiful.

<comment><USER5> What website/vendor did you use to print one?

<comment><USER6> I have been using canvaspop.com for prints at home. They're affordable, more than they are great, but from the couch they look fine. I haven't done much experimenting with higher DPI, and all that stuff. Sending them a 72dpi HD jpg has been enough for a 20x16 print, about 40 bucks with a coupon code that is easy to google.

</comment></comment></comment><comment><USER7> Any way of finding out who the artists that made these are?

</comment><comment><USER8> I wish they had made a quality poster of the golden record.

<comment><USER9> Or a vinyl reprint for hipsters?

(Edit: this comment got severely downvoted, but I'm actually serious -- I think a reprint of the record would be a nice product considering the resurgence of record players.)

<comment><USER10> Damn, I guess I'm a hipster then since I'm on the kickstarter for the repress: [https://www.kickstarter.com/projects/ozmarecords/voyager- gol...](https://www.kickstarter.com/projects/ozmarecords/voyager-golden- record-40th-anniversary-edition)

<comment><USER11> Damn, that is some pure... Kickstarter. You have to poke around a minute or two to figure out that basically, getting the record on vinyl and not a bunch of related kipple costs a hundred bucks.

It's a cool idea but it's too bad about the cost.

<comment><USER10> It wasn't just the record (3 pieces of fully remastered vinyl at that), it also came with:

\- Lithograph of Voyager Golden Record cover diagram, gold metallic ink on archival paper

\- a Voyager trajectories turntable slipmat

\- a hard cover book containing all images included on the original Voyager Interstellar Record, gallery of images transmitted back from the Voyager probes, and a new essay by Timothy Ferris, producer of the original golden record

\- Voyager Golden Record diagram pin

<comment><USER11> It would be fun to get a copy of the record that flew and no kipple, for a reasonable price. That's all I meant.

<comment><USER12> Depending on your definition of reasonable price; [http://www.ozmarecords.com/shop](http://www.ozmarecords.com/shop)

(trivia: the replica is on 3 discs as the original was 16⅔rpm)</comment></comment></comment></comment></comment></comment></comment>


Altair 8800 Clone - <AUTHOR> https://altairclone.com/ <comment><USER2> I am a bit disappointed that only the look&feel was cloned not the internals. It's just a PIC24FJ128 in an over-sized case. I would much prefer to have a clone that comes with a thick manual and that you need to solder for 2 days. That would be fun. Something ala Ben Eater computer but more pro.

The pricing page is funny, especially the old price listing saying how much you get for "free" with this kit. You start expecting an unreasonable price after that and indeed you are not disappointed.

<comment><USER3> [http://altairkit.com](http://altairkit.com) doesn't seem to be available any longer, but it was what you describe. An actual replica instead of just a functional and cosmetic clone.

You can still find new replica CPU, RAM, and probably backplane boards out there for sale, so if you wanted to build your own replica, it's not impossible. Figuring out the case and the front panel would be the hard part, I think.

<comment><USER2> Thank you for the link. I could download the full schematics from the site and also the original assembly manual! Nice.

BTW On my personal TODO list I have this project: [http://www.malinov.com/Home/sergeys- projects/minimax8085](http://www.malinov.com/Home/sergeys- projects/minimax8085)

</comment></comment></comment><comment><USER3> I have an original, real Altair 8800. They aren't super solidly built (lots of individual wires), and having been sold as kits, the assembly quality on them is very variable. Among the many tens of vintage computers I own, the Altair is definitely the most finicky to keep running.

If you're interested in understanding what it was like to use an Altair 8800, the software available for it, etc., this is a great way to go. I've been really tempted to get one myself.

<comment><USER4> In what way(s) is it finicky?

</comment></comment><comment><USER5> Been daydreaming about a full-size working replica of an IBM System/360 processor unit (mostly empty, with an RPi Zero inconspicuously glued to one of the corners inside).

<comment><USER6> Oh no, you've given me ideas now... How about old wardrobes painted to look like the cabinets? You could even get an old reel to reel tape player and put it behind some plexiglass for that tape drive effect.

</comment></comment><comment><USER7> If you want an 8800 you can use to measure things, check out the Digirule 2. An entire 8800. In a ruler.

<comment><USER8> [https://bradsprojects.com/digirule2/](https://bradsprojects.com/digirule2/)

</comment></comment><comment><USER9> This YouTube channel has a ton of great Altair videos. I learned so much! [https://www.youtube.com/playlist?list=PLB3mwSROoJ4KLWM8KwK0c...](https://www.youtube.com/playlist?list=PLB3mwSROoJ4KLWM8KwK0cD1dhX35wILBj)

</comment><comment><USER10> A computer with a backplane form-factor that mimicked the old S-100 bus but with modern components (and a modern bus speed) would be much more interesting.

<comment><USER11> Something like [https://www.tindie.com/products/semachthemonkey/rc2014-pro-h...](https://www.tindie.com/products/semachthemonkey/rc2014-pro- homebrew-z80-computer-kit/)

</comment></comment><comment><USER12> $621

<comment><USER13> If you don't care as much about the authentic look, there's an Altair clone on eBay that faithfully recreates the buttons, switches, and LEDS in the right places, but doesn't look like the Altair. I have one of these myself. It's $99. [https://www.ebay.com/itm/RETRO-ALTAIR-8800-S100-Arduno- CLONE...](https://www.ebay.com/itm/RETRO-ALTAIR-8800-S100-Arduno- CLONE/254718436145?hash=item3b4e66e331:g:XEoAAOSw5J1fLSAs)

<comment><USER14> Says it runs Zork. That's my benchmark.

<comment><USER13> It does! [https://gunkies.org/wiki/Zork#CP.2FM_.288080.2F8086.29](https://gunkies.org/wiki/Zork#CP.2FM_.288080.2F8086.29)</comment></comment></comment></comment>


Color Maximite 2 "boot to basic" new retro computer - <AUTHOR> https://www.youtube.com/watch?v=lzrX72aB7zg <comment><AUTHOR> This is a "new retro style" computer which boots to basic.

disclaimer: I have no connection at all with this project.

Home page:

[http://geoffg.net/maximite.html](http://geoffg.net/maximite.html)

Specifications:

[http://geoffg.net/CMM2_Description.html](http://geoffg.net/CMM2_Description.html)

Video reviews:

A review by cTrix: [https://www.youtube.com/watch?v=lzrX72aB7zg](https://www.youtube.com/watch?v=lzrX72aB7zg)

A review by the 8-bit guy: [https://youtu.be/IA7REQxohV4](https://youtu.be/IA7REQxohV4)

Data sheet of the CPU: [https://au.mouser.com/datasheet/2/389/dm00387108-1799185.pdf](https://au.mouser.com/datasheet/2/389/dm00387108-1799185.pdf)</comment>


Learn Echolocation like a Dolphin - <AUTHOR> http://www.wired.com/wiredscience/2009/06/echolocation/

<comment><AUTHOR> When I was in high school, I had a blind friend who used something similar to do some rather amazing things. He would follow me on his bicycle (!), tracking by the sound the bike made. Solo, he could turn into the driveway next to his house. When prompted, he told me he could tell where he was by the trees. What? "Yes, I can hear the sound the trees make". The light rustling of the leaves, the reflection of the bike's sound off the tree itself.

I suspect that we may use a bit of this already without being aware of it.

I have always felt that there are opportunities to extend our senses, not only by practice as suggested by the article, but also by some sort of electronic assist.

</comment><comment><USER2> A few months ago I had to spend four days with my eyes closed. I was surprised to discover that I could tell where my coffee was just by holding out my hands and tracking the heat source. I also tended to stop suddenly when walking around, feeling that something was wrong, and then finding that there was indeed an object out of place and in the way. Sometimes these were quite small - mug-sized (although not mugs).

Feynman had more to say about training the senses. You can read about it in his semi-autobiographical books.

</comment><comment><USER3> Comparing Human Echo location to a Dolphin is highly unfair, at least for the human. The Dolphins brain has specifically adapted to use this technique and it is quite impressive. Dolphins are actually able to see through things which block their view of an object. Meaning that they can distinguish objects without actually seeing them directly.

Here is more on this:

[http://www.guba.com/watch/2000977386?duration_step=0&fie...](http://www.guba.com/watch/2000977386?duration_step=0&fields=8&filter_tiny=0&pp=5&query=404934828&sb=7&set=5&sf=0&size_step=0&o=3&sample=1231730837:f40ae2aaa7e3b1508fe84d3aa954dc6b786be741)</comment>


Android permissions and hypocrisy - <AUTHOR> http://mjg59.dreamwidth.org/46403.html <comment><USER3> Any app can capture everything you put in your android clipboard and it does not need to ask for permission to do it.

So don't copy passwords into your clipboard!

<comment><USER4> Hmm, I know iOS allowed that as well for a long while (basically free-for-all access to the pasteboard). Was that fixed in later iOS versions?

<comment><USER5> It's even worse with Universal Clipboard, the feature that seamlessly shares your active clipboard between your mac and iOS devices. I have seen the official Facebook iOS app trigger a "Pasting from <mac-hostname>..." spinner when starting up, because Facebook silently steals your clipboard on startup/resume, and they are probably an API that happens to now possess Universal Clipboard powers and thus are triggering a clipboard content pull from the mac.

<comment><USER6> I'm still astonished people on HN trust Facebook enough to have any of their apps installed. Since day one their developers have shown complete disregard for users privacy.

<comment><USER7> I didn't really think about it until the iOS Facebook app helped itself to my Christmas morning photos this year. I had assumed that Apple had stronger protections in place for users' content. It's one thing to say in an alert or popup or something "did you take photos of the kids opening presents this morning? want to make a photo collage using our helpful tool?" and quite another to access my photos (and, presumably, other personal data) without prompting.

<comment><USER5> You must have granted the app permission to your photos/camera roll earlier. Still I agree it's sneaky for the app to go in uninvited at a later point in time.

<comment><USER8> Agreed. It might be nice if Apple extended their "Do you want to continue allowing XYZ to use Location Services" prompt to other permissions, provided it wasn't too aggressive.

<comment><USER5> Or even better, offer a restricted photo access permission that only works with the built-in image picker. Then at least the user has to tap on an image before it is transferred to the app. I don't care about the fancy custom image pickers with real time preview effects that various apps build in.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> My own muses and solution: [http://williamedwardscoder.tumblr.com/post/13316924653/bette...](http://williamedwardscoder.tumblr.com/post/13316924653/better- permissions-in-android)

Basically, back in the Symbian/UIQ days, we worked on this and came up with a way to embed apps within another visually even though they were separate apps with separate permissions.

So an app wouldn't need all the internet access stuff just because it embeds ads; instead, an ad-service running on the phone would embed ads in the space given to it by the app.

We primarily wanted to show contacts and online status etc inline without each app needing to be able to read your contacts or find out their online statuses.

The host app would basically use a UI widget that took a 'url' to what was going to be shown, and apps registered as providers of various url schemes e.g. uiq_contact:phonenumber_goes_here?display_options=whatever

<comment><USER10> That would be great! Both Android and iOS _partly_ implement it, but in each case it's underused.

On Android, an app can send an email just by posting an intent. That will open your favourite email app and create a new message, but crucially, you can check the contents yourself and decide whether or not to hit "send" or not. The app can't interfere and can't even tell whether it was sent (modulo underhand stuff like tracking pixels).

Unfortunately, the intents for "post a message to twitter/facebook/whatever" are badly designed and don't work well with most apps. So many apps just request direct access to your social media.

On iOS, you can deny Facebook and Twitter access to your photo library, yet still post photos: you just do it in the Photos app itself. Photos gets access to your social media, rather than vice-versa, and that's (probably) OK because Photos is built into the platform, not a third-party app.

Unfortunately people don't seem to know about that, and just use the (admittedly easier) workflow of sharing photos from within the Facebook or Twitter app. And sharing _multiple_ photos from Photos didn't work properly the last time I tried: it creates multiple posts rather than a single post with multiple photos.

So in each case the platforms offer the functionality you're looking for, but apps and/or users are too lazy to use it properly. I don't know what the solution is. Apple or Google could make it harder for apps to do the wrong thing, but that would probably just annoy users ("I upgraded my phone and now I can't share photos any more!")

<comment><USER11> And even on Android this functionality has a lot of holes. As an example, just try to find a robust way of sending an email with multiple attachments that only shows email apps and doesn't crash some of those apps.

</comment></comment></comment><comment><USER12> My solution is to use CyanogenMod (now LineageOS) and deny access when apps request it. To applications it looks like they can access my contacts, but if I deny it, they only get to see an empty list.

<comment><USER13> My solution is to buy an iPhone. I don't mean that as a snarky response, as I'd very much like to use an Android phone (And if it's just to be able to use Tasker). But I simply don't have time to bother with this stuff anymore, so I pay ~200$ more in exchange for my time (and privacy).

Secondly, I don't want to give anyone money that gives a crap about my device's security and privacy.

There was a similar article on HN a while ago that came to the same conclusion: [https://news.ycombinator.com/item?id=13056288](https://news.ycombinator.com/item?id=13056288)

<comment><USER14> I currently use an iPhone and it too isn't a good privacy solution either.

For example my pet peeve is that apps like Waze or Uber are allowed to only request full location tracking, even while running in the background. As a user you cannot restrict location tracking to happen only when the app is running. This is an either-or proposition. Either the user allows location tracking while in the background, or you cannot use the app.

And surely you can manually enable and disable location tracking per app, but that's way too cumbersome. Just imagine trying to start navigation while at a red light. Whereas with Android I used to be able to enable/disable location tracking globally, since you get a global shortcut that you can access in a swipe and tap.

I also use 1Password as a password manager. Well, iOS has the same problem as Android where apps can read the contents of your clipboard, including copied passwords. And compared with Android it's not common to see password managers use third-party keyboards or accessibility features to side-step copy/pasting passwords. And sure, apps have an API to integrate managers like 1Password or Lastpass, which is nice when it's there and it's surely nice when it works in Safari, but too few apps use it.

In other words, even though the privacy/security story is currently better for iOS, IMO it's not that good either and I hope that Apple and Google will work on improving this situation because I'm seriously thinking of going back to a dumb phone.

<comment><USER15> To be fair, those are app choices to require 'Always' for location tracking. You can most definitely restrict an app to use location only while using - <USER2> can't fault Apple or IOS for apps that (unnecessarily [1]) demand more.

One thing I really like about IOS is the reminder that an app has been using your location in the background for a while [2]

[1] [http://www.theverge.com/2016/11/30/13763714/uber-location- da...](http://www.theverge.com/2016/11/30/13763714/uber-location-data- tracking-app-privacy-ios-android) [2] [https://support.apple.com/library/content/dam/edam/applecare...](https://support.apple.com/library/content/dam/edam/applecare/images/en_US/iOS/iphone6-ios9-weather- app-using-location.jpg)

<comment><USER16> But Apple makes (seemingly) no effort to encourage developers to allow limited location access. Why can't iOS be in charge of when an app uses my location when the app is backgrounded?

The reminder only appears once per app, as far as I've noticed. I restored my phone recently for the first time in over a year, and had totally forgotten about the reminder feature.

</comment></comment></comment></comment></comment><comment><USER17> Has anyone noticed apps switching from requesting individual permissions to relying on Google Services permissions lately? For instance, Google Maps now need Google Services to have permissions to [1].

This makes it even harder to track which information apps are actually collecting (in case you grant all permissions to Google Services).

[1] [http://i63.tinypic.com/1zwt91.jpg](http://i63.tinypic.com/1zwt91.jpg)

<comment><USER18> Slightly tangential, but yesterday my Gmail app kindly informed me that I need to give Google Play Services the following permissions in order for it to function:

\- Body Sensors

\- Calendar

\- Camera

\- Contacts

\- Location

\- Microphone

\- Phone

\- SMS

\- Storage

This promptly led me to discover K-9 Mail. Not entirely incidentally, Google's Calendar was so helpful as to suggest that I install Google's fitness tracker to integrate with the Calendar. I politely declined the offer, and installed Etar.

<comment><USER19> Looks like it's a bug

[https://productforums.google.com/forum/#!topic/gmail/oTMPWq2...](https://productforums.google.com/forum/#!topic/gmail/oTMPWq2u5H4)

<comment><USER20> These days it's harder to tell whether something was a bug, or only became a bug after it was discovered.

</comment></comment></comment></comment><comment><USER21> This is not specific to Android, it is basically the antivirus industry in general. "Let's ask every possible permission and inject code everywhere in the OS so we can prevent other applications from doing so."

I am usually for modularity, but I think this kind of security is part of the OS' job, and we have to move to security models where third-party AVs do not exist.

Of course, this is not just my opinion, see [https://news.ycombinator.com/item?id=13082832](https://news.ycombinator.com/item?id=13082832) in particular.

</comment><comment><USER22> Some apps prefer to declare more permissions than they need because adding more permissions would stop app from autoupdating – user will need to manually confirm new permission when updating in Google Play. Android 4.X is running on nearly one third of the Android devices and there are apps with old permission model (eg. Snapchat), so that's still a thing in some apps.

I am not defending Meitu and Kaspersky though. Be careful installing new apps and look at apps' permissions.

<comment><USER23> It can fail both ways:

On the one hand you may not install an update because the app wants more permissions than you consider acceptable.

On the other hand you may not install the app at all if it asks for too many permissions during the initial install.

<comment><USER22> While I agree with you I also think that sadly average person doesn't really care about permissions at install time simply because there're lots of them. But app update is different -- there're usually 1-2 permission(s) added with update so there's huge chance that user will notice it and think about why these permissions are needed.

</comment></comment></comment><comment><USER24> I still wonder why Android does request permissions before application was run. Apple does it when app actually tries to use AB, location, camera, microphone, etc. You know the context of requirement then and are able to tell whether it is really required (and turn it off later). On Android you just blindly accept it, and app is free to go anywhere, anytime. Maybe I'm wrong and it got better now, but my recent experience with friend's Android was exactly as described. We got a couple of new contacts in address book and actively prevented sending sms to China from boiler-info app. Wtf?

<comment><USER25> Android uses runtime permissions since marshmallow, but the app has to support them otherwise it falls back to granting them all at install time.

<comment><USER24> That way android is stuck with tons of 4th-party software publishers that are not even professionals in programming. Stores are full of working evolutionlessware. Why don't they just present "ok/nope" dialog and fail a system call after "nope"?

<comment><USER25> It's not that simple. The app I work on now is pretty complex, and the only way we were able to get runtime permissions in normally was to commit to a complete rewrite of the app (that wasn't the justification for the rewrite). It's just not always the highest priority.

<comment><USER24> That's what I'm talking about. Must have used better wording to make it clear, sorry. It _is_ possible seamlessly at the OS level (as one of commenters noted about CM). But OS devs just kicked the responsibility to app devs.

</comment></comment></comment></comment></comment><comment><USER19> Isn't this solved with run-time permissions model since android 6? Customers can be informed before requiring individual permissions, in a context where it is understandable, such as requiring WRITE_EXTERNAL_STORAGE when saving a picture. Am I missing something?

<comment><USER26> It's not obvious to users that READ_PHONE_STATE means the ability to obtain your IMEI, and if an app just exits when you deny a permission (or lies to you about why it needs it) what do you expect most users to end up doing?

<comment><USER4> The user-facing text for READ_PHONE_STATE is "Read and control phone status __and identity__".

How more obvious do you want it to be?

And I expect users to uninstall the app or live with the consequences. Because what other option is there?

If you want a kindergarten OS where a corporation prevents you from running apps according to their daily whim and maximization of profits - get an iPhone. Apple will protect you by making sure you run only kids friendly apps which only work with their dongles and hardwares. And that's ok, but we do not need two operating systems with same limitations that only differ in branding. In corporate controlled Apple world, things like Linux do not exist.

<comment><USER26> I only know what "identity" means in this case because I've read the SDK docs. There's any number of things that phone identity could mean other than IMEI.

(Before you accuse me of just wanting to restrict what people can do with their devices, I'm on the board of directors of the Free Software Foundation - I am very, _very_ interested in ensuring that ultimately end-users are able to do whatever they want to do with things that they own. But that's not incompatible with the OS being designed to do its best to ensure informed consent for whatever an ap wants to do)

<comment><USER4> Of course, but is there even a way to phrase this better? Google could (and probably should) write "allows access to IMEI", but I'm not sure that adds a lot of informational content.

Don't get me wrong - I think this is still a severe problem. The fact that Google made a half-arsed solution where apps can just target older API and get away without asking for permission is horrible. The fact that apps can extort users with "give us contacts or I won't run" is also horrible.

But I'm out of ideas on how to fix this without giving control over to a single huge corporate entity which will rather lock you out of your own device than to deal with slight possibility of and kind of liability :/

<comment><USER26> My understanding is that iOS doesn't give apps access to the IMEI - it gives them a tracking identifier that users can disable. Having the OS empower users feels like a better solution than obfuscating what information you're giving up to apps.

<comment><USER4> Android has it as well - you either have the "Advertising ID" which behaves the same way as the iOS one (requires no permission on either OS) or ANDROID_ID (also requires no permission).

Both are reset with factory reset, but apps still for some reason demand tracking via IMEI.

<comment><USER27> > Both are reset with factory reset, but apps still for some reason demand > tracking via IMEI.

Because from the marketers perspective, a fixed, constant, identifier of a particular phone beats out one that can change periodically. There's more tracking and big-data possibilities from the fixed never changing IMEI value. So that is what they want.

<comment><USER28> Except you probably want the reset anyway, since most normal people don't factory reset unless the phone changes owner.

<comment><USER27> What I personally would want is no way for any advertiser to ever send any ad to my phone in any way, ever.

But given that I'll not likely ever reach that point, I'd settle for those advertisers not receiving any unique identifier from my phone that allows them to know anything more than "ad X was sent to an anonymous phone".

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER29> Everyone just need to read a bit more about Kaspersky family. [https://en.wikipedia.org/wiki/Natalya_Kaspersky](https://en.wikipedia.org/wiki/Natalya_Kaspersky)

For example: she [N Kaspersky] believes that all personal data, such as search history, geolocation, contacts, correspondence, photo and video materials, should belong to the State.[11]

<comment><USER30> And Eugene Kaspersky himself has ties to KGB/FSB.

[https://en.wikipedia.org/wiki/Eugene_Kaspersky#Alleged_affil...](https://en.wikipedia.org/wiki/Eugene_Kaspersky#Alleged_affiliations_with_Russia)

</comment></comment><comment><USER31> I'm in the market for either a iPhone 7 or OnePlus 3T, with the latter running OxygenOS, which is based off Android Nougat I believe.

Do concerns around Android security apply to all Android devices and versions or are there exceptions?

<comment><USER32> Android's main security issue is systemic and applies to all phones and all versions. If tomorrow morning a new major version of Android fixed every deep seated security issue there was, it'd still be years before it had a sizable marketshare.

<comment><USER31> I guess this is the answer most users will be looking for. I really like the proposition of the OnePlus 3T and I appreciate the ability to load other ROM's but I'm really just looking for the best baseline secure environment that doesn't require me to either be super vigilant about installing apps or aggressively manage permission on a per-app basis.

</comment></comment></comment><comment><USER33> With a title like that, I was assuming that this post would have something to do with the hypocrisy surrounding android's audio capture permissions.

Want to make a WiFi-based audio adapter and support Android (without requiring root)? Too bad. Only the Chromecast app is allowed to request permission for system audio capture.

</comment><comment><USER34> CopperheadOS is trying at least. [https://mobile.twitter.com/CopperheadOS/status/7873572570296...](https://mobile.twitter.com/CopperheadOS/status/787357257029685248)

</comment><comment><USER35> > _The moral here isn 't that Kaspersky are evil or that Meitu are virtuous. > It's that talking about application permissions is difficult_

Maybe. Or the lesson could be: the fewer apps the better.

</comment><comment><USER36> A friend of mine and I wrote an app which you can use to find apps without suspicous permissions _before_ installing: [https://play.google.com/store/apps/details?id=de.steppicrew....](https://play.google.com/store/apps/details?id=de.steppicrew.saferplay) We didn't do any marketing because we just scratched our own itch, but I always use it when seaching for a new app. Doesn't solve the problem, put makes it manageable.

</comment><comment><USER37> There really is a lot of things to improve about permissions. Like Apple and Android's default camera apps requesting access to camera... really? Or contact app asking permission to list contacts (on android at least).

Setting up a new phone or tablet is like dismissing 99 dialogs every time.

I indeed hope in the future there will be a better balance between user experience and user privacy.

<comment><USER38> How often do you upgrade or purchase a new Apple device? Once per year? I'll take one instance of setting up permissions for stock apps (Many of which I don't use) over granting them unfettered access to my data and device services any day of the year. For instance, under no circumstances do I want Location Services enabled for: "App Store, Camera, Facebook, Messages, Siri, Twitter, HomeKit, Location based Alerts or Ads or Suggestions, WiFi Networking, Frequent Locations, Diagnostics and Usage, or Popular Near Me. I'd be happier if I could disable location access by modem too (GPS, Bluetooth, and WiFi) but it isn't that granular.

<comment><USER37> Offer a device to a novice and watch him/her panic over the incredibly huge amount of popups. (I saw my mom)

How frequent do I buy a new device shouldn't be a reason for onboarding to be such a hassle.

Of course location is a good exemple of permissions you don't want to give to every app, but I gave example of apps asking for obvious permissions.

Camera app (Still love this example, sorry) ask access for camera, and oh storage... really? Both of them are really obvious. I don't know anyone using camera just to see the preview, but maybe.

</comment></comment></comment><comment><USER39> Hi, i would like to draw the attention of you, the people with more expertise than I to another app that at least for me is more terrifying Xiaomi Mi Fit ([https://play.google.com/store/apps/details?id=com.xiaomi.hm....](https://play.google.com/store/apps/details?id=com.xiaomi.hm.health)), because it also takes all the intrusive permissions (modify system settings?!), but also takes all this info and combines it with your health data. Furthermore it is very hard to find it's privacy policy (I may have seen it once during registration in the app and it said "it's scattered around the terms and aggreements). This comment may be burried, but I hope at least someone, who's better in this than I will check it

<comment><USER40> Modify system settings permission is needed when your app needs to change network state. Previously using the Change Network State permission was enough, but since Android 6 it's no longer suffice. I imagine that app probably need to access the watch accessory over Bluetooth and need that permission to make the Bluetooth turn on automatically.

</comment></comment><comment><USER41> Android permissions are full of bugs. Even they prevented call recording on Android 7, apps on google play can overcome this by directly communicating with drivers.

</comment><comment><USER42> I stopped using TrueCaller because not only this app gets everything out of your phonebook, it puts it on the web for others to see. And that's exactly how you see other's contact details too.

Uninstalled after deactivating my account and then used [https://www.truecaller.com/unlist](https://www.truecaller.com/unlist) but my number is still listed.

</comment><comment><USER43> There was a long discussion about this on /r/android. [https://www.reddit.com/r/Android/comments/5oyvun/psa_dont_in...](https://www.reddit.com/r/Android/comments/5oyvun/psa_dont_install_the_meitu_photo_app_its_sending/)

</comment><comment><USER44> Solving the issue that was mentioned about how to give an app developer a unique id for a device and still give the user privacy was solved problem with Windows Mobile before the first iPhone came out. The OS would give a developer a unique identifier for only their app that was different per app.

</comment><comment><USER45> It doesn't always have to be like this, on Android:

[https://twitter.com/BramStolk/status/421750337750327296](https://twitter.com/BramStolk/status/421750337750327296)

</comment><comment><USER46> Do newer versions of Android ask for permission on first use of every such feature? Or it was Cyanogenmod feature?

<comment><USER47> Yes they do

</comment></comment><comment><USER48> Those Kaspersky permissions look like permissions on the payload you can create with Metasploit...

</comment><comment><USER49> Android (or anything Google) means close to zero privacy.

</comment><comment><USER50> >Why does Kaspersky want the ability to record audio? Why does it want to be able to send SMSes? Why does it want to read my contacts?

Block unwanted phone calls and SMS texts, filter out dangerous links and sites

>Why does it need my fine-grained location?

To find your lost Android phone or tablet

>Why is it able to modify my settings?

To be able to remove viruses and other threats from smartphones and tablets

\---

I can't even open this website with Noscript because of Cloudflare. Why do you need to stream all your unsecure (I'm talking about js, not https) user traffic through 3rd party providers?

</comment><comment><USER51> " ... this is the sort of thing that capitalism is inherently going to end up making use of."

I just stopped reading after this.

<comment><USER52> Well, isn't it true?

Nowadays users (and their data) are the means of production and capitalists are using it to their advantage. Libertarian appeal to consumer responsibility is too idyllic. Consumers are mostly not responsible and often misinformed and easy to manipulate.

<comment><USER51> "capitalists are using it to their advantage"

yes, this is true but by the same token you can say that socialists use this data to better target users with their socialist agenda.

My point is, there is no need for introducing this type of "innocent" remarks because it only creates more hype around the whole capitalism vs. socialism thing.

<comment><USER52> Then say that. "I stopped reading" comments are not constructive. They lack content and can't be argued with.</comment></comment></comment></comment>