Facebook Apps transmit Personal IDs and Friends' Names to Advertisers - <AUTHOR> http://online.wsj.com/article/SB10001424052702304772804575558484075236968.html?mod=djemalertTECH <comment><USER2> Hmm. This is very interesting.

A few facts:

1\. When you embed an iframe with fb:iframe, the parameters Facebook passes to your app get passed to the iframe automatically. This includes the Facebook UID. This is the way everyone has always embedded Facebook ad units and AFAIK nobody has ever been punished for doing so. I've had people at Facebook look over my apps with a fine tooth comb when dealing with TOS violations and this has never once come up.

2\. Facebook will take action against apps if people use fb-provided widgets in ways that "violate" the TOS, i.e., if Facebook's own widgets violate the TOS they will take action against the app.

This happened to be with the fb:wall widget, where Facebook told me I wasn't allowed to have comments auto-post to people's walls (the default behavior) and must include a "report" link to every comment (impossible / not a feature of fb:wall). They disabled feed posting for one of my apps due to that "violation."

3\. Facebook, as an organization, hates, hates, hates bad press. They will move mountains to prevent or preempt bad press. I've had people at Facebook tell me more-or-less verbatim that whatever I did, my applications were not allowed to generate bad press for Facebook. If they did, I would be banned.

4\. Facebook will scapegoat companies. When the Scamville drama happened, Facebook banned Gambit payments from the platform and threatened any application developer with banning if they used Gambit. They were no worse than Offerpal or Super Rewards with respect to the types of offers they were running -- everyone was getting their offers from the same pool -- but Facebook banned Gambit and implicitly endorsed Offerpal and Super Rewards.

Gambit was the smallest of the three, so the general feeling in the FB developer community is that they picked the weakest one and took them out to show how "serious" they were in dealing with the problem. They also made SR and Offerpal clean up their offers and punished Zynga for running questionable offers, but only Gambit was permanently and forever banned.

So, given the above, I have to wonder...did Facebook ban lolapps, the smallest of the major FB game companies, from the platform as a way to preempt the press fallout from this article?

Very interesting.

<comment><USER3> I really like your comment, and appreciate that someone with real world experience is giving an inside look into dealing with Facebook.

I doubt any viable organization would act any differently about bad press. Are you trying to say in your third point that Facebook takes it to an extreme beyond other companies you've worked with? Could you expand on your thought?

Why was Gambit the weakest of the three payment companies? From your perspective, is it possible that the FB dev scuttlebutt was conspiracy theory, or are you reasonably sure they used Gambit as their sacrificial lamb?

Thanks for your insight.

<comment><USER2> 1\. No, I'm just saying Facebook reacts very strongly to bad press. Maybe more or less strongly than other companies, but they don't typically take swift action on the platform (e.g., putting a 50-person company out of business overnight) unless there's a bad press story lurking somewhere.

That's their MO.

2\. I know some of the parties involved, and Gambit wasn't doing anything differently than the other offer providers in this regard.

Even if they were being more aggressive, say, why not ban them until they cleaned up their act vs. banning them forever?

And why ban any developer who decided to use them, even if they were only serving up compliant ads?

Facebook was going so far as to send out C&Ds to developers using Gambit at one point.

</comment></comment></comment><comment><AUTHOR> Specifically:

"The apps, ranked by research company Inside Network Inc. (based on monthly users), include Zynga Game Network Inc.'s FarmVille, with 59 million users, and Texas HoldEm Poker and FrontierVille. Three of the top 10 apps, including FarmVille, also have been transmitting personal information about a user's friends to outside companies...

The information being transmitted is one of Facebook's basic building blocks: the unique "Facebook ID" number assigned to every user on the site. Since a Facebook user ID is a public part of any Facebook profile, anyone can use an ID number to look up a person's name, using a standard Web browser, even if that person has set all of his or her Facebook information to be private. For other users, the Facebook ID reveals information they have set to share with "everyone," including age, residence, occupation and photos.

The apps reviewed by the Journal were sending Facebook ID numbers to at least 25 advertising and data firms, several of which build profiles of Internet users by tracking their online activities."

<comment><USER4> Ironically, fb_id is one of the big missing pieces in the personal datadump that Facebook users can now download.

<comment><USER5> It is trivial to identify. If you don't have a vanity URL, it is in your profile URL.

<comment><USER6> How do you find it if you do have a vanity URL?

<comment><USER7> [http://graph.facebook.com/<user_id>](http://graph.facebook.com/<user_id>);

</comment></comment></comment></comment></comment><comment><USER8> In the article, Rapleaf says de-anonymized linking of ID's to real names "wasn't intentional." That's a little hard to believe -- isn't the point of the company to have a massive person database of information like this?

<comment><USER9> Yes. The main crux of their business is turning ids/email-addresses into personal profiles.

<comment><USER10> OTOH, they may not actually care what your name is; it's probably less uniquely identifying than your FB ID.

</comment></comment></comment><comment><USER11> _The apps reviewed by the Journal were sending Facebook ID numbers to at least 25 advertising and data firms, several of which build profiles of Internet users by tracking their online activities._

This doesn't surprise me at all, it was just a matter of time before ad networks and retargeters, et al, caught up to include Facebook. FB's "social plugins" and the cookies they leave laying around give these companies an incredibly reliable way of identifying unique users and mapping their profiles. Which is very valuable to them.

One of the larger sites I run was recently approached by an ad network to drop a pixel upon user registration that would pair a user's email address with an identifier for unique tagging within their ad network. I declined for ethical reasons, but it was interesting nonetheless to see that this pairing is so valuable to ad networks, that they would pay for it separate from any display services.

</comment><comment><USER12> Serious question:

How many people _didn't_ see this coming?

Using an app gives it additional info about you, and _nothing_ prevents it from passing that along to outside sources. And now we find out that _all_ of the top 10 applications are doing just that? Surprise, surprise.

Anyone who thinks Facebook is _anything_ other than a machine that turns your information into cash for Facebook is kidding themselves.

<comment><USER2> You're speaking out of ignorance.

First, Facebook can and does police what people pass to third-party ad networks. When the FB platform first launched app developers did what you're describing.

In mid-2008 Facebook amended the TOS to prevent people from passing in PII to third-party ad networks. Apps that did this got banned.

In mid-2009 Facebook again amended the TOS to prevent people from passing in their friends UIDs, and apps doing this also got banned. In addition at least two ad networks were banned from ever advertising on the FB Platform again.

This nonsense from the WSJ is about passing your Facebook UID to third-party application, which (unlike the two cases above) happens automatically for every developer that has ever used any ad network.

Your Facebook UID is not private information. The only information one can get with your Facebook UID is the information you've decided to make public.

Now, you can argue that Facebook has incentivized people to overshare and not realize the consequences. That's fine.

But this article is 100% not about developers passing personal data to third- party ad networks, unless you somehow consider your Facebook user ID personal data. A stretch, considering until a year or so ago it was part of your profile URL, and still is for many people.

<comment><USER13> That's not entirely true, your Facebook UID always maps to your real name, gender, and your locale (country ie: en_us etc). That information in the hands of someone clever is more than ample to make some pretty decent guesses as to your identity, especially when you can pair it with other data that you may or may not have collected in your own app. In a previous job I held where we dealt with this sort of stuff facebook ids were generally thought of as PII.

</comment></comment></comment><comment><USER14> When you sign into a facebook app you give away all sorts of interesting information. Check out <http://www.rabidgremlin.com/fbprivacy/> and click on the "view raw data" links to see what I mean.

</comment><comment><USER15> This to me is probably the first large visible salvo in the coming "personal information wars" I've personally predicted for some time now that we can expect to see for the next 10-20 years play out between corporations and consumers.

On the one side, you've got ad networks who are salivating at the thought and willing to pay big bucks in order to target tiny demographic buckets of consumers, but cannot get their hands on the necessary information, because consumers want them to fuck off.

Along comes Zynga, bless their hearts, who have cracked the code of human behavior in order to get consumers to do whatever it takes to keep playing their games. The poor bastards, after spending their last bit of disposable income on virtual cows and sheep are either willing to or are unknowingly handing over the keys to their personal information in order to keep getting their daily hits of the social gaming drug.

So, how does the personal information get extracted from the consumer and put into the hands of the ad network?

In the middle, you've got the granddaddy of all personal data warehouses, Facebook, whose future rests upon bringing consumers to their site in order to gather personal information for their ad platform or, more recently, to reap the cash cow of virtual game items through the credits system they're launching.

And finally, next to the advertisers, you've got the aggregators, who are jumping through whatever hoops necessary in order to get this information in order to provide it directly to ad networks through a nice, clean, fast API or tracking cookie for the ad networks to use.

According to the article allegedly they're getting the social gaming providers to send it along. So the circle's complete. If the story is true (and I'm not sure it is), they're basically keeping the social gaming companies profitable by either paying them for this data or allowing them to use it for more efficient advertising. Their survival makes Facebook happy, since it's driving more people back to the site and giving them more Facebook credit revenue. Facebook would never be able to build this type of direct-to-the-ad-network data pipe the ad networks need to operate, but certainly benefits from it existing.

What's happening here is what I'm going to coin right here on HN: "information laundering." Facebook doesn't give away your personal information, they give it to innocent gaming companies. Who then give it to aggregators. Who then give it to advertising networks. Plausible deniability for everyone!

It's almost beautiful how it's all come together, each member of this ecosystem now dependent on the next. If any single person pulls the plug, the whole thing comes crashing down. It seems the valley's created a monster. No, it's not a conspiracy. It's just everyone acting "rationally selfish." But this behavior should come as no surprise to anyone who has been watching the majority of the types of companies launching at conferences the last several years.

So, what's next? Here's the worrisome part. The aggregation and dissemination of this type of personal information has been up until now largely used (we assume) for benign purposes like advertising. But, we're now in an era where access to this information is easy (APIs) and access to massive computing power (AWS) and analysis tools (Hadoop) is cheap.

It doesn't take much of an imagination to come up with ways this information can be used for far more nefarious purposes than selling weight loss pills. Surely the politicians are already plugged into this in order to craft advertising to manipulate people into voting for their guy. But it could be much worse than this, of course.

The truth is, the "information trade" will likely have the same connotation as the "drug trade" for the Millennials as they get older. As soon as there is a mainstream story about how this type of leak has ruined lives, or directly led to large scale fraud, blackmail, or even violence, things will start to happen.

I expect the next phase of this will play out in the press (expect alarmist articles like this one to be followed with more alarmist news pieces on TV) until some politician (as likely a Republican or Democrat, for different reasons of course) takes it up as their pet cause. It will start as "think of the children!" but over the years this will turn into "think of us!" as the children turn into the adults.

I expect to see legislation eventually that criminalizes a lot of the practices going on today with regards to aggregating and transmitting large amounts of personal information.

</comment><comment><USER16> I thought this was common knowledge.

</comment><comment><USER17> As some hn reader pointed out -- and I wish I remembered his or her name -- if you aren't paying for it, you are the product.

fb is going to continue to aggressively monetize the information people have given them. I'd wager Zuckerberg thinks he is running a $20+ billion dollar company, and all that money is going to come from using your information to sell you to advertisers.

<comment><USER18> Was actually from MeFi, I believe (and I agree that it's a fantastically succinct observation):

"If you are not paying for it, you're not the customer; you're the product being sold."

<http://www.metafilter.com/95152/Userdriven-discontent></comment></comment>


You Can't Quit, I Dare You - <AUTHOR> http://brooksreview.net/2013/03/quit-i-dare-you/

<comment><USER2> > It's not an easy thing to do, mostly because old habits die hard, but it is > actually very possible.

That's a different premise than most people are using.

I wouldn't quit Google services because its _possible._ I would quit Google services if it was _personally worth it._

And it simply isn't. Not for me and not for the overwhelming majority of internet users.

Oddly, he confuses why it might be worth it too. He says at the beginning that it is "mostly because old habits die hard", but ends with "people are willing to give up their privacy before handing over cash". Neither of these address the utility of being in the Google ecosystem, especially if you own several Android devices.

I think its good to talk about the practicalities of leaving Google, but I don't think this article does a very thorough job. It just takes jabs and offers a few poor alternatives.

<comment>

The author mentions he uses iCloud instead of Gmail, but doesn't actually say why there would be any material difference between the two. I know that alternatives to Gmail exist, but I need to know why I'd want to change my email address for more than a lark.

<comment>

The author claims DuckDuckGo is "fantastic", but gives zero reasons why except for different search results. I just tried it again, and got _nothing_ useful for "showtimes near me", "movies near me", "NBA standings", "Cafes in Nashua", and a few recipes (for recipes Google shows reviews, total time and calories in-line). Try "flights from SFO" in each. Wow. Prices to popular destinations _in-line_ in Google.

What different search results, make DuckDuckGo fantastic? Does anyone have any examples?

Here we are _at long last_ in the age of the Semantic Web, 12 years after Berners-Lee declared it a thing (and 7 years since he lamented that his vision had gone unrealized). The combination of web semantics and very powerful inferences have made Google (and Bing) search into wonderful powerhouses of utility with so much information above the fold and even before the click! DuckDuckGo has _nothing_ in this space.

One of the best tests for search engines in my opinion is what it does it poor or incomplete search terms. Often I don't know how to spell something, or someone has related something to me with incomplete information. What if someone told me to look up a cat breed called the "egyptian maw". DuckDuckGo returns nothing at all useful, Google correctly figures out that my friend spelled the breed wrong, its really "egyptian mau".

Interestingly, trying DuckDuckGo with capital letters ("Egyptian Maw", or merely capitalizing Egyptian) produces _completely different results_ , in this case more correct ones. That certainly fits the "DuckDuckGo is different" mold, but in a way that's horrifying.

<comment><USER3> To be fair to DuckDuckGo, I tried your searches and did get useful results. "movies near me" took me to Yahoo! Movies, which showed me theaters near me. I could also search for something like "movies [zip code]". I tried it for a few different zip codes and it always got me the results I wanted, but not always through the same site. For one zip code, it brought up the Fandango page for that area, which had exactly what I wanted. For another, it took me right to the showtime page of the only theater in the town.

As for "NBA standings," I'm not a huge NBA guy, so maybe I don't know what you wanted, but it takes me right to nba.com/standings, which is the same as the top result on Google. The only difference that I can tell is that Google puts some of the standings in a table on the search results page, which doesn't seem like a huge deal to me.

It sounds like you're judging a search engine based solely on the information it takes out of links and puts in its own format on the results page, not by the links it provides. While I agree that bells and whistles like extracting certain results into a table on the results page are cool, that hardly seems to me like the ultimate test of a search engine. Actually I'd say that's one of the least important factors in a search engine, to me anyway.

Anyway, with all that said, I don't have anything against Google. I just don't agree with your assessment of DuckDuckGo.

Edit: That's not to say DuckDuckGo is perfect. I queried my own name and found that DuckDuckGo didn't pick up on all the stuff that Google does about me. For instance, I can't seem to find my linkedin page through DuckDuckGo at all.

Still, honestly, I think it seems pretty decent for a search engine. Not better than Google, but certainly useful.

Edit2: DuckDuckGo actually has some cool features that Google does not.

Search "password generator" on DDG and it actually generates a password for you above the search results. Search "hackage reactive-banana" and it gives you a summary of the Haskell package above the search results.

<comment><USER2> The author touted DuckDuckGo returning different results as an advantage, so I've been looking for differences between DuckDuckGo and Google, not similarities, and semantic data pulled is the easiest way to show that Google results are more informative faster.

After all, if we ignore all the sugar from Google results, and they merely return the same top result, why then would I use DuckDuckGo?

I've been fooling with it for 15 minutes now. Are there _any_ good examples of DuckDuckGo results being more relevant than Google results?

<comment><USER3> That's a fair point, and I agree with you that it doesn't really seem to give significantly different results from Google, but regardless of what the author of the post said, I think the main intended selling point of DuckDuckGo is that it doesn't track user information at all. It's not an advertising company, and Google is.

</comment></comment></comment></comment></comment></comment><comment><USER4> Hmmmm, I suspect that Google, just like Facebook, creates "shadow profiles" on non-members, ie profiles on unique non-member users across a very large part of the internet (G: any site using google analytics, a +1 button, etc; FB: any site with FB like button) As such, escape from Google or FB is near- impossible.

You might say: sure, but at least they will not know my identity!

Try again. Most US ISPs sell click-stream data. Several services that offer those "interesting articles elsewhere on the web" that you see on various news outlets, have in their terms that ANY registration submitted on those sites is passed on to them as well by their "publishing partners". Combine IP addresses and date/timestamps, and very detailed user profiles, including personally identifiable information, can and are compiled.

The only way to escape the clutches of G/FB is to disconnect from the web.

PS I'm fully aware of the very large number of additional tools/options one can employ to remain more anonymous (FB disconnect, VPNs, Ghostery etc etc) but remember: just _one_ "essential" service that you cannot live without and requires a real name (mobile phone, landline, credit card, etc.) is all that is needed to "close the loop".

<comment><USER5> As a paranoid would say: that's what they want you to believe.

Now that people are learning about how companies use their data in dubious ways (and they can't deny it, only PR-speak it), it's in their best interest to twist the narrative so that people believe that they now have no agency—that everyone is being tracked all the time, and that there's no way to escape that.

Why? Because if you think there's no way around it, you just give up and eventually stop worrying about being tracked and analyzed. Since you no longer care, you give up on blocking tools, and most importantly for them: you give up on trying to find alternative companies that respect your privacy.

<comment><USER6> Perhaps, but there is a kernel of truth in what the parent comment says. As long as an IP address can be associated to an undeniable identifier, like an address, credit card, SSN, etc., your identity and activity can ultimately be tracked. Perhaps not by Google, but by your ISP and thus the government who can coerce that ISP, or by business partners your ISP sells that information to.

The buck has to stop somewhere--and it stops at what packets your ISP handles, and thus has the ability to inspect, on your IP address's behalf.

</comment></comment></comment><comment><USER7> I don't see Google Maps mentioned here. That's proving the hardest to quit for me - by far. I moved to NYC a month ago and it would be like an order of magnitude harder to get around without GMaps' transit, walking and biking directions.

For biking, <http://ridethecity.org> actually gives great directions comparable to GMaps but the site isn't mobile friendly at all - have to memorize the route before you set out. I know there are alternatives for transit directions but I haven't tried them - suggestions? And I haven't seen walking directions offered anywhere.

Even for browsing maps on mobile I haven't found a good option yet. Of course there's <http://openstreetmap.org/> on desktop, but it doesn't show your current location and isn't very mobile friendly. There's an "OSM Browser" app for Android, but it's solidly mediocre - no directions, doesn't show current location, and you can only scroll one screen at a time, like MapQuest circa 2002.

It's my hope that I'm simply ignorant and some smart HNers will reply with apps/sites I haven't heard of yet... Anyone?

<comment><USER8> I like Nokia's map app (<http://here.com>). Haven't tried it on mobile but it's great on the desktop.

</comment></comment><comment><USER9> I stopped using Google's search a long time ago because of the monstrous "instant" feature. Sure, you can turn it off, but you have to be signed in to do that. And if you're signed in, you're being very closely monitored. It wasn't that hard.

<comment><USER10> You can add &complete=0 to the URL, or avoid running JavaScript on encrypted.google.com, or use <https://startpage.com/> to see results that are very similar to Google Search

</comment></comment><comment><USER11> _I like to run my email on my server, but it's a significant undertaking and I don't recommend you do that._

I agree with Ben on this point, but don't really understand why things are this way. In looking for a replacement for Google Reader I found a bunch of high quality self hosted options. Similarly, hosting a website on your own server (or one you rent from someone else) is a pretty trivial exercise for anyone that reads Hacker News.

So why is email so damn hard? Where is the Wordpress of email?

<comment><USER12> Spam is one aspect of why email is hard, and having more than just a few email accounts on your host helps to tackle that problem. Take a look in your Gmail spam folder at how much they've managed to weed out.

<comment><USER13> I self host my personal email and have to use gmail at work. Spam is actually the one thing that I find gmail weaker at compared with self hosting.

My nearly stock Postfix setup with a few basic anti-spam settings, rejects about 80% of spam. Then stock SpamAssassin config (with a nightly sa-update cron job) gets accuracy somewhere into the 90s. The SpamAssassin Bayes plugin takes it to very close to 100% (maybe 2 or 3 Spams per year).

The best part is that I'm in control -- when someone continues to send annoying email even after being asked to stop (like our daughter's old childcare provider), I can add a Postfix rule to reject their mail at SMTP time and enjoy knowing that for every email they send, they'll get a Non- delivery report from their SMTP server complete with a personal message from me.

Another example: an acquaintance liked to send mass mailers to everyone in his address book of the quality on par with most people's facebook/twitter status updates, followed by a barrage of useless replies from people I don't know. After realizing I never want to see those kinds of messages from anyone, I added a regex to Postfix header_checks to reject messages with more that 15 @ symbols in To: or Cc:.

Another benefit of self hosting is unlimited temporary email aliases (e.g. email@example.com). Many places don't accept the standard firstname.lastname@example.com sub-address that gmail supports (and a spammer can easily identify), and it's nice to be able to tell when companies abuse my email.

</comment></comment></comment><comment><USER14> Contrary to what the author believes and would want us to believe, at this point I _really_ don't see how is Google going to "come and get me" with the data that I _choose to_ give it to them. Yes, I have given my credit card number to its Play Store, but I have given that to like 15 other services on the internet who just charge me when appropriate. They have my personal emails, its machines read them and show me ads, which I block with adblock plus anyway. It is training its natural language processing algorithms by reading my emails, and not giving me a share of them. I'm fine with that. It's giving me a really unmatched email service for that cost, and I understand that. It is acting according to its privacy policy, which it is trying to unify across its products. I believe so far, except one or two occasions they have been pretty fair to it.

</comment><comment><USER15> So you quit using Google, but you advocate products by Apple and MS? Clearly those companies don't want to monetize your data. Ever.

</comment><comment><USER16> I'm almost completely off Google (started my exodus late last year) and it wasn't nearly as difficult as I thought it'd be.

I moved into the Microsoft ecosystem.

It's all there. Bing is surprisingly good, SkyDrive surpasses even Dropbox and Office 365 w/ OneNote is the best office suite available. I even got a Windows Phone 8 (yeah, I can get carried away sometimes).

The point is, there's a whole new world out there that's sans Google, and it's probably better than you imagine it to be.

<comment><USER17> It's great that you're happy in the Microsoft ecosystem, but other than the "not Google" checkbox, what issues with being in the Google ecosystem does being in the Microsoft ecosystem solve?

<comment><USER16> It's an upgrade and a change from the usual, and the change didn't disrupt my workflow. If anything, it streamlined it.

But in terms of privacy, it just means I have a new taskmaster.

</comment></comment></comment><comment><USER18> Just tried searching "march madness" and "yuba city hotels" in Bing, DuckDuckGo, and Google. I don't think I will be switching.

I use Google Apps for Business: 25GB email inbox plus 5GB doc storage, custom domain, Google Docs, admin controls, two-step verification, best spam filtering on the planet, integrated calendars, video chat, mobile support, UI support for multiple accounts (business and personal), 99.9% uptime, and no ads for $5 per month / per user.

<comment><USER19> Until you do something they don't approve of and they shut you out of EVERYTHING overnight.

If Google provided a no-shutdown guarantee and service to service shutdown isolation I would consider them for business. Until such time, no friggin way.

There are far better ways to deal with violators than killing off their entire account and every single service they use. Staged restrictions with feedback comes to mind.

<comment><USER18> In the nine years I have been using GMail, this has never been an issue for me.

</comment></comment></comment><comment><USER20> some more points:

maps - replace them with OpenStreetMap, that could even be used offline

news - my <http://w3dig.com/> aims on replacing this in the long run

play - I dont have it installed on my phone, and only use apk's I compiled myself

youtube - I host videos only my own server, but I still watch yt, if someone sends me a link

security - google blocks many one click share hosters, claiming that they are attack sites. I have this firefox/google service off since that time.

chrome - I prefer to turn of google features in FF, I wont switch to chrome, not for money or good words

analytics - a 127.0.0.1 in your /etc/hosts might help ;-)

apis - _ouch_ they are really evil. Sites wont work, if you turn them off, but google will monitor you if you leave them on.

... the evil big brother google is much bigger then just search

<comment><USER21> You're fighting the Good Fight, though I personally think it's fine to use the Play Store. You use FF Nightly?

</comment></comment><comment><USER22> I regularly search for fairly obscure stuff in several languages, so when I decided to quit Google Search trying to use alternatives like DuckDuckGo [1], Ixquick [2] or Bing [3] didn't quite work out for me. The best solution I found was to use StartPage [4], which works like a proxy for Google. Based on over a year of experience I can highly recommend it. I rarely have to resort to using Google Search directly and at times I prefer the non-personalized results that StartPage gives me. Still not sure if I like their domain- squattery name, though.

[1] <https://duckduckgo.com/>

[2] <https://www.ixquick.com/>

[3] <http://www.bing.com/>

[4] <https://startpage.com/>

<comment><USER23> Startpage and Ixquick are really the same thing:

 _"Startpage was released in 2009 in the United States as a new name for the Ixquick search engine. Because the name Ixquick can be somewhat difficult to remember and spell, people asked us for an easier name, and we were happy to oblige. Startpage uses Ixquick's search methodologies and privacy features, and is governed by the same privacy policies."_ [1]

[1] <https://startpage.com/eng/company-background.html>

<comment><USER22> Not quite. Their information pages might not make this immediately clear but currently Ixquick aggregates the results from several sources while StartPage uses Google exclusively (hence the "Enhanced by Google" logo).

For a bit of fun try comparing the results they give you for the same query.

</comment></comment></comment><comment><USER24> I've been attempting this to some extent. I use startpage.com for search, google results without the tracking. Firefox for chrome, and pay $1.50 a month for a personal domain email account.

My gmail account is only used for my Android device at this point.

</comment><comment><USER25> Why is Bing seen as the only other game in town? If you're really about not letting 'the man' in on your stuff, why would you go to the other 'the man' of Microsoft?

I don't use them, but my privacy-conscious friends use duckduckgo for this exact reason, and it has a wealth of rich search available.

Also, something in me philosophically opposes a mail company that charges 50% more for IMAP access. IMAP should be encouraged for the masses, not shunted into a 'you-only-want-it-if-you-know-it' space. IMAP solves most of the problems I hear from normal users that isn't password-related.

<comment><USER26> I was thinking that about Bing too, when I first read it. Then the Bing thing turns into "and that's a worst-case, we also have DDG, which kicks butt!"

<comment><USER25> Not sure how I missed that on a reread, but it's still puzzling why he firstly recommends replacing 'the man' with the other 'the man'.

</comment></comment></comment><comment><USER27> Why is anyone under the impression that living sans Google is difficult or unrewarding? I haven't used a single Google product in months (and I use Android.)

<comment><USER28> So you do use a Google product, one of the ones they care most about right now.

<comment><USER29> For anybody who wants to go for Android without Google, try Replicant, an Android distribution only running free (libre) software through its whole stack. <http://replicant.us/about/>

</comment></comment></comment><comment><USER30> An alternative to the OP's recommendation of Hushmail is FastMail.fm. I recently switched to FastMail from GMail and wrote about it: <http://reidburke.com/2013/03/25/own-your-email/>

</comment><comment><USER31> What he doesn't mention is YouTube - the one product for which there is NO alternative. Sure, you can choose to post your own videos elsewhere, but when it comes to watching videos - many videos are only posted on YouTube and nowhere else.

</comment><comment><USER32> I've been using DuckDuckGo exclusively for months now, and it is a dog's breakfast compared to Google. Some types of searches are almost as good, but nothing about it is better than Google's experience yet.

</comment><comment><USER33> Why would you want to? Because they are no longer providing you with as many free services as before? I mean yeah of you are selling ad space maybe. But otherwise I don't really see it.

</comment><comment><USER34> He says he has quit Google, but its unlikely that he has quit using all third paty apps that sit directly or indirectly on Google services/APIs such as Maps & Search.

</comment><comment><USER35> > You can easily use it on your Mac in Safari by changing your hosts file and > in Chrome like so.

Using Chrome to help you quit google? ;)

</comment><comment><USER36> Anyone else getting 404'ed?</comment>


Parallax - open source scrolling parallax script for mobile and desktop browsers - <AUTHOR> https://github.com/GianlucaGuarini/parallax <comment><USER2> I don't get how this is considered good design. It certainly does not add to the UX, not for me anyway.

But who am I to tell, I'm just a user, not a designer.

<comment><AUTHOR> whatever this means...

<comment><USER3> This means that, as user, OP doesn't consider his opinion on the subject qualified enough, despite being fluent in the use of web browsers, and being a potential target for sites implementing this effect.

</comment></comment></comment><comment><USER4> Demo breaks, parallax script is 503'ing.

[https://rawgit.com/GianlucaGuarini/parallax/master/dist/Para...](https://rawgit.com/GianlucaGuarini/parallax/master/dist/Parallax.js)

Failed to load resource: the server responded with a status of 503 (OK)

<comment><AUTHOR> Does this happen also if you reload? Maybe rawgit.com was down for a while

<comment><USER4> Nope, all fixed now (demo is working also).

</comment></comment></comment><comment><USER5> Demo doesn't work for me.

Ubuntu, Version 44.0.2403.157 (64-bit)

[http://imgur.com/Rg3YaSl](http://imgur.com/Rg3YaSl)

<comment><AUTHOR> which browser are you using?

<comment><USER6> Breaks for me on Chrome 45.0.2454.85 on Ubuntu as well. Runs fine on Firefox.

<comment><AUTHOR> hmm.. it's strange, it works in Chrome 45 on Mac and on Windows 10, 8, 7 (even windows xp) Unfortunately I can not test it on Ubuntu but at this point I doubt the problem is the OS. Sure you don't have any Chrome extension installed that could block the execution of the script? Thanks for your feedback anyway I will test it on Ubuntu asap

<comment><USER6> Yep, don't think its an issue with any extensions as I tried in incognito mode and there are no extensions enabled there.

<comment><AUTHOR> Thanks your feedback is really helpful for me, I opened an issue on the repo hoping to verify it soon [https://github.com/GianlucaGuarini/parallax/issues/2](https://github.com/GianlucaGuarini/parallax/issues/2)

</comment></comment></comment></comment></comment></comment><comment><USER7> So laggy on an iPhone 5S. I have a hard time believing this was optimised for mobile.

<comment><AUTHOR> Another user reported completely the opposite [https://twitter.com/syropian/status/645735377291096064](https://twitter.com/syropian/status/645735377291096064) But I have tried my best I swear ;)

</comment></comment><comment><USER8> Is Parallax still used somewhere else than ThemeForest Templates?

<comment><AUTHOR> does twitter.com count also as ThemeForest theme? [https://twitter.com/gianlucaguarini](https://twitter.com/gianlucaguarini)

<comment><USER8> No, but as one of those uncountable amount of sites that implemented it _when_ it was chic and sexy.

(This was btw. a real question, and I didn't want to smaller your work. The script itself looks nice and works like a charm here, no doubt about that!)

<comment><AUTHOR> I kind of agree, but since there will be clients requiring this feature we can not do a lot! I have tried my best to get a script enough flexible that will help me (and I hope other devs) wasting hours to configure a smooth parallax site</comment></comment></comment></comment>


Ask HN: You are seeing this message because you are using ad blocking software - <AUTHOR> Many websites reports a warning about using ad blocking software.
I report here what I got from  www.flightradar24.com:
>> You are seeing this message because you are using ad blocking software
>> To view Flightradar24.com without ads, please get a Flightradar24 Premium account
The problem with this is not the ads but the way they track you.
So my question is: why do most of the website think you don't want to see ad? <comment><USER2> They know you use an ad-blocker and that you want to block ads, they don't know why, but they'll make an assumption. It is a fair guess that you use an ad-blocker because you don't want to see any ads; whether that is for privacy reasons, bandwidth, or because you dislike ads is not really relevant to them. In fact, most people who block ads probably do so for a combination of those reasons, and I am willing to bet that most users of ad-blockers simply don't want to see ads on every page they visit. So their assumption is not that unreasonable.

If you want websites to know exactly why _you_ use an ad-blocker, just mail them and tell them. The answer you'll receive (if any) will probably tell you that they depend on ad income to provide a free service, that they need ad delivery networks to act as brokers for their advertising space (and thus can't host their own ads), and that you are welcome to purchase a premium subscription if you want to use their service without ads.</comment>


Levandowski agrees to plea deal over Google secrets - <AUTHOR> https://www.reuters.com/article/us-uber-autonomous-levandowski/former-uber-self-driving-head-levandowski-agrees-to-plea-deal-over-google-secrets-idUSKBN21646I <comment><USER2> After reading the comments here, I think it might be better to move the source article to another one with more historical context, like [https://www.theverge.com/2020/3/19/21187651/anthony- levandow...](https://www.theverge.com/2020/3/19/21187651/anthony-levandowski- pleads-guilty-google-waymo-uber-trade-secret-theft-lawsuit)

Things I learned from that article that aren't apparent in this one:

\- Uber was forced to pay more than $244 million to Waymo in the separate lawsuit between them.

\- The $179 million that Levandowski owes to Google comes from a third lawsuit between him and Google over poaching engineers from Waymo.

Update: [https://news.ycombinator.com/item?id=22633861](https://news.ycombinator.com/item?id=22633861) suggests that the article is being shadow edited. It now contains information on those two points, but I don't think it did when many of the comments on here were written.

</comment><comment><USER3> Even if they dont "use" anything he stole, 30 months of someone else's life in jail is a zero price to pay for Uber to get even a small amount of competitive knowledge. Even something like an internal calendar of expected timelines would be super useful and cant be unseen.

<comment><USER4> I'd argue the opposite that this was extremely expensive for Uber.

The legal nightmare which resulted a loss in 0.34% of equity and combined with having to throw away whatever they had[0] before as part of the deal with Google is not cheap at all.

Anecdotally, I have engineering friends on the Uber self driving team and they talk about how they are just starting over again and how far behind they are as a result of it.

This is definitely a path Uber would not choose to go down again in hind sight. All to say, Uber did pay a significant price for "30 months of someone else's life".

[0] [https://www.wired.com/story/uber-waymo-lawsuit- settlement/](https://www.wired.com/story/uber-waymo-lawsuit-settlement/)

<comment><USER5> It's a gamble, though. Say you're Uber's CEO, Travis Kalanick, and you believe 3 things for sure: 1. Uber's completely doomed if self-driving cars show up and Uber doesn't own it, 2. Sexual harassment is a good idea, and 3. Uber's behind the top players in self-driving car research.

Say you believe that there's a 25% chance that this Google guy can get you to the front of the self-driving car race, and there's a 50% chance you'll get caught. Based on those 3 assumptions at the top, this is a worthwhile risk.

Sure, he wouldn't do it again with hindsight, both because it didn't work out and because his board fired him for creating a culture of sexual harassment, but the risk was probably worth it, strategically if not ethically.

<comment><USER6> > 25% chance that this Google guy can get you to the front of the self-driving > car race

This is the absurd assumption

</comment></comment></comment></comment><comment><USER7> Does he still owe any of the $179M to Google or does that go away? Is he still in bankrupcy?

<comment><USER8> If that amount is for civil damages, I think that would be a separate matter, but the last two paragraphs of the article leave little doubt that he is, and that Uber is not picking up the tab unless he can force them to (...would it be in the interests of Google (Alphabet? Waymo?) to help him do so? It would hurt Uber. Could it do so, if it wanted to, e.g. by hiring lawyers on his behalf?)

Update: The article has just been shortened, and the paragraphs on that issue have been removed...

Update 2: they are back again, apparently slightly reworded, IIRC the original...

<comment><USER7> > Update: The article has just been shortened, and the paragraphs on that > issue have been removed...

I thought I was going crazy. I could swear it mentioned it but now it's gone.

> Update 2: they are back again, apparently slightly reworded, IIRC the > original...

Not for me? It's gone still.

</comment></comment></comment><comment><USER9> Curious to hear from those who have been following the details more closely: was there _any_ legal basis to Levandowski's claims?

It's easy to write him off as an extremely greedy sociopath, but I wonder if he was walking along some precarious line or "loop-hole" that eventually too many attempts to cross bit him in the butt.

<comment><USER10> No, there is no legal basis for using corporate resources for personal gain. It's not a gray area, it's a bright line.

<comment><USER11> No poaching agreements are a bit more of a grey area though

</comment></comment></comment><comment><USER12> great example of how white collar crime does not get punished. "no more than 30 months" for a theft implicated at multi-billion dollar values. that's even less with good behavior credit

<comment><USER13> Two and half years is a hell of a lot of jail time. I seriously wouldn't wish it on my worst enemy.

<comment><USER14> People have gotten used to ridiculously long sentences, but 2 years in jail would be absolutely terrible.

Think of it this way, people are currently SIP and going stir crazy with all the modern stuff.

</comment></comment></comment><comment><USER15> After admitting his guilt and serving his time, would you refuse to work with him again? It seems like he was a brilliant guy who made a bad mistake. I don't think he's unemployable. Isn't prison punishment enough? Time is the only irreplaceable resource we have.

<comment><USER16> Seriously? What exactly is brilliant about stealing designs? If he was so brilliant, he'd know what to do better or differently. He'd have been able to work around Google's IP. That's true brilliance.

Not only is he a thief, by his own admission, but it probably wasn't the first time he did this. The way he stole the designs he wasn't worried about getting caught. This is not something someone does for the first time. It's a pattern of behavior built up over a long time.

I'm seriously worried about the lack of basic morals in technology where behavior like this, like Andy Rubin's, etc.... goes unpunished because these people are "brilliant."

<comment><USER17> Did you read any of the news articles? This isn't about stealing designs...

<comment><USER16> He downloaded schematics and pcba designs, documents, etc, onto a thumb drive and transferred those contents outside of Google. Call it whatever you want. It's called theft.

* The files that Levandowski is alleged to have stolen contain drawings and schematics pertaining to circuitry and LIDAR laser-sensors that were used in Google's self-driving cars. If convicted, he faces a maximum of 10 years in prison and $250,000 fine, plus restitution, for every count.*

[https://www.theverge.com/2019/8/27/20835368/google-uber- engi...](https://www.theverge.com/2019/8/27/20835368/google-uber-engineer- trade-theft-secrets-anthony-levandowski-charged)

<comment><USER17> Why are you pulling from an article from last August? There is news happening in real-time about this with updates. The DOJ dropped all those charges. If they could have proven it they wouldn't have allowed a plea. He was accused not convicted...He plead because he's bankrupt from a civil suit with Google and the DOJ let it drop because their case isn't strong enough. Look at the Fitbit case. And funny enough - GOogle went on to buy them just a few months after.</comment></comment></comment></comment></comment>


Blockchains and Cryptocurrencies: Burn It with Fire - <AUTHOR> https://www.ischool.berkeley.edu/events/2018/blockchains-and-cryptocurrencies-burn-it-fire <comment><AUTHOR> Did a search for this link before submitting and the first post from 3 hours prior did not appear in the search results. Will hide the post.</comment>


JSX Alternative: Sowing Machine - <AUTHOR> https://github.com/harrysolovay/sowing-machine <comment><AUTHOR> I just released this React UI toolchain / JSX alternative, which is part babel-plugin & part runtime lib. It would mean a lot to me to get your feedback! Please let me know what you like, what you dislike, areas that need improvement, feature requests / ideas, etc.

Thank you so much!

Kind regards,

Harry

<comment><USER2> Recently I released similar library ([https://github.com/sultan99/react-on- lambda](https://github.com/sultan99/react-on-lambda)).

We solve same problem but we went with different approaches I made a wrapper and you babel-plugin.

Does your plugin transpile code to React.createElement or it still wraps to some other function?

I found code snippet in your documentation: _c( _s('div', [ [{some: 'prop'}], [_s('span', _x, [['neat']]), _s('span', _x, [['syntax']])], ]), )

Looks like you wrap code with some other functions?</comment></comment>


Ask HN: Who are the best icon designers? - <AUTHOR>

I will be in the market for some custom icons in a few months. If anyone here has experience hiring a custom icon designer for high-quality icons (such as those used by CulturedCode, etc.) or is a designer with a strong portfolio, I'd love to hear about it. <comment><USER2> Just a short list of icon designers I follow on twitter, I plan to collate this into a blog post eventually:

\- Sofa: <http://www.madebysofa.com/>

\- Pinvoke: <http://twitter.com/pinvoke_com> \+ <http://www.pinvoke.com>

\- ByLine Break, Midtone Design: <http://www.midtonedesign.com/> \+ <http://twitter.com/DDrDark> \+ <http://twitter.com/bylinebreak> \+ <http://bylinebreak.com/>

\- Cocoia: <http://twitter.com/Cocoia> \+ <http://www.icondesigner.net/>

\- Louis Harboe: <http://twitter.com/spiralstairs> \+ <http://www.graphicpeel.com/>

\- Jonas Rask (retired): <http://twitter.com/JonasRask> \+ <http://jonasraskdesign.com/>

\- Mathieu White: <http://twitter.com/MathieuWhite> \+ <http://mathieuwhite.com/#funtime>

<comment><USER3> I'd also add Jared Christensen to that list. He made the icon for <http://sifterapp.com>, amongst others.

<http://www.jaredigital.com/>

</comment></comment><comment><USER4> Check out <http://yellowicon.com/>

The design company is run by Everaldo, the creator of the Crystal Project <http://www.everaldo.com/>

His icon sets have been some of the highest rated and most downloaded at kde- look.org for years now

If you are not familiar with kde-look.org, check it out. There are hundreds of very impressive icon sets you can download for free. Many are released under LGPL and can be used in commercial software

</comment><comment><USER5> Please have a look at <http://www.iconarchive.com> icon designer put there work on this site you'll be able to contact the authors via the site.

</comment><comment><USER6> I've heard good things about CrowdSpring, price efficient and get your pick of the litter from thousands of prospective Creatives.

Crowdspring even guarantees 25 entries, worth checking out

<http://www.crowdspring.com/>

</comment><comment><USER7> The best I've seen is Icon Factory, I have a feeling they're pricey though :)

They've done the icons for Coda, Windows XP, and others I believe.

<http://iconfactory.com/design/icon>

</comment><comment><USER8> I run Iconfinder (www.iconfinder.net) and have hired many good icon designers. Please send me a mail if you would like to have a talk: martin.leblanc [at] iconfinder [dot] net

</comment><comment><USER9> <http://www.virtuallnk.com/> did nice icons for a client of mine

</comment><comment><USER10> Jon Hicks work always impresses.

<http://hicksdesign.co.uk/>

</comment><comment><USER11> www.iconfinder.net has collections of icons and should lead you to some designers</comment>


Ask HN: What are the advantages of C-style synxtax? - <AUTHOR>

What is better about C-style syntax versus parens? Lisp's syntax makes macros and structured editing easier, what techniques does C-syntax enable? <comment><USER2> You are scratching simultaneously on the doors of a huge semi-religious war (oops, block that metaphor!) and a seriously open set of questions.

(I think this has been asked zillions of times. I don't know why I feel compelled to throw in my 2 pence...)

It's hard to say "better" in a multi-dimensional question like this.

The things that seem clear are:

* Without the absolute simplicity of the prefix-style paren-delimited Lisp syntax, true macro power is almost impossibly hard/complex/messy.

* For some reason, most people find the Lisp syntax hard to internalize. (Likely due to its prefix nature.)

* Progress generally happens by evolution, not revolution. (Revolutions take about 20-30 years from idea to success in the market, if the latter ever happens.) C is the granddaddy of the "worse is better" philosophy that swept the computing world about 30 years ago, and, so C-style brackets are part of the "comfort zone" that most programmers inhabit. (C++, Java, Go, etc., all stay within that zone.)

I'm not sure you can say anything more before the discussion breaks down into endless rounds of fruitless bickering...

</comment><comment><USER3> For many people reading and/or writing C-style is easier than s-expr (Lisp). On the other-hand it is far easier to parse Lisp than C-syntax. So really depends which perspective you are considering.

As a programmer you delegate the heavy lifting to the compiler and choose the language (& framework) based upon what you wish to accomplish.

Perhaps you could explain your motivation for asking the question. E.g. thinking about designing yet-another-new-language?</comment>


SoftBank-Backed Lender Kabbage Cuts Off Businesses as Cash Needs Mount - <AUTHOR> https://www.washingtonpost.com/business/on-small-business/softbank-backed-lender-kabbage-cuts-off-businesses-as-cash-needs-mount/2020/04/01/902f6694-7453-11ea-ad9b-254ec99993bc_story.html <comment><AUTHOR> Kabbage Inc., an online lender backed by SoftBank Group Corp., cut off credit to its small-business clients in the past week, more than a dozen customers and an employee said in interviews.

The borrowers, who range from software consultants to heavy-equipment contractors, said Kabbage didn't give them any notice, and that they learned their credit lines had been suspended only upon logging into their accounts. Some said they were counting on the money to get through the tough times ahead.

"This is very bad business ethics," said Joydeep Paul, who runs Medserv Healthcare Solutions LLC, an emergency-medical training company in Princeton, New Jersey. He says his line of credit was cut from $22,000 to $0. "You just turn it off without saying a word -- not an email, not a phone call, nothing."

Online lenders have spent years touting themselves as the opposite of banks. But as the coronavirus pandemic ravages cities across the U.S., they've turned to a playbook that banks used during the last financial crisis more than a decade ago: reducing access to credit when the economy is contracting. Other lenders, including On Deck Capital Inc. and Fundbox Inc., have also tightened their underwriting standards or limited lines of credit.

"They've left me high and dry when I needed them the most," said Rob Jacques, co-founder of theCodery, a software consulting company in Petaluma, California. He said he was particularly galled to be cut off without notice because until recently Kabbage called him every day asking him to borrow more money.

Furloughed Workers

Kabbage, based in Atlanta, says it has loaned more than $9 billion to thousands of small businesses since it was founded in 2009. The company furloughed hundreds of its workers this week as it contends with a slowdown in spending at small businesses, which have suffered as consumers nationwide have been ordered to stay inside to slow the spread of the deadly coronavirus pandemic.

Kabbage is now trying to position itself as a middleman that will connect people with loans from the Small Business Administration. It has also started a website to help small businesses sell gift certificates to consumers.

"Like many other fintechs, we have temporarily adjusted our lines of credit and are focused on supporting the SBA's Paycheck Protection Program," Paul Bernardini, a spokesman for Kabbage, said in a statement. "Just as manufacturers have retooled their processes to build ventilators and masks, we're doing the same to reallocate our resources to respond to the national emergency and provide financial products that small businesses need most."

Rob Frohwein, Kabbage's chief executive officer, put it differently in an email to employees on Friday, when he said the company would temporarily stop making loans.

"As of last night, all lending has been turned off," Frohwein wrote.

Kabbage in 2017 raised $250 million from SoftBank. Other SoftBank Vision Fund portfolio companies -- including Indian startup Oyo Hotel, co-working giant WeWork and real estate brokerage Compass -- have axed staff in recent weeks.

Credit Reductions

The credit reductions come at a dire time for restaurants and shops across the country. In normal times, small businesses have about a month of cash on hand, according to a 2016 study by JPMorgan Chase & Co. That means they're particularly vulnerable as major cities across the country continue to expand shelter-in-place orders.

On Deck began putting holds on customers' ability to draw on their lines of credit if they hadn't done so in the last 30 days. Customers affected by the holds have been asked to send the company recent bank statements to have the holds lifted. Jim Larkin, a spokesman for On Deck, said the firm will "continue to serve and support our existing customers and are selectively lending to new customers."

Fundbox, a venture-capital backed small-business lender based in San Francisco, has also limited some customers' ability to draw on their credit lines.

"Like many companies that serve small businesses, we've had to make changes that have affected some of our customers," Tim Donovan, a spokesman for Fundbox, said in emailed statement. "While these decisions have not been easy, it will allow us to continue to serve the majority of our small-business customers now and in the future."

Kabbage customers who called to ask what happened were told that their accounts were under review. An employee at Kabbage, who asked for anonymity to protect their job, said that customer-service agents were instructed not to tell borrowers that the company had suspended credit lines across the board.

Michael Figueroa, a security contractor in Fort Lauderdale, Florida, said the representative he talked with was apologetic. "Hey, I don't even know if I'm going to be working here tomorrow," he recalled the agent saying.</comment>


Pebble Time Smartwatch Teardown - <AUTHOR> https://m.youtube.com/watch?feature=youtu.be&mc_eid=fa34acfcfc&mc_cid=8210b1c2af&v=MDJ0EOkU_Fg

<comment><USER2> Got to love Dave's commentary, Always learn a thing or two from his teardowns.

I wonder if anyone from pebble can comment on the FPGA, I thought that was a bit odd as well, Is it just so that the processor can sleep as much as possible and doesnt have to wake on small trivial things ?.

<comment><USER3> Probably to drive the memory LCD. The drive timing in the datasheet looks pretty tight (about 2.2MHz), and bit banging at that rate will leave the uC unable to much else during a screen update. Ideally, you want to make use of the STM32F439's 2D graphics accelerator to do graphics legwork, then the DMA controller to write out to the screen.

The FPGA could even have been provided by the LCD vendor to provide a more standard interface.

<comment><USER3> Replying to myself: this was actually confirmed by one of the developers on reddit:

[https://www.reddit.com/r/pebble/comments/37lg95/ifixit_pebbl...](https://www.reddit.com/r/pebble/comments/37lg95/ifixit_pebble_time_teardown/crnr78a?context=10000)</comment></comment></comment>


Rewarded for failure: RIM share price up as BlackBerry service crashes - <AUTHOR> http://www.computerworlduk.com/news/mobile-wireless/3310085/blackberry-share-price-up-as-service-crashes/ <comment><USER2> I don't think the author gets how markets work. Investors are much more focused much more on macro factors (e.g. the state of the EU) than micro ones (e.g. Blackberry's servers being down in the middle east).

The S&P was up 3.4%, and with RIM's beta of ~1.3..a rough benchmark, extremely imperfect "guess" for how much RIM should be up is 4.4%. This could mean that if the overall market was just flat, RIM's stock might have taken a loss. I think this was more a case of a rising tide lifting RIM's boat.

....or maybe it means MSFT will finally buy them out.</comment>


How to swap images using javascript - <AUTHOR> http://mrbool.com/how-to-swap-images-using-javascript/26669

<comment><USER2> All the "PatriciaLopes" account does for the last many months is promote mrbool.com. Flagged.

BTW, use CSS for image change on mouseover. It's simpler, and involves no Javascript coding.</comment>


Full Scholarship program teaching marketing to start-ups - <AUTHOR>

Poor marketing is one of the leading causes for start-up failure. Marcademy Fellows (marcademy.com) is a full scholarship program for start-ups to teach and mentor on the full stack of marketing. It is founded by a group of highly successful CMO's, senior marketers and start-up founders. <comment><USER2> Is this the type of organization that earns money through lead generation?

<comment><AUTHOR> no. we are a school wanting to help start-ups learn marketing and become better start-ups. we are not a lead gen company or an affiliate that sells names or leads. read our site, look at who our founders and advisers are, and you'll see we are legit.</comment></comment>


The Moral Question of Ad-Blocking - <AUTHOR> https://www.prindlepost.org/2018/08/the-moral-question-of-ad-blocking/ <comment><USER2> "However, the advertising industry is certainly not morally neutral."

If advertising were other than 99.5% falsehoods, I might feel a little bad about running uBlock, Privacy Badger and NoScript in Firefox (which you should do, too!) as well as running dnsmasq as a proxy to filter out a lot of well- known ad networks. But the way it stands, with "caveat emptor" essentially being the law of the land, I feel I have to do this. Caveat consumer, advertisers!

Also, criminy, it makes a huge difference. When I use a PC or Mac at work, I'm shocked at how intrusive and overwhelming the advertising is. Dial it back several notches, you untruthful scallywags!

</comment><comment><USER3> > People use ad blockers for a number of reasons: they find ads annoying, > invasive, and distracting; ads can use large amounts of data, especially > video files; and they can slow down page loading time. People are also > increasingly worried about misuse of personal information. In the transition > from print to digital media ads have become more invasive. The prevalence of > ad blocking appears to be a response to this. It has especially increased > with targeted advertising, suggesting people don't like being followed > around by ads.

And thus I have no moral problem with running an ad blocker.

I don't mind ads. What I do mind is the resource consumption, the person tracking, and the potential malware vector. Modern online ads are just too risky to let into my environment.

And if you subscribe, most sites are _still_ going to serve ads.

There is another solution besides turning off ad blocking. If a site detects that I'm ad blocking, then block me. I have been so blocked. Or erect a paywall, and don't allow visits after more than zero to N visits. I think that's fair, and they've lost _nothing_ by blocking me, a non-ad-consuming visitor.</comment>


Degrading Script Tags - <AUTHOR> http://ejohn.org/blog/degrading-script-tags/

<comment><USER2> Interesting, but honestly - not that useful. Also very very hard to read. He writes very concise, and if you don't follow very carefully you'll get totally lost.

A hint: The functionality that he wants does not exist, so he's adding code to make it work.

What he's not doing is explaining some nuance of script tags.</comment>


FBI Is Pushing Back Against Judge's Order to Reveal Tor Browser Exploit - <AUTHOR> https://motherboard.vice.com/read/fbi-is-pushing-back-against-judges-order-to-reveal-tor-browser-exploit <comment><USER2> Such arrogant hubris:

        Here, [Special Agent] Alfin starts an analogy for software
        vulnerabilities: that of a flaw in a lock.

        "In layman's terms, an 'exploit' could be thought of as a
        defect in a lock that would allow someone with the proper
        tool to unlock it without possessing the key," he writes.

He admits that there is a flaw, but no mention _at all_ that the flaw should be _fixed_? If one person found the exploit, someone else can as well. Apparently fantasies about having a "nobus" tool are a higher priority than protecting people.

<comment><USER3> That's why I believe that there should be more energy put into genetic fuzzing of Firefox. If we managed to attach AFL to its content sniffing engine for example, I'm pretty sure it wouldn't take long to find something fun...

Google doesn't seem to say that anybody officially tried it so far:

[https://encrypted.google.com/search?hl=pl&q=afl- fuzz%20firef...](https://encrypted.google.com/search?hl=pl&q=afl- fuzz%20firefox)

</comment></comment><comment><USER4> FBI broke into your house to prove you were commmiting a crime.

FBI broke into your firefox...

FBI keeps all citizens at risk because it is convenient to them that there is a major flaw in the most common doorlocks.

Specific circumstances, proper oversight ?

Ripe for overreach these citizen unsafety programmes.

</comment><comment><USER5> I actually agree with the FBI here. I would love to see the vulnerability fixed, but it is of little importance to the case. It's like asking what make and model of lockpicking tools they used to pick a lock. If it is to verify the legality of it, I'm sure that allowing only the judge and an expert to see the exploit is enough.

<comment><USER6> > It's like asking what make and model of lockpicking tools they used to pick > a lock.

It is more like asking for the technical specs of the teleportation equipment they used. It needs to be established that they broke into the right house, because there are all sorts of potential "mistakes" that can be hidden behind secret magical investigative tools.

<comment><USER5> Not at all. What they had was a lead, they got access and found the real evidence. They wouldn't know if it was the right house or not, that is the nature of a lead, and the person (hopefully a judge) that gave them green light decided if the lead was substansial enough to warrent hacking a citezen and break privacy.

The process from start to finish can be public. If they followed protocol and found real evidence that is what matters. They can demand to see warrants and the timeline of the process to determine the legality of what happened, but the technical nature of the exploit adds no additional insight to this.

<comment><USER6> > If they followed protocol and found real evidence that is what matters.

That is what is yet to be determined. Trying to shield the process from public scrutiny and justifying it with an appeal to authority is a pretty bad idea. Imagine the same logic applied in the non-digital world: traffic stops conducted with probable cause delivered by a black box and an authoritative "Just trust me, I'm an expert."

<comment><USER5> I agree, and if the defendant wants a judge and domain experts to go over it, fine, but the public does not need to know for this particular case.

<comment><USER6> I'm not sure how that would work without more secrecy (FISA style courts) or compelled silence (NSLs). Before we do that, maybe we should take a moment to reevaluate the premise of state secrets, and the benefits they provide a free society.

</comment></comment></comment></comment></comment></comment><comment><USER7> Pretty sure that just about everyone is hoarding Firefox 0days :P

<comment><USER8> That's my thought too. I'm sure most of the so-called "security experts" who like to talk about how important privacy and security are for the rest of us are sitting on lots of 0-days.

<comment><USER9> Right? There are too many valuable bug bounties and interested parties for people to divulge the best exploits. Those are all probably still in the wild and will remain that way until the right buyer appears.

</comment></comment></comment><comment><USER10> May be? They almost certainly are stockpiling them.

</comment><comment><USER11> "hoarding" "a" Does not compute...

<comment><USER9> Stowing away a better term for you? Yeah hoarding is usually a plural reference but you know what the article meant.

<comment><USER12> More like "reserving". Clearly they're actually using the exploit in question. I would associate "stowing away" or "hoarding" with hiding or putting a later circumstance.

In any case, the original title ("FBI Is Pushing Back Against Judge's Order to Reveal Tor Browser Exploit") is more informative and less click-baity. There's a reason that's HN's preferred style.</comment></comment></comment>


PayPal Founders: Innovation is Dead - <AUTHOR> http://www.forbes.com/sites/nicoleperlroth/2011/09/12/paypal-founders-innovation-is-dead/

<comment><USER3> Total hypocrisy. Given what they have accomplished and their road to where they are today, you would think that they would spearhead such ventures, but when you have made your $$$$'s, it's a comfortable place to be.

But let's explore their observation that "real, deep innovation is not taking place in today's market" (from techcrunch article; [http://techcrunch.com/2011/09/12/max-levchin-and-peter- thiel...](http://techcrunch.com/2011/09/12/max-levchin-and-peter-thiel- innovation-in-the-world-today-is-between-dire-straits-and-dead/)). This has some truth in it, especially when you consider that many tech startups in the last 5 years have been a 'mish-mash' of other companies from the past (do I really need more photosharing apps?) Today's startups are really not tackling world-changing problems - so my question is, "Why?" I came up with three general reasons: 1) people are not thinking outside the box - rather than coming up with a new security patch, why not ask yourself, "why did we start using patches in the first place"; 2) Levchin touched upon it in the article, "the overall risk-taking culture has declined" - Nobel laureate, Barry Marshall ingested H. Pylori himself to prove that ulcers were caused by bacteria; we lack risk takers in tech; and finally (coming back full circle on this 'hypocrisy') 3) GREED. Many startups focus on making $ and once they make their $$$, many (not all) do not put $ back into disruptive research - <USER2> put more $$ into other 'mish-mash' startups to make more $$$ (right, Levchin and Thiel?). Compare a democratic country like the US - lots of innovationn. And now compare China - not so much innovation, but they sure are making a lot of $$$ (solar panels, anyone?). We're good at putting a man on the moon, but that's not going to make us $$$. Today, it's all about making $ and that's what's stifling innovation.

<comment><AUTHOR> @Sandroyong I totally agree on these points. Would you mind posting your comment here? It'd be great for readers to see this. [http://www.forbes.com/sites/nicoleperlroth/2011/09/12/paypal...](http://www.forbes.com/sites/nicoleperlroth/2011/09/12/paypal- founders-innovation-is-dead/)</comment></comment>


Try it and kindly please give some feedback - <AUTHOR> http://www.foodmnm.com/index.php <comment><USER2> what are you looking for feedback on?

looks like the idea is to search for dishes but there's no search box. need a bit more to go on.</comment>


The Other Stuff That's Not Product That You Need To Build Early - <AUTHOR> http://blog.meatinthesky.com/the-other-stuff-thats-not-product-that-you-ne

<comment><USER2> _Make sure you've built a functional admin panel before you launch._

Sorry, but this is bad advice. For 99% of startups, their biggest risk is not going to be spending too much time mucking around in the production database because they don't have an admin panel, but that no one is going to show up or care when they launch their product. Building cool stuff like admin panels, metrics dashboards, and loggers is just more procrastination to keep from doing the most difficult thing: launching.

If you're going to build those things at some point, make it _after_ you've seen that users care enough about this product that you're not going to scrap it and move on to the next one. Otherwise you're just wasting effort.

EDIT: To be fair, I think this is otherwise a great post. It is important to build those things _early_ but I think building them pre-launch and pre- validation is a big mistake.

</comment><comment><USER3> I think it's symptomatic that the author does not mention building the part where people _PAY YOU MONEY_.

Payment integration is a big pain and is something you should get into the product early, because grafting it on later will hurt. The same goes for ad management, if that is your business model.

<comment><AUTHOR> Given that my startup I not only had people paying me money and then turning it around and giving it out to others, I definitely know that pain. I just totally thought of it as core to the product; people generally have asked me about gateways and whatnot when they have their "ohmygodIhavethisidea" conversations with me.

This was more about the stuff they didn't ask about that they should have, but your point is exceptionally well taken - people who are picking a revenue model should _support that revenue model before launch_.

<comment><USER4> Are you acting as middleman ? In the sense, people are paying you money for products/services you don't own ? (An example would be online travel companies)

If that is the case, which gateway did you choose. From the gateways I spoke to this type of operation is difficult to get approved unless the final vendor itself has a merchant account. Was that the case in your startup?

<comment><AUTHOR> Yes, Dawdle.com acts as a middleman between buyers and sellers. We got a merchant account through Paymentech and used Payflow Pro as our gateway to take money in and used PayPal's Mass Pay API to send money out (after an aborted attempt to use ACH for disbursement). Dawdle is the merchant of record and so holds the proceeds in escrow for some period of time to mitigate risk.

</comment></comment></comment></comment><comment><USER5> I'll just offer some counterpoint, as we didn't do this. We created accounts manually with a script for a long time. By the time we needed a panel (leads were starting to get out of hand), I knocked out a fugly one in Rails in one 20 hour coding marathon. Then I banged up an email parser in Perl to add all of our current accounts / correspondences. That was just a couple months back.

The biggest problem that I could see with building a panel up front is that you might be building it for the wrong product. In my eyes, testing your product to see if you get any traction would probably win.

<comment><USER6> Ditto. When we needed to do a little admin, we just modified the database. (A little risky, I suppose, but we were doing regular backups.) We only wrote administrative tools when things got too complicated for the least- technically-sophisticated member of the team - me - to easily tweak things.

As it turned out, some of the most common customer support issues we had weren't anticipated by us in advance, so building out an admin panel would've still only met part of our needs.

</comment></comment><comment><USER7> +1 for Django admin! The amount of effort it alone saves would make Django worth while (for me) even if the rest was no better than PHP (luckily that's not the case though).

</comment><comment><USER8> There's an overwhelming amount of cool-looking options for analytics. Is there a standout option for logging and visualizing everything that one would need, or is it better to have two or three different analytics suites?

</comment><comment><USER9> The pitfall I've run into when building CMS interfaces for the sales types is that they always want to do something you didn't enable it to do. The image always displays on the right, so naturally they want it on the left, and you end up having to go muck with the code anyway.

Sure, there are plenty of vetted CMS systems out there (e.g., Drupal, Wordpress, etc.), but they're massive overkill when you only need an events list or something.

</comment><comment><USER10> #777 on white is just plain abusive</comment>


Show HN: An app to solve patient backlog problem - <AUTHOR> http://patientbacklog.in/#/ <comment><AUTHOR> We are at MVP stage so would love to get feedback.

There is huge patient backlog problem in developing countries with pretty bad doctor to patient rations. We want to explore if this is an interesting problem to solve and would users really use our service. Please share what do you think.

Thanks.

<comment><USER2> _would users really use our service._

Who are your users? Are they on Hacker News? If not, where are they? How can they be reached?

Good luck.

<comment><AUTHOR> Our users are doctors. I don't think they would be on hacker news. The other two questions i need to think about. Thanks for commenting. :-)</comment></comment></comment>


New in Chrome 66 - <AUTHOR> https://developers.google.com/web/updates/2018/04/nic66 <comment><USER2> I went to msnbc to confirm that autoplaying content was blocked...only to find that the video is set to start playing when you scroll the page, as well. Jesus.

<comment><USER3> uMatrix should fix that.

[https://github.com/gorhill/uMatrix](https://github.com/gorhill/uMatrix)

<comment><USER4> the web is really painfull without umatrix, but everyone so far failed to make a decent ui for firefox mobile :(

<comment><USER5> The new FF UI on mobile (Android at least) is pretty decent once they got rid of the stupid tab bar at the top.

</comment></comment></comment></comment><comment><USER6> And

\- What's New In DevTools (Chrome 66): [https://developers.google.com/web/updates/2018/02/devtools](https://developers.google.com/web/updates/2018/02/devtools)

\- What's New In DevTools (Chrome 67): [https://developers.google.com/web/updates/2018/04/devtools](https://developers.google.com/web/updates/2018/04/devtools)

<comment><USER7> That's me! Questions / feedback welcome

<comment><USER8> Thanks for all the great work on dev-tools. I recently started developing a chrome extension and found that not all of the great standard functionality was present. Here were some of the main pain points:

\- debugger; statements do not work for me

\- When right clicking the extension and clicking _Inspect Popup_ , the first few network requests are not reported in the network tab (seems that it starts recording _after_ the extension opens)

\- It took a very long time for me to figure out that cookies were not being set due to this permission: ([https://developer.chrome.com/extensions/declare_permissions](https://developer.chrome.com/extensions/declare_permissions))

\- Hot-reloading extension code would be extremely nice

Even just extra documentation on dev-tools with extensions or tips/tricks for debugging extensions would be excellent - I haven't been able to find much in the way of docs. Keep doing the excellent work you're doing, just thought I'd give some suggestions :)

<comment><USER7> Learning more about Extensions is one of my nagging TODOs. I'll see if our Extensions writer is up for the task, otherwise I'll take a crack at it this quarter. Thanks for the specific feedback.

</comment></comment></comment></comment><comment><USER9> It seems the new Clipboard API requires explicit permission (video on [0]), that's not going to increase adoption I suppose.

[0]: [https://developers.google.com/web/updates/2018/03/clipboarda...](https://developers.google.com/web/updates/2018/03/clipboardapi)

<comment><USER10> Reading from clipboard without explicit permissions would be a severe security issue.

<comment><USER11> tell that Android users... [https://www.xda-developers.com/stop-apps-reading- android-cli...](https://www.xda-developers.com/stop-apps-reading-android- clipboard/)

</comment></comment></comment><comment><USER11> New is the Symantec PKI blocking. There are still plenty websites which did not renewed their outdated Symantec certificates.

<comment><USER12> Sounds like this might be the kick in the ass they need to get new certs

<comment><USER13> Yup. I updated it for one our web services today, haha. But it was really my mistake. I had received the new cert soon after Google's advisory. :p Consider ass kicked, and lesson learnt to do these things right away, when I earlier today received a mail from a colleague alerting me of Chrome 66 going stable...

</comment></comment></comment><comment><USER14> Bottom bar on Android is gone. It is so hard to get used to top bar again.

<comment><USER15> I am missing bottom bar since I stopped using Windows Phone :(

</comment></comment><comment><USER16> jQuery becomes less needed by the second, unless you want compatibility with other and older browsers, which is almost a given. :)

</comment><comment><USER17> Are changes like CSS typed objects a new web standard or Chromium independently making decisions? Can we expect safari/firefox/ie to support this soon or is this only useful if my entire userbase uses chrome?

edit: found the spec [https://www.w3.org/TR/css-typed- om-1/](https://www.w3.org/TR/css-typed-om-1/) so I think it's reasonable to expect parity from other vendors eventually

</comment><comment><USER18> > Typed OM landed in Chrome 66 and is being implemented in Firefox. Edge has > shown signs of support, but has yet to add it to their platform dashboard.

Sigh. What happened to standards? This entire update is a bucket of changes that nobody can use because IE, Firefox, Safari, and mobile are not even close to implementing them.

<comment><USER19> A google search for "firefox attributeStyleMap" yielded little _info_ about the state of this, but one of the results was a specific commit at a mercurial repository at Mozilla[1], and it seems to be a patch to add this. So perhaps it's much closer than you think?

Edit: Actually, I wasn't paying too much attention to the commit initially. Apparently it's not implementing attributeStyleMap, it's using it as if it exists, so I suppose it's already implemented in this branch, or this is a test in anticipation of it.

1: [https://hg.mozilla.org/mozilla- central/changeset/f4e33c42faa...](https://hg.mozilla.org/mozilla- central/changeset/f4e33c42faa7)

<comment><USER20> No, you've linked a merge commit, which is merging a bunch of stuff.

One of the things it merges is BZ # 1442425 which is landing a newer version of the W3C's set of web platform tests, seen here testing the Typed OM feature you are interested in:

[https://github.com/w3c/web-platform- tests/tree/master/css/cs...](https://github.com/w3c/web-platform- tests/tree/master/css/css-typed-om)

So, this actually tells you nothing about whether Firefox is interested in implementing this or plans to do so.

<comment><USER19> Hmm, so what is the status of this W3C _draft_ [1] (which they say specifically does not imply endorsement), if the W3C is putting a test for it in one of their test suites? Or do Chrome/Chrome devs get commit bits? Or maybe one of the purposes of this is to serve as a way for browsers to coordinate on implementations even _before_ it's become a standard? (It's obviously a way to coordinate on things that _are_ a standard).

1: [https://www.w3.org/TR/css-typed-om-1/](https://www.w3.org/TR/css-typed- om-1/)</comment></comment></comment></comment>


Show HN: Startup resources - <AUTHOR> http://startupstash.com/

<comment><USER2> Awesome, guys! Would be good to have comments at bottom of service description so that people could add something there, maybe you consider to add Disquss?

</comment><comment><USER3> Great list. This is something I will be using for my startup(s). Keep it up.

[edited for dodgy grammar and not being a very useful comment!]

</comment><comment><USER4> This is a really helpful resource, thanks for putting this together.</comment>


This Blood Test Can Detext Every Virus You Have Ever Had - <AUTHOR> http://time.com/3911629/blood-test-virus/

<comment><USER2> Actually, it only detects viruses that the test manufacturer already knows about. So, it cannot detect _all_ viruses.</comment>