Hands-on: The $300 Kano PC, a "build-it-yourself" Chromebook competitor - <AUTHOR> https://arstechnica.com/gadgets/2020/07/hands-on-the-300-kano-pc-a-build-it-yourself-chromebook-competitor/ <comment><USER2> I bought three of these as gifts we had a pretty good experience with the hardware, but the social features integrated into the operating system disappointed me. my 6 year old daughter was getting harassed by another user. Everything she was saving was getting posted to a social forum, a user was sending her messages about everything she did, there was no way to block the messages, except to disconnect from all the online features that included all the educational content.

The Kano teams response at the time was was: 'The design of Kano world sort of mimics Twitter, which means that shares are open to comment by the Kano World community. ... comment deleting is disabled on it is because there have been cases where a lot of users were excluded and bullied by having their comments deleted' I think this is an unsatisfactory unsophisticated response for a product aimed at children

Perhaps this is now improved?

Kano redesigned their online features several times, and my kids lost all their work and lost interest. But not until they had completed the learn to use the terminal adventure, which led to us playing zork.

<comment><USER3> Are they Children's Online Privacy Protection Act compliant? And if they are compliant, are you saying their product is unusable if you refuse consent?

I would think their design mimicking Twitter would put them under COPPA.

<comment><USER2> I have no idea if they are compliant, I was a fairly early user and I don't know how much their software has evolved. At the time the education content they curated was online, and you needed to be logged in to progress and unlock content.

This content is a key part of their product, the whole point of the Kano is that it is a carefully prepared experience from the moment you hold the box, until you're writing bash scripts.

The interface would prompt you to post your work, and the way that choice was integrated, even if it wasn't mandatory, it seemed as if was the only way to save your work.

Once it was posted it was publicly available, and anyone with a Kano login could comment. If my daughter was logged in using the Kano she would be notified of the message. There did not seem to be any way to set any privacy controls, given that I asked Kano specifically about this I'm sure they would have let me know.

I confess I have a low tolerance for hype, and as a result my communication with the Kano team was a little bumpy. I was genuinely disappointed with aspects of their product. I think a more thoughtful self critical culture would have addressed what I believe were glaring problems. Overall I appreciate what they do and I bought three.

</comment></comment></comment><comment><USER4> Why does Ars insist that this is a Chromebook competitor? I think it shows a blindspot and cultural gap that they appear to be unaware that low-end PCs exist. At Walmart.com right now I can filter for Windows laptops between $200-$399 and get models such as the Lenovo ideapad S145 with a i3-1005G1, or ASUS VivoBook with Ryzen 3 3200U, or the closest competitor to Kano, a HP Stream with the same Celeron and eMMC storage for only $219. They even benchmarked against a Dell 15-3573 but borrowed the performance measurements from Geekbench instead of running the test themselves.

<comment><USER5> Think it's a shame that such a privacy-last and openness-last machine as the Chromebook is the "standard" for kids and classrooms.

Windows isn't perfect, but it has the broadest ecosystem of applications in the world, and is far more manipulable than Chrome or iOS. Far more.

<comment> heresie-dabord > Think it's a shame that [...] the Chromebook is the "standard" for kids and > classrooms.

Chromebooks are cheap to buy and maintain, that's why they are in classrooms.

Whatever the $OS, we don't #teach# privacy. In fact, privacy and critical thinking are the subjects that we teach #worse# than math.

Although Chromebooks are GOOGware, you can make them better by switching to dev mode and installing SeaBIOS ([https://en.wikipedia.org/wiki/SeaBIOS](https://en.wikipedia.org/wiki/SeaBIOS)). I boot Debian Linux on a CB with premium hardware. Cheapest "ultrabook" that you get, and with Firefox DoH and ESNI, you bleed less into the surveillance system.

</comment></comment></comment><comment><USER6> I would stay away from Kano as far as I can. Bought a Kano Pixel kit earlier which does not go with the description on official web site. Did some research my self, and it turned out I was not alone, obviously Kano changed the design after crowd-funding finished but with out changing the description. Obvious misleading, but that was not the end of the story. A couple of days later, I could not tell exactly but definitely less than 1 week, the battery slot came off the board. Whaaaaat? I decided to take a closer look at the board and I was amazed to find out: 1. The battery contacts and the battery slot case were two different component, and the battery slot case was glue to the board using some crappy glue which came off automatically. 2. The potentiometer which was supposed to be soldered on the board was standing on its feet and those anchor points meant to be soldered on the board were dangling there as they need it to be vertically mounted to the board. That's more than enough to say that Pixel kit was my very first and last Kano product. It simply too much cutting corners stuff.

<comment><USER5> I apologize on behalf of the company for this.

It sounds like you received a version that was manufactured by a bad supplier, one we've moved away from.

Let me know if we can offer you something new and fresh to make up for the fumble here. Happy to give you anything from our current line. You will be impressed and overjoyed.

Alex Klein, Cofounder & CEO, Kano

</comment></comment><comment><USER7> Kano originally was an education kit build around a Raspberry Pi [1].

I was a backer of that and the hardware and instruction book you received was great. I played with it for a bit, but I ended up gifting it to a friend who had two young kids. His daughter ended up using it to create same games in Scratch.

Interesting to see that they've moved onto Windows instead now. I wonder if it's so parents are more familiar and able to help with projects on it?

[1] [https://www.kickstarter.com/projects/alexklein/kano-a- comput...](https://www.kickstarter.com/projects/alexklein/kano-a-computer- anyone-can-make)

<comment><USER8> > Interesting to see that they've moved onto Windows instead now. I wonder if > it's so parents are more familiar and able to help with projects on it?

That is a possible reason, but the Kano PC kit also seems to be sold from the Microsoft store directly. So it is not unlikely that they made an agreement to sell with windows 10.

It probably is important for MS that Windows has some degree of penetration in this 'edutainment' sector (early user adoption etc.).

<comment><USER9> I found it really surprising that, aside from color and what is printed on the key caps, the keyboard appears identical to the keyboard on my surface pro. Which would explain why the article raved about how impressive the keyboard connector is, I have been extremely impressed with mine and have had zero issues with it. My guess is they are sourcing the keyboard from the same supplier as Microsoft, which isn't a bad thing.

However, the extremely thin typecover doesn't feel that out of place on the surface, but it looks kind of strange attached to this very chunky Kano computer.

</comment></comment></comment><comment><USER5> I'm Alex, the company's founder and CEO.

Here's us talking about the product and the Microsoft partnership on TV: [https://www.instagram.com/stories/alexnklein/235848341696754...](https://www.instagram.com/stories/alexnklein/2358483416967548013/)

You can reach out to me directly at alex at kano dot me

Alex

<comment><USER10> What's the deal with the firmware? Will it run coreboot without a hassle?

</comment></comment><comment><USER11> This is what I've been saying about modular phones for years - "oh if only phones were modular people wouldn't have to buy a brand new one ever 2 years" \- yes, maybe, but the phone would be 3x as heavy, to facilitate a functionality that realistically would be used once or twice. And people increasingly upgrade phones not because the old ones are too slow or lacking memory but because...they just want something new.

<comment><USER12> Google had an interesting project (Ara, IIRC) for a modular phone. But indeed, no-one solved the issue of the weight and thickness. Even if these were solved, the cost would probably be another issue.

<comment><USER13> Ara was a really cool project, from what I've read about it by the end the only way to feasibly do it ended up being the CPU/Memory/Modem and even the storage ended up just being on a single unit.

Still love the Tardigrade module idea though, even if it's completely absurd.

[http://midnightcommercial.com/project/tardigrade- biome/](http://midnightcommercial.com/project/tardigrade-biome/)

Really wish more companies were working towards sustainable tech ideas, thinking about the pile of dead AirPods the average Apple customer will leave behind during their life fills me with anxiety.

</comment></comment></comment><comment><USER14> Another similar concept is by CrowPi initiative but it is based on ARM not Intel [1].

Their second version CrowPi 2 allows the use of any Raspberry Pi in a more laptop like hardware shell with 11.6" display. They also offering many sensors for additional IoT and hardware interfacing exercises. Currently they are on Kickstarter and more than 1600% funded [2][3].

[1][http://linuxgizmos.com/hackable-crowpi2-steam-education- lapt...](http://linuxgizmos.com/hackable-crowpi2-steam-education-laptop- available-with-8gb-raspberry-pi/) [2][https://www.elecrow.com/](https://www.elecrow.com/) [3][https://www.kickstarter.com/projects/elecrow/crowpi2-steam-e...](https://www.kickstarter.com/projects/elecrow/crowpi2-steam- education-platformand-raspberry-pi-laptop/posts)

</comment><comment><USER15> >Although the process started out very fast indeed, a couple of minutes in, the disk's write performance fell off a cliff, which you can see in the radically decreased performance graph above. //

AIUI slow deletion is an MS Windows thing.

A partial solution is offered here, [https://superuser.com/questions/76906/deleting-large- amount-...](https://superuser.com/questions/76906/deleting-large-amount-of- files-in-windows-is-slow) \-- command line deletion of files with output to 'nul' followed by pruning of directory trees is reportedly 3x faster.

</comment><comment><USER16> As a former k-12 edtech practitioner-- these are terrible as a CB replacement. There are 6 reasons the CB has market dominance 1\. dirt cheap 2\. cattle not pets 3\. manageable 4\. google apps integration 5\. available in pretty rugged form factors 6\. pretty boring, not an attractive nuisance for poking and prodding

these things run windows, which in and of itself gives substantially more nooks and crannies to poke at. the hardware is all modular and accessible and losable

from a technology education perspective, these look amazing. but the majority of technology in education is and should be about as interesting as a pencil.

</comment><comment><USER17> I have given the Raspberry Pi versions to my niece and nephew. They like it. Social features are mostly annoying but actual system and messing around in mine craft was a blast.

I hope they keep doing stuff with P and Linux, so once my kids are older I will get them one

</comment><comment><USER18> We got a Kano touchscreen Pi model last holiday season. It lasted maybe 3-4 months before totally falling apart and the power system dying. I wanted to like this company and their vision so I hope they have fixed the build quality.

</comment><comment><USER19> I work for kano, feel free to ask questions...

<comment><USER20> Can I install Linux?

<comment><USER19> Unofficially - it appears to work, at least on my sample. Didn't install on the disk as I can't risk bricking it right now, but I can boot Ubuntu 20.04 from a USB stick, connect to wifi, and view threejs.org examples. Can't make any claims as to the timeline on official support.

</comment></comment></comment><comment><USER21> Is the hardware linux compatible?

<comment><USER19> See [https://news.ycombinator.com/item?id=23915085](https://news.ycombinator.com/item?id=23915085)

</comment></comment><comment><USER22> Cute. Might be a good novelty thing you'd give a child, maybe with Linux installed.

<comment><USER19> Indeed, our main markets are parents and teachers.

</comment></comment><comment><USER23> So much empty space on the pcb/closure, you can fit in few more ARM boards.

<comment><USER5> Looking at upgrades right now - lots of chip suppliers courting us.

Alex Klein, Cofounder & CEO

</comment></comment><comment><USER24> Wish i could install linux.

</comment><comment><USER25> This is great for kids to learn about technology, one you have windows on it. They could then install scratch [https://scratch.mit.edu/about](https://scratch.mit.edu/about) then move onto Python. Linux would be a good alternative OS to go on it as well.

<comment><USER5> Check out the real reactions of kids opening it and using it, versus standard HP/Dell/Lenovo ... [https://www.youtube.com/watch?v=jIXPEPu3Y6Y](https://www.youtube.com/watch?v=jIXPEPu3Y6Y)

<comment><USER25> one of the comments is brutal if you are HP. Didnt Grandad have one of these? All the money that HP spends on marketing and they are the grandads laptop!</comment></comment></comment>


Morton-order Matrices Deserve Compilers' Support (1999) [pdf] - <AUTHOR> https://www.cs.indiana.edu/pub/techreports/TR533.pdf <comment><USER2> I can't imagine a language more suited for implementing this than Julia. Custom N-d array types are easy to create and are composable with the rest of the linear algebra ecosystem. Multiple index and index iteration strategies are supported. It's easy to implement optimized code for common operations, falling back to reasonably-efficient generic implementations. There are strong metaprogramming facilities in case custom unrolling behaviour is necessary at compile time.

If someone was interested in exploring an implementation I would strongly suggest giving Julia a try.</comment>


London's Royal Free Hospital Handed over Personal Health Data to Google - <AUTHOR> https://www.theguardian.com/technology/2017/jul/03/google-deepmind-16m-patient-royal-free-deal-data-protection-act <comment><USER2> Article is more than 2 years old.</comment>


Facebook Still Tracks People on Yelp, Duolingo, Indeed - <AUTHOR> https://privacyinternational.org/blog/2758/guess-what-facebook-still-tracks-you-android-apps-even-if-you-dont-have-facebook-account <comment><USER3> Hacker News is a pretty small bubble, but news about Facebook being awful is pretty mainstream at this point. It surprises me that the majority of my family can still tolerate Facebook (and instagram/whatsapp etc.) despite what is known.

I'm pretty vocal among my family about data security/privacy, as I'd like to keep information about me and my family safe from prying eyes, but it takes a lot of effort and know-how to put up walls against the sort of electronic creepiness that's default-on for most of us. It's been almost 3 years, and most of my friends/family still don't have content blockers installed for Safari on iOS. None of my family or friends have made any moves to ditch Facebook, instagram, whatsapp, etc. even though the barrier to entry for new services is so low.

It's frustrating to know that despite how bad they are, despite every new discovery of terribleness, nothing's going to change, and they're just going to get bigger.

<comment><USER4> The unfortunate explanation for the phenomena that you're observing is that most people simply don't care about their privacy -- at least not nearly as much as you do.

<comment><USER5> > The unfortunate explanation for the phenomena that you're observing is that > most people simply don't care about their privacy -- at least not nearly as > much as you do.

I don't think that is a fair assessment. Even if that is true technically, it is missing the spirit of the question at hand. I think many people are misinformed about what is happening in data collection and processing, and if they were well-informed, would care more about their privacy. Given that people are intentionally being misled about the implications of giving up their privacy - via various propaganda about how it's not-that-bad, etc - <USER2> think it is unfair to state that people "simply don't care about their privacy ... as much as you do".

I think if people knew what was at stake, they would care more. Stating that they "simply don't care" is basically ending the conversation preemptively, such that the only possible future is that there is no privacy.

But I think people are misinformed, greatly. Very few people have any idea how intense FB's data collection efforts are, or how insecure the data is when it goes there, etc. Even NYT pieces do not reach that many Americans. And NYT or other publications are careful and methodical about their writing, barely able to reach into the future and question out loud the future FB is building.

Democracy is at stake. This is more than a question of individual privacy: people need to understand that our society is crumbling due to lack of privacy, because wealthy and powerful institutions are using that intense violation into private American lives to brainwash targeted people with conspiracy theories and other dangerous society-damaging things.

Privacy matters to everyone, I'd wager even to those who think they don't value their individual privacy.

<comment><USER4> >> I think many people are misinformed about what is happening in data collection and processing, and if they were well-informed, would care more about their privacy.

Yea, people are uninformed. But, I think you're overestimating people's capacity to care about issues that will have no real consequence on their life. The average person just wants to spend time with their family/friends, gossip, and enjoy their hobbies. Facebook helps them do just that.

>> But I think people are misinformed, greatly. Very few people have any idea how intense FB's data collection efforts are, or how insecure the data is when it goes there, etc.

This is exactly the type of information that people don't care about. "So, you're telling me FB knows I'm browsing Groupon for wedding gift deals and looking at cat pictures on Reddit? O, and other people could have access to that data?" Shoulder shrug...

>> Democracy is at stake. This is more than a question of individual privacy: people need to understand that our society is crumbling due to lack of privacy.

I guess this is the type of argument people actually care about. The problem is that their uninstalling Facebook isn't going to change anything, other than making their lives less fun. If there's a real threat to democracy, the solutions need to come via regulation.

<comment><USER5> > But, I think you're overestimating people's capacity to care about issues > that will have no real consequence on their life.

Why do you think that this has no real consequence on their lives? I would state unequivocally that privacy violations have a direct consequence on people's lives. And they see that consequence, too, it's not some hidden thing. I would blame a lack of privacy culture on the election of a lying, cheating government that has directly caused pain to individual Americans. This is happening presently and I believe that if we had valued privacy significantly more over the last two decades, there would be far less physical pain intentionally caused on targeted people.

> This is exactly the type of information that people don't care about. "So, > you're telling me FB knows I'm browsing Groupon for house cleaning deals and > looking at cat pictures on Reddit? O, and other people could have access to > that data?" Shoulder shrug...

What do you mean? I'm not talking about that _at all_. I'm talking about how when you go to the grocery store and someone snaps a selfie with you in the background, FB knows. They know when you take the subway and where you go, they [will] know pretty much every single detail of your life even if you don't have an account.

I'm not talking about browsing the web. By the way, that privacy violation is real and serious, not something to shrug off.

> The problem is that their uninstalling Facebook isn't going to change > anything, other than making their lives less fun

What do you mean by this? Uninstalling Facebook isn't going to change anything because FB spies out the wazoo anyway! And anecdotally, I think that people are generally happier when they spend less time on Facebook, not less happy.

> If there's a real threat to democracy, the solutions need to come via > regulation.

Sure - but with the way laws are written, FB's lawyers will write those laws and nothing meaningful will change. More than legislation has to happen, a cultural shift into caring about privacy is needed.

<comment><USER4> >> What do you mean? I'm not talking about that at all. I'm talking about how when you go to the grocery store and someone snaps a selfie with you in the background, FB knows. They know when you take the subway and where you go.

"I don't care if FB knows I was at the grocery store, or at the mall, or on the subway. I care about not missing the invite to my niece's birthday party."

>> They [will] know pretty much every single detail of your life even if you don't have an account.

Imo, this is fearmongering...

</comment></comment></comment></comment></comment></comment><comment><USER6> I hate this data tracking as much as everyone else here, but is this really a surprise to anyone? I used to put Google Analytics on my blog, and I thought most of the people here were pretty aware of how gigantic the Facebook advertising claws stretched.

I feel like until we have an internet that isn't dependent on ad-networks, this is an inevitability. Targeted ads perform better, and you cannot expect these giant megacorporations to act ethically when it will cut into their profits and while they're technically not violating any laws.

<comment><USER7> > I used to put Google Analytics on my blog

Have you found a viable alternative or removed analytics from your blog altogether?

<comment><USER8> Not OP, but personally I removed it and don't miss it. But then I'm not trying to monetise everything, so analytics seem more about the ego boost in retrospect. A bit shameful I was willing to compromise my readers' privacy for that.

Depending on your needs, it's pretty easy and interesting to hack something together yourself though.

<comment><USER7> I think I will resort to looking at the Apache access logs.

I just want to know the number of daily unique visitors and where they are located (geographically).

</comment></comment></comment></comment><comment><USER9> Oh the number of apps that EVERY TIME are ran try to talk to FB... Even my phone banking apps. I understand that from a game or a selfie app. They are 'silly' by nature. But why the F... would my bank want to notify FB that I am using their app?

The same applies for EVERY airline app I have used over the last 5 years.

NoRoot Firewall for Android, and put a global Deny rule for 31.13.x.x and problem is solved.

<comment><USER10> > But why the F... would my bank want to notify FB that I am using their app?

It's not that they want to notify Facebook. It's that they get useful functionality from libraries that Facebook makes available. And they've either decided that sharing your info with Facebook is a worthwhile tradeoff for the engineering time, or they don't realize it's happening.

<comment><USER11> What services are you thinking of?

<comment><USER10> If you click through to the original PI investigation [1], it says:

> _Facebook routinely tracks users, non-users and logged-out users outside its > platform through Facebook Business Tools. App developers share data with > Facebook through the Facebook Software Development Kit (SDK), a set of > software development tools that help developers build apps for a specific > operating system._

I don't have more info than that

[1] [https://privacyinternational.org/appdata](https://privacyinternational.org/appdata)

</comment></comment></comment></comment><comment><USER12> How many people here track their users? How many people here track where their users come from, what they click on, who they are, etc?

The constant articles deriding Facebook ring hollow considering most of HN's audience is engaged in similar behavior.

<comment><USER13> There's a very large difference between:

\- Tracking the behavior of your own users on your own app, for product improvement purposes (which most users will expect)

\- Sending the behavior of your own users on your app to an advertising surveillance company, with an ID that can be used to correlate that behavior with behavior elsewhere, without their knowledge, consent, or reasonable expectation

And before anyone says it, no, a generic line about third-party service partners in a sadistically long TOS/Privacy-policy does not count as meaningful consent. Even Supreme Court justices admit that they don't read them.

<comment><USER14> I'm not too up to date on the news, but isn't FB building a shadow profile of everyone?

So even if you're not a user, you get tracked and your data gets sold. That to me was a step too far, and got me to really scale back what I share on the Internet.

<comment><USER12> They don't have shadow profiles. That was FUD spread by the news, and articles like the one we're commenting on now that constantly get voted up to the front page.

Here's Facebook's post explaining what they collect for people who haven't registered: [https://newsroom.fb.com/news/2018/04/data-off- facebook/](https://newsroom.fb.com/news/2018/04/data-off-facebook/)

TLDR: They collect what Google and all the analytics and ad-network companies collect, in order to target ads, along with incidental "user data" like IP address, etc.

</comment></comment></comment></comment><comment><AUTHOR> Changed the title from 'Guess what? Facebook still tracks you on Android apps (even if you don't have a Facebook account)' (too long for HN and missing details)

<comment><USER15> might be worth leaving Android in there though...

<comment><USER16> From the article:

> Since we published our report, mobilsicher.de could also confirm that apps > on iOS exhibit similar behaviour.

</comment></comment></comment><comment><USER17> And Google tracks people on ALL websites, without any consent. When are we talking about that?

<comment><USER18> Whataboutism isn't helping anything. Google doing something doesn't make it okay that Facebook does it. And Google's tracking is being discussed in this very thread, so it's not even accurate whataboutism.

<comment><USER19> Hushing people who are pointing out the larger context isn't helping anything.

The root problem is not any one single company.

<comment><USER18> There's always a larger context though. Who cares about Facebook or Google when the NSA is tracking everything we do? Who cares about anyone being tracked when the global climate is on track to destabilize society? Who cares about society when we're not doing anything about the inevitable heat death of the universe?

Pointing out the larger context isn't automatically helpful. I believe the GP's comment is an example of unhelpful whataboutism.

<comment><USER19> >Who cares about Facebook or Google when the NSA is tracking everything we do? Who cares about anyone being tracked when the global climate is on track to destabilize society? Who cares about society when we're not doing anything about the inevitable heat death of the universe?

Your hyperbole isn't helping anything, and you still havent explained why delecti shouldnt point out the similar practices of other companies like GOOG.

NSA tracking could be considered relevant, seeing as how they get much of their data from FB and GOOG tracking, but you're being silly and disengenuous by asking what about climate change and physics being relevant, that's an obvious strawman argument that isn't even close to what delecti or anyone here is talking about.

<comment><USER18> Calling out google's practices is valid, but doing it in a thread about facebook's practices is whataboutism. It's just not on-topic.

<comment><USER19> You're wrong, that's not whataboutism.

>Whataboutism (also known as whataboutery) is a variant of the tu quoque logical fallacy that attempts to discredit an opponent's position by charging them with hypocrisy without directly refuting or disproving their argument,[1][2][3] which in the United States is particularly associated with Soviet and Russian propaganda.

OP did not "attempt to discredit an opponent's position by charging them with hypocrisy". Please stop trying to stifle genuine intellectual discussion with erroneous assertions.

</comment></comment></comment></comment></comment></comment></comment><comment><USER20> When shall we have a "distro" of fair, open source, free apps produced by the open source community guaranteed to run with minimal permissions without privacy abuse?

<comment><USER21> I believe you're describing F-Droid.

<comment><USER22> That solves the "app store" problem, the OS is still hostile though, and even using Replicant the Baseband OS is still a threat.

Not using F-Droid wouldn't be better, it is just that it really seams hopeless for a complete solution without a major movement like what spawned GNU-Linux. All these problems need way more devs involved.

<comment><USER23> Why is the OS still hostile when using an AOSP based ROM?

<comment><USER22> From what I understand it isn't possible to run AOSP on the vast majority of hardware. You still need proprietary binary blobs for the drivers and the baseband OS.

<comment><USER24> You don't need it to run on the majority of hardware. Just need one device that runs AOSP and meets whatever other requirements you may have.

<comment><USER25> I agree, but it's a pain. I tried to run AOSP on an Xperia XA2. You are missing so much. Sony doesn't offer much software for your hardware on AOSP. F-Droid has like three orders of magnitude less apps than the play store. Even the many apps that don't rely on google features, hell even competitors like Microsoft offer e.g. their Word for Android nowhere else. In the end, you probably will install google services non the less, but this time from less trustworthy sources since google doesn't officially want or will help you getting their stuff run on ASOP.

The system was generally unstable. I finally gave up when I noticed video playback in landscape mode turns the screen green, but works fine in vertical (Different apps, even ASOP stock apps, even after fresh re-compile)

I'm now going the other route... using a sony image and rip out everything unnecessary. Neither seems worth the time for average consumers. Learned a lot, though.

</comment></comment></comment></comment></comment></comment></comment><comment><USER26> Isn't that similar to Google Analytics and Mixpanel, Segment.io and so many other tracking tools?

<comment><USER27> Did you like the giant image at the top of the article?

<comment><USER26> Yeah, I don't think it's a problem and I'm not convinced by the article at all. Also, if an app/website don't track user behavior and improve themselves based on data, they are most likely going to be defeated by their competitors soon enough.

<comment><USER27> They aren't sending the data to Facebook to improve themselves.

</comment></comment></comment></comment><comment><USER28> > Apps, especially those with millions of installs, need to take the privacy > of their users seriously.

This is wrong. So, so wrong. This leads to the "I'm a small dev so I don't have to care, I don't have millions of installs, right?" believ.

</comment><comment><USER13> Out of interest, why do developers use the SDK and send these events?

Is it just for 'sign in with Facebook'? I'm surprised at the specificity of the event-data; do they offer an analytics interface like for GA?

Do they give you any cash or other benefits for all the data?

I'm very surprised that companies like banks are including it, when I'd assume they have their own analytics and identity systems.

<comment><USER29> They have analytics like GA. In particular, they track conversions, etc... So if a company runs an ad on FB, putting the FB analytics on their site and in their apps lets them tracking the effectiveness of the ad they ran.

There is nothing nefarious from the company other than they are trying to figure out what their FB ad spend is worth. FB OTOH is probably using the data for tons of other reasons. Are those reasons dissimilar from GA/Google? I do not know.

<comment><USER30> > There is nothing nefarious from the company other than they are trying to > figure out what their FB ad spend is worth.

I call exposing users to the likes of Facebook, Google, etc. "nefarious" all on its own. At the very least, it's treating users with a degree of contempt.

</comment></comment></comment><comment><USER31> Like with tobacco may be privacy invading permissions need to be regulated a bit. May be a clear warning on what happens with your data will make consumers think a little bit more about prompts to handover your data.

Also, it might be interesting to see if certain permissions can have parental control. That is you need to be with your parent/guardian to allow certain data access.

Might be great to make it slightly difficult to gain sensitive permissions for everyone. Requiring to input your password/pin at the permission box. We already has these on desktop computers where you need to be able to input your password for admin access to apps. This may not deter companies to ask for permissions, but my hypothesis is that it will show up in their conversion funnels and eventually they will stop asking for blanket permissions to all your data.

</comment><comment><USER32> Facebook still doing something ethically questionable. Must be a day ending in 'Y'.

</comment><comment><USER33> This is one of the reasons I use a VPN - I can set it up to disallow contact with Facebook and other trackers at the DNS level, rather than fiddle with content blockers on all of my devices.

<comment><USER34> But then again, unless you're setting up your own VPN infra, I don't trust anyone with my data.

If you've set up your own infra, deets please!

<comment><USER33> I self host on Digital Ocean with Algo:

[https://github.com/trailofbits/algo](https://github.com/trailofbits/algo)

</comment></comment></comment><comment><USER35> Wow, this is super ugly. Not to hijack the thread, but we just launched yesterday at [https://www.privacymonitor.com](https://www.privacymonitor.com) \- The stuff we find about what companies bury in their privacy policies is pretty frightening.

</comment><comment><USER36> Is this even a surprise though? Where don't they track you would be a more interesting headline.

</comment><comment><USER37> Reminds me of this presentation: [https://media.ccc.de/v/35c3-9941-how_facebook_tracks_you_on_...](https://media.ccc.de/v/35c3-9941-how_facebook_tracks_you_on_android/)

<comment><USER38> That'll be mostly because they gave this talk and they link to it in the article!

</comment></comment><comment> throwaway-1283 And if you use a cellphone you're tracked 24/7 by the gov't...

</comment><comment><USER39> Part of the problem here is the entire smartphone and app culture of walled gardens. No native desktop applications try to pull this shit excepting the webapp as 'native' electron-based fakes.

<comment><USER40> That's not how I remember it.

I remember that malware was rampant on Windows back in the 90's and early 00's.

And some of that malware probably did collect information on you.

Either way, the point I am trying to make is that desktop software is not as benign as you are making it out to be.

And even some of the desktop operating systems have been doing telemetry or advertising related things in the OS itself.

Ubuntu. [https://www.gnu.org/philosophy/ubuntu- spyware.en.html](https://www.gnu.org/philosophy/ubuntu-spyware.en.html)

Windows 7 and 8.1 telemetry. [https://mspoweruser.com/microsoft-makes- telemetry-updates-fo...](https://mspoweruser.com/microsoft-makes-telemetry- updates-for-windows-7-and-8-1-critical-updates/)

Windows 10 built-in advertising. [https://www.howtogeek.com/269331/how-to- disable-all-of-windo...](https://www.howtogeek.com/269331/how-to-disable-all- of-windows-10s-built-in-advertising/)

I don't get why or how people put up with this bullshit.

<comment><USER41> Back then it was widely recognized as malware, that wasn't a controversial classification. These days if you categorize such software as spyware/malware, you get a ton of pushback. It's become normalized.

When did this happen? Obviously it was a gradual change, but when about was the inflection point? I'd estimate sometime around 2007.

<comment><USER42> Malware and spyware wasn't generally sophisticated enough to do this type of data collection and targeting. This is a ton of work, as evidenced by the 10s (maybe 100s?) of thousands of engineers employed doing it today.

The data Malware and spyware went after was your credit card number, and bank account & passwords. Which they then used to steal money from you.

No one ever was worried that malware would build a profile of them and sell it to internet advertisers who would send them more relevant ads.

</comment></comment></comment></comment><comment><USER43> Is there an easy way on Android to, for example, block all traffic to Facebook? Sort of a Little Snitch for Facebook?

I know this could be done via VPN, but I'm looking for an on-device solution.

</comment><comment><USER44> Is anyone aware of a respectable security rating system for android apps we can look up before installing something from the play store?

</comment><comment><USER45> Is there a tool that shows you if you are being tracked, and by whom?

EU compatriots--looking at your general direction here.

</comment><comment><USER46> I block Facebook's domain on my laptop, I wish it was as easy to do on mobile.

</comment><comment><USER47> A reminder to use Privacy Badger from the Electronic Frontier Foundation (EFF)

</comment><comment><USER48> Maybe we need a law that simply makes it illegal to track any user on any network for any reason. Is there any legitimate reason to track a users that is purely in their own interests? Also, how many of these articles does it take before people stop using Facebook?

<comment><USER10> > Also, how many of these articles does it take before people stop using > Facebook?

Infinite. The majority of people won't see these articles. And the majority of people who do see them won't care enough to change their behavior.

<comment><USER49> Yeah? Why should I care about tracking? Why is what you click on so secret and guarded and why should I care. Sites have been tracking forever. I was 8 and putting counters on my geocities sites

Is the problem just Facebook and Google? The retail clothes store I used to work for tracked everything. Where's the outrage?

<comment><USER50> > I was 8 and putting counters on my geocities sites

How is a hit counter at all related to tracking users?

<comment><USER49> Why would you say it's not. It's the begging of tracking to get information about what's happening on your website

</comment></comment></comment></comment></comment><comment><USER51> Bigger question is - why would anyone use yelp?

<comment><USER52> > Bigger question is - why would anyone use yelp?

Because they're looking for a good place to eat, possibly in an unfamiliar area?

</comment></comment><comment><USER53> At least for Duolingo there is an easy fix: don't use it. I'm currently reading a researcher paper written by an employee and while the paper is interested the app itself is abysmally bad. I just tried the app again today just to be sure my opinion wasn't a mistake but it reinforced it instead.

That app have no lesson, nothing is explained, there is just quizzes slapped on your face until you remember the good answer. The distractors are bad (you can find answer using capitalization in some case), sentences seems to have been generated automatically etc. I cannot fathom how one can learn anything with that nor why it is so popular.

<comment><USER7> I've been learning Japanese with it for the past 2 years.

Although I haven't tried other apps (so I don't have a baseline for comparison), their methodology has proven quite effective for me.

<comment><USER54> Japanese conforms extremely poorly to the duolingo format. As someone who is also learning Japanese, I'm very surprised you've stuck with Duolingo this long. My experience was that it explained nothing. No explanation of particles, the different between hiragana and katakana, no other grammar explanations, etc.

<comment> barry-cotter How useful is explicitly learning about the difference in use of hiragana and katakana, really? As far as I'm aware the research on language learning is pretty clear on teaching grammar; teaching it explicitly is no more effective than teaching implicitly. This example is right, that one isn't is how we learn to speak our native tongues and we faultlessly follow rules we can't teach all the time, e.g. adjective order in English is opinion, size, physical quality, shape, age, colour, origin, material, type, purpose.

[https://dictionary.cambridge.org/grammar/british- grammar/abo...](https://dictionary.cambridge.org/grammar/british- grammar/about-adjectives-and-adverbs/adjectives-order)

<comment><USER53> Do you have a link to a paper or two supporting that claim?

Sure as children we learned our natives language by hearing it for years but the point is you can't magically have ten years of everyday language input when learning a foreign language. So then as adult it is way more efficient to learn the underlying rules. If there really was a more efficient method universities would have ditched their curricula for it. But from my experiences they don't and they don't recommend Duolingo either.

</comment></comment></comment></comment></comment><comment><USER55> I'm sorry to be that guy, but if after all the shitty news about Facebook tracking and selling your information you are still using Facebook than you deserve to be tracked and sold.

<comment><USER56> I'm sorry to be that guy, but if you properly read even just the submission title you'd know it's not about people that are still using Facebook but people that are using other apps like Yelp. That might include you.

<comment><USER55> oh my bad then. but yeah, is this news? don't we know fb already.

</comment></comment></comment><comment><USER57> I wonder if Zuck is stupid enough to use Facebook? or does he have a special build just for himself?</comment>


Some thoughts after porting my javascript game to native Android and PC apps - <AUTHOR> http://www.reddit.com/r/javascript/comments/1johkr/my_javascript_game_as_native_application_for/

<comment><USER2> This is really impressive.</comment>


Zero Electricity Air Cooler - <AUTHOR> http://www.notechmagazine.com/2016/06/zero-electricity-air-cooler.html <comment><USER2> The only way it can actually work is as an insulation. The venturi effect - which requires wind - cools the air in the constriction due to the pressure drop, but it stops being cool once it leaves the constriction.

A simple sun-powered cooler could work in principle, but at a minimum the exhaust air wouldn't go into the house...</comment>


Csysdig – Universal System Visibility with Native Container Support - <AUTHOR> https://github.com/draios/sysdig/wiki/Csysdig-Overview

<comment><USER2> Interesting, this looks slick. How does the performance overhead compare to htop?

<comment><USER3> One of the tool authors here. The answer is "it depends". We absolutely designed sysdig and csysdig to work on production systems. They both work by capturing system events, so their cpu usage depends on the number of system calls in the system. On machines with average workloads, I would expect csysdig's CPU usage to be comparable or slighly lower than htop. On machines that do a lot I/O, the CPU will probably be higher. Memeory usage is typically some tens of megabytes.</comment></comment>


Hot Chips – A California Startup Has Built an AI Chip as Big as a Notebook. Why? - <AUTHOR> https://medium.com/syncedreview/hot-chips-a-california-startup-has-built-an-ai-chip-as-big-as-a-notebook-why-4d068429349 <comment><USER2> I want to know how many petaflops the thing runs at, they're keeping mum on compute performance numbers at the moment.</comment>


I lost my OpenBSD full-disk encryption password - <AUTHOR> https://blog.filippo.io/so-i-lost-my-openbsd-fde-password/ <comment><USER2> Enlightenment always takes a while :)

      I later found a nice article documenting the entire system. It
      also includes references to JohnTheRipper having a module for
      this. Well, this was more fun.

\--

Wonder how many times are the same items posted: [https://news.ycombinator.com/from?site=filippo.io](https://news.ycombinator.com/from?site=filippo.io)

<comment> f- Off-topic, but my personal work sometimes ends up on the front page, and I'm always amazed how much reposting there is on HN - probably more than on Reddit and similar sites. Say, here's my stuff:

[https://news.ycombinator.com/from?site=lcamtuf.blogspot.com](https://news.ycombinator.com/from?site=lcamtuf.blogspot.com)

[https://news.ycombinator.com/from?site=coredump.cx](https://news.ycombinator.com/from?site=coredump.cx)

The process seems quite random; sometimes, the same link is submitted four times and lingers at score 1, and then some random dude's fifth attempt goes to #1. May be an interesting thing to graph (and get a #1 story on HN out of =).

<comment><USER3> I wish that more personal projects were posted here on the site. It's a bit tiresome to read about startups.

<comment><USER4> I suspect they just get lost in the noise. HN is pretty high volume, the front page is short, and articles quickly fall down under if they don't manage to get enough attention from the get-go.

Certainly these are more interesting for me than news about whatever the big tech companies are doing right now.

</comment></comment></comment></comment><comment><USER5> The previous article, about a lost password for a NAS, is hilarious and well worth a read as well:

[https://blog.filippo.io/so-i-lost-the-password-of-my- nas/](https://blog.filippo.io/so-i-lost-the-password-of-my-nas/)

<comment><USER6> He's lost _two_ VITAL passwords? This seems like a false premise then (which is fine, but the fictional premise seems unneeded and disrespectful).

<comment><USER7> Ehhmmmm. _stares at feet_

I wish I could tell you anything better than "in my defense, I seem to forget only one vital password per year..."

(But seriously, I never risked data: the WD didn't have FDE, it was just a matter of salvaging the hardware; the OpenBSD was still in the middle of a migration and I had the source still accessible, so it was a matter of saving time. And it's fun.)

<comment><USER8> _> I seem to forget only one vital password per year_

For me, it helps to enter the passwords from time to time. The easiest way to do this is to reboot.

If you have moral issues with rebooting a system where rebooting is not necessary, maybe run just the password checker, e.g. by unlocking a second volume that has the same password, or something.

<comment><USER4> I've recently gotten in the habit of writing passwords (or at least a part of them) down in a notebook. There are just too many passwords to remember, some of which I use very very rarely. I don't trust any password managers running on a networked computer or (gasp) phone, so paper is good for me. Plus it's more reliable.

</comment></comment></comment></comment></comment><comment><USER9> Quick question for the more cryptographically inclined: apparently after decryption the code does an HMAC validation:

        /* Check that the key decrypted properly. */
        sr_crypto_calculate_check_hmac_sha1(sd->mds.mdd_crypto.scr_maskkey,

Does this mean it's using Mac-Then-Encrypt? And if so, is it likely doomed [1]?

[1] [https://moxie.org/blog/the-cryptographic-doom- principle/](https://moxie.org/blog/the-cryptographic-doom-principle/)

<comment><USER10> OpenBSD uses XTS, which is what you should do _for disk crypto_ (only). For more background, see [http://sockpuppet.org/blog/2014/04/30/you-dont-want- xts/](http://sockpuppet.org/blog/2014/04/30/you-dont-want-xts/).

<comment><USER11> Awesome article, thanks for posting.

This explains better than I could the whole point of doing encryption in bcachefs:

[https://bcache.evilpiepirate.org/Encryption/](https://bcache.evilpiepirate.org/Encryption/) [https://news.ycombinator.com/item?id=12410798](https://news.ycombinator.com/item?id=12410798)

</comment></comment></comment><comment><USER12> If he wanted to know the value of the salt for his disk, wouldn't it be easier if he just modified the sources so it would be printed it out?

<comment><USER7> I... Actually didn't think of that, to be honest. But it would have involved rebuilding the OpenBSD kernel, so it probably wasn't easier. Also, the tool wouldn't have been reusable. But yeah, good thinking.

<comment><USER12> I am not familiar with OpenBSD, so it never occured to me one might have to rebuild kernel for this... Anyway, nice write-up, glad you cracked it in the end! :)

</comment></comment></comment><comment><USER13> _the rounds number 0x2000_

Does anyone know if this is the default? If I'm understanding this correctly, it's around 10 ms of key derivation time; on FreeBSD we default to 2 s, which should make cracking disk encryption 200x more expensive.

<comment><USER7> That's the default. Easy to override--and I did after this--but admittedly _ew_. Maybe we should email the OpenBSD list?

<comment><USER13> Please do. I'm not sure exactly which list would be appropriate, and I don't want to provoke a "FreeBSD guy coming in and trying to tell us what to do" reaction anyway.

</comment></comment></comment><comment><USER14> While reading I had the feeling that the author was reverse-engineering open source software...

<comment><USER15> In essence, that's precisely what he's doing. The exact on-disk metadata layout may not be documented anywhere, so he pieced it together using the structure definitions in the source code.

For those reading along at home, what is being done here is a run-of-the-mill bruteforce, this article could be about any FDE implementation.

So now the real question .. what was the password? :-)

<comment><USER16> hunter2

<comment><USER15> All I see is * * * * * * _

</comment></comment></comment></comment><comment><USER17> When deciding to encrypt, lets say a backup, you need to ask yourself, is the data better lost then in the hands of the wrong people.

<comment><USER18> Indeed. Good data encryption is also far stronger than the things like locks that people make analogies to in the real world. There is essentially no locksmith. If you lose the key, your data is gone forever. As illustrated by this article, if you have weak passphrases there are ways around it, so I suppose it is possible to "tune" the strength of your encryption that way.

<comment><USER19> I think the implication wasn't that the passphrase was weak, but that it was mostly known.

</comment></comment></comment><comment><USER20> I briefly went all-in on security, cryptocurrency, tor, etc., and had a locked down desktop machine encrypted with LUKS. Then, I moved, and it took me a few weeks to get the computer set back up. In that time, I'd forgotten my passphrase. So, I have a desktop machine containing (at least) a couple hundred bucks worth of cryptocurrencies that I can't open. I still _think_ I remember the passphrase I used, but it doesn't work, so I'm obviously missing a word or a punctuation addition (I used the CorrectHorseBatteryStaple method of making a memorable passphrase in this case).

I've been known to do dumb things, and going down the rabbit hole of cryptocurrencies and how to securely use said currencies was one of them. These days I put everything of importance into Google drive, Dropbox, and/or git (not github...a privately hosted git that I access via ssh and runs on a VM on hardware I own in a data center I trust). If it is sensitive, it is encrypted with a passphrase I've been using for a couple decades, and so it unlikely to be forgotten. A high capability attacker could thwart my protections, I'm sure, but I don't have any reason to believe a high capability attacker has any interest in me.

And, I don't hold much cryptocurrency, and what I do hold is at Coinbase, just sitting there on the off chance Bitcoin really does take over the world and a small amount turns into a big value.

<comment><USER21> _but I don 't have any reason to believe a high capability attacker has any interest in me_

Note what George Smiley is known to reply: "There was _every_ reason":

Peter Guillam: Well, at the time there was no reason to suppose the phone was tapped... George Smiley: There was every reason.

(from [http://www.imdb.com/character/ch0030043/quotes](http://www.imdb.com/character/ch0030043/quotes) as well as the book)

</comment></comment><comment><USER22> So, for the layman, does this mean, the encryption can be practically cracked or not?

<comment> Tuna-Fish If you almost know the right passphrase, it can be. If you don't, and the passphrase is good, it can't.

<comment><USER22> Thats, that is reassuring :). Would have been a good addition to that article. Of course, if you are lacking just a few letters in the password, brute forcing gets much more applicable.

</comment></comment></comment><comment><USER23> Hm, if it were me and I had just set up the new system and then promptly forgot the password, I'd just reinstall.

</comment><comment><USER24> Why not have your passwords be hashes of passphrases?

<comment><USER25> Because that would add little entropy at the cost of much inconvenience, which is the opposite of what you want.

</comment></comment><comment><USER26> That's why I keep them written down in my safe!

<comment><USER27> I do that too! I have the same "suffix" that's on all of them that I leave off the written version for a tiny bit of extra security. It's just a few characters that I've been using consistently for years on written-down passwords.

</comment></comment><comment><USER28> That's why you always

1) store passwords in the password manager, even the ones you think aren't important.

2) backup your data

<comment><USER29> > 1) store passwords in the password manager, even the ones you think aren't > important.

Losing the password that unlocks full disk encryption (FDE) is like losing the password that unlocks your password manager. At some point you have to have something stored only in your mind.

Now sure you could have your FDE password stored in a password manager as well but that's probably not a good idea. Also, compared to just about everything else saved in a password manager, you'd have to manually type the FDE password at boot. You can't copy/paste it as if anything your password manager would be running on a different computer.

<comment><USER30> > stored only in your mind

A sticky note at home is reasonably safe, unless you're legitimately worried that a dedicated person may target you specifically.

<comment><USER31> I have portions of my password safe passphrase stored with certain friends. If I get hit by a bus, those friends will almost certainly work out who each other are and what to do with the snippets they have. (And I "mind" several snippets of passphrase for some of them as well).

Not "nation state" secure, but I'm reasonable sure it's well beyond petty thief, curious cow-orker, 4chan/anonymous, or local LEO's capability to subvert.</comment></comment></comment></comment>


Show HN: Too busy for online dating? Try Wednesday Night - <AUTHOR> https://www.wednesdaynight.me/ <comment><USER3> These dating/find-a-friend services that require Facebook show up often on HN, and like clockwork are berated because they are Facebook-only (and the privacy issues that go along with it).

Yet people keep making them. Am I correct to deduce they are popular and there is market for them, and that it's only HN that hates them?

<comment><USER4> No.

You would have been correct to deduce that young 20-something people who are trying to scratch an itch keep thinking that a better dating site (as measured by one that can get them dates) is a real need, and the FB tie-in is an obvious way to do it.

They keep failing for the reasons that are pointed out on HN. And since they fail, not long after someone else looking around for an itch to scratch says, "Why doesn't someone make a better dating site using FB? Doesn't seem like anyone has done it yet. And HN is the perfect place to get feedback on it!"

<comment><USER5> We never started with the thought "why don't we use FB to build a dating site." Facebook is simply a means to solve a lot of different problems that come up in dating, and it ends up providing a better experience. That's all we care about.

<comment><USER6> Just to give you one user's perspective (which honestly, by virtue of being a HN reader probably represents a very small fraction of general users); anytime I see a service that requests I login via FB or Google, I assume you're trying to mine my personal data. Unless you are Facebook, or Google, or maybe LinkedIn (with whom I'm already willing to share my personal data) I'm not going to use these options. Make this your only option and I'm going to close the tab.

No personal offense to you, or your business. Just telling you as a geek, this is a non-starter for me.

<comment><USER7> But they _are_ trying to mine your personal data, to confirm that you're real, and to get to know you better so that they can match you. It's really all up there on their website.

</comment></comment></comment></comment></comment><comment><USER8> I'm not sure how I feel about this. They aren't matching you up with people they've vetted or know -- they're just finding you a date from other online dating services. And then charging you $75 (which could end up being $150 for them if they get both people via their site).

Semi-related, but Tim Ferriss has an interesting story about how he "outsourced his love life": [http://blog.timferriss.com/1/post/2009/07/how-to- tim-ferriss...](http://blog.timferriss.com/1/post/2009/07/how-to-tim-ferriss- your-love-life.html)

<comment><USER5> We've setup drinks for people through our own personal networks (one or two degrees away from the matchmaker), and they've gone well. We use a variety of options, but our philosophy is: we don't care where we find a match, as long as they're good, that's all that matters. We can also keep notes on everyone using it.

</comment></comment><comment> cupcake-unicorn This might be a weird comment, but the service seems very alcohol oriented - meeting at a bar, covering drinks. What about people who don't drink?

<comment><USER5> We have people who don't drink using the service and they order non-alcoholic drinks at the venue--sometimes they're bars, sometimes lounges.

Alcohol does act as a pretty good social lubricant though. The girls actually prefer that to extravagant dates when we've suggested them because there's less pressure--if the chemistry isn't there, it's more acceptable to leave after that first round rather than commit to spending a lot of time with someone up front.

<comment> cupcake-unicorn I don't think this service is for me at all. I'd prefer flexibility in places to meet and not having to resort to getting inebriated to meet someone :/ Coffee shops? I'm a girl, btw.

<comment><USER5> We're not saying you have to drink something alcoholic, we're just saying whatever beverage you choose to drink, we'll cover it. Think of the bar as a neutral place in public to meet up.

Our focus is on reducing all effort that goes into meeting someone, and the scheduling is part of that. Meeting during the day won't work because most our members are working on regular 9-5 schedules. Weekends are usually booked too.

What usually happens is if both people feel like it's going well, they'll exchange contact info at the venue and then plan something the following weekend and do something different.

You may want to check out Coffee Meets Bagel or How About We.

</comment></comment></comment></comment><comment><USER9> So the 75 bucks is to cover the actual match making? Or are you sending people to some really fancy bars. How's that even work? I'm in Canada, You have deals with franchises here?

Ah no, that's a US zip code you're asking for. I'm very familiar with the US zip code, you see, as most US based web services present themselves as a global service rather than a US based one, and the zip code is often the only sign that they arn't catering to my nation.

<comment><USER5> We haven't worked with any venues or had any dates in Canada. We're primarily focused in SF, LA, Chicago, and NYC. Sorry about that. Hope we can add support for you soon.

</comment></comment><comment><USER10> We at Truffle are building something similar but with linkedIn authentication - catering to working professionals.

We tried doing work email verification but users revolted against that and we have to revert back to linkedIn. I guess people on HN are right when they say that facebook logging is instant turn off but for some people entering email address and password is even bigger.

Also yah I like your service, though you are my competitor but 75$ is a lot. Try out making it a coffee, first date at a bar is a big sell.

By the way, if anyone of you here on HN are from Seattle and looking to grab a coffee with someone interesting, try out www.jointruffle.com :)

</comment><comment><USER11> Wednesday Night:

I'd be tempted to sign up with Facebook and receive a reply on exactly what kind of person you'd try to connect me to, given what you glean from FB.

If you got it right, I'd be a step closer to giving you money (if you operated near me). If you got it wrong, and I freely admit that I expect you will, I'd keep my money.

Either way, I am able to determine the quality of your service. I regularly spend $75 in a bar and have no trouble meeting people, despite how busy I am. You don't provide a compelling reason to give that $75 to you instead of my friendly local bartenders.

Meeting people isn't the problem. Meeting the right person, with whom I'd be interested in more than sharing a few drinks and conversation, is _the_ problem. My closest friends of more than a decade, who know me exceedingly better than FB, have routinely tried to connect me with someone or other. Not one has been the right fit.

Hell, just cos I'm feeling generous, I'd even give you a hint and say one of your staffers has the look. But that wears off in about 2.3 minutes.

DoubleHell, just cos I'm feeling that much more generous, let me suggest (if you haven't already thought of it) that you mesh HN activity with FB activity for an even better understanding.

Sadly, to my knowledge, we haven't yet figured out a way to determine likelihood of _chemistry_ between superficially compatible people. Perhaps I'm just a naysayer, but until we can figure that out, online dating just isn't working. Apparently almost 75% of US single people have tried online dating. Only 20% have found committed relationships (assuming that's everyone's goal, which it isn't).[1]

We need a chemistry detector, not a compatibility detector (machine or human).

[1]: quick search leads me to stats from 2012 at <http://www.statisticbrain.com/online-dating-statistics/>

</comment><comment><USER12> What happens when you can't set up a match?

What happens if someone is stood up?

What happens if you have a skewed ratio of men to women?

<comment><USER5> Good questions.

\- If we can't setup a match, you are either being unrealistic with your expectations (you consistently pass too often on people who we think are a good fit), or we just don't have enough people in the pool who are in your proximity. If it's the former, you'll need to adjust your expectations, if it's the latter, we'll focus more attention on that area. If we just can't make it work, we'll give you a refund. We usually can tell whether people are being unrealistic. If you can't tell, there's a simple experiment you can run: setup your own online dating profile to gauge the type of women who want to talk to you.

\- If someone is stood up, we'll refund the money and the person who stood the other up won't be invited or allowed to go out with any of our members again. Standing people up isn't cool.

\- Our current ratio is 1:2 girls to guys. We will find you a match one way or another. Our matchmakers border on obsessive with this stuff.

<comment><USER13> Do you exist in all zip codes of the US?

If you are only supporting certain zip codes then I'm going to be real annoyed when I enter half a dozen questions and THEN you tell me you're not available in my zip code.

<comment><USER5> If you live close to a major city (SF, NYC, LA, Chicago, Austin, Miami, Seattle) we can do it. If you don't, I would suggest waiting until we grow the user base out more.

</comment></comment></comment></comment><comment><USER14> It is interesting that there's a human in the loop. It's sort of a Mechanical Turk approach to web dating, and notable because it's the opposite of sites like E-Harmony that trump the superiority of their algorithm.

</comment><comment><USER15> Things that bug me: "setup" is the noun; "set up" is the verbal phrase. When I see 'setup" used like that, it drives me nuts.

<comment><USER16> login / log in

</comment></comment><comment><USER17> If you're too busy for online dating, aren't you too busy for dating in general? Seems like a vanishingly small market - people willing to pay $75 for a date, but unwilling to take the time to look on match.com. But I'm usually wrong about this sort of thing, so carry on!

<comment><USER5> It'd be a false dichotomy if you said "people who are too busy to date are too busy for falling in love" or something similar. People are busy and online dating eats up more time than any other type of application, including social networking.

Matchmaking is already going on and successful relationships have been established that way, we just make it more affordable and transparent. Linx Dating charges $30,000 for 11 dates spread out over 2 years, and they charge $500 just for the screening process.

Online dating has a higher frequency of use than social networking sites. It requires more time than you'd think if you haven't tried it before.

<comment><USER18> Hey man,

Just wanted to say you're doing an A+ job of responding to people's concerns here in the thread. People usually suck at this, too, but you've really got your shit down. Which, to me, demonstrates that you've been working the product over and over in your head, i.e., the opposite of what everybody else in this space is doing.

Because you're absolutely right. Fuck the Match.coms. Fuck the click click click click model. I'm not 16. I have neither the time nor the inclination.

<comment><USER5> Thank you. I think some people's concerns are valid. There's a quote that I really like: "The opposite of love is not hate, it's indifference." - <USER2> Wiesel

In other words, we'd rather have people pissed off or uncertain about something than to not care at all.

</comment></comment></comment></comment><comment><USER19> Can I get set up with Dan the matchmaker? He got that Clark Kent thing going on.

<comment><USER5> Dan's awesome. If you're serious about this, shoot an e-mail to me -> jared at wednesdaynight.me and I'll introduce you to him.

</comment></comment><comment><USER20> Have you seen this website? <http://www.jointruffle.com>

Seems doing similar things but targeting different group of people.

</comment><comment><USER21> So it's Grouper, but for 2 people instead of 6, and unblinded?</comment>


Uber Gets Run Over by Its Own Subprime Auto Leases - <AUTHOR> http://wolfstreet.com/2017/08/09/uber-gets-run-over-by-its-own-subprime-auto-leases/ <comment><USER2> The idea that one could lease a vehicle from Uber, at a significant loss to Uber, then turn around and use that vehicle to drive for Lyft, is absolutely hilarious.

<comment><USER3> Yet another example of VC ending up subsidizing America. We could just cut out the middleperson and go to basic income paid for by VCs.

<comment><USER4> Now, as a thought exercise: who do you think subsidizes VCs? (I.e. who are the biggest LPs)

For people who don't want to look it up... Some of the biggest are pension funds! It's not just high net worth individuals or companies, it's also mom & pop retirement funds.

[https://www.quora.com/Who-are-the-biggest-investors- limited-...](https://www.quora.com/Who-are-the-biggest-investors-limited- partners-in-US-venture-capital)

<comment><USER5> >Now, as a thought exercise: who do you think subsidizes VCs? (I.e. who are the biggest LPs)

The Fed, with their policy of Quantitative Easing over the past 5 years.

<comment><USER6> The quantitative easing FUD on HN is getting pretty tiresome. It gets blamed for everything from VC subsidies to house prices and just about everything in between.

All three rounds of QE in the USA focused on mortgage-backed securities and Treasury securities. Are you suggesting there were a bunch of VCs who were neck deep in the MBS or CDS/CDO rackets in the mid 00's?

See [https://en.wikipedia.org/wiki/Quantitative_easing#US_QE1.2C_...](https://en.wikipedia.org/wiki/Quantitative_easing#US_QE1.2C_QE2.2C_and_QE3)

<comment><USER5> I'm not making any kind of judgement to the effects of QE policy, simply stating a fact.

</comment></comment></comment></comment></comment></comment><comment><USER7> This is b.s. Uber is playing hollywood with it's money.

They are taking cars that are not particularly desirable, selling them to their own leasing company at full retail, collecting 4 times as much money per month than any same person would pay, earning money on every mile driven, and... I'm not sure about this one, but I _think_ they reduce the pay of the drivers who do the leases (I know Lyft does this).

Then they are "selling" the cars at a loss. But are they selling the cars at a loss to the wholesale market at large? i.e. putting them up for auction at Manheim/etc.? I doubt that is happening. More likely they are selling them to yet another subsidiary or affiliated company.

You don't lease a 15K car to someone at $800/month and lose money.

<comment><USER8> > You don't lease a 15K car to someone at $800/month and lose money.

It seems easy to imagine how you can: the driver rents the $15k car for 6 months, paying $4.8k in total before they stop making payments and Uber repossesses the vehicle. Uber hope to make themselves whole by selling it for $10.2k...except...they can't sell it for $10.2k because cars depreciate fast and anyway this one has 30,000 more miles on the clock than it did at $15k.

Only the cars initally cost $20k instead of $15k, Uber had to pay ~4% interest on the money they used to buy the car, the driver paid closer to $400 than $800, not all the cars are in fully working order and there are 40,000 cars.

</comment></comment><comment><USER9> I am not sure to understand.

The example 2014 Toyota Corolla at US$122 per week makes in a 130 weeks lease with Xchange some 122x130= 15,860 US$ and a 2.5 years (high mileage) old Corolla may still have some minimal residual value, let's say US$ 1,500.

I.e. roughly total reimbursement of the list price of the car:

[http://toyotanews.pressroom.toyota.com/releases/2014+toyota+...](http://toyotanews.pressroom.toyota.com/releases/2014+toyota+corolla+pricing.htm)

Assuming that cars in such a situation are bought "in bulk" and thus with a 10, maybe 15% discount, very roughly it should mean that in the US$ 15,860+1,500=17,360 of reimbursement some minimal costs for interests and expenses are included on an initial spent sum of around US$ 16,000/16,500.

So, at least in theory it seems like a "side-business" that is going to make even or maybe loose a few hundred dollars each car (for interests on the loaned money), but this only if everyone keeps the car and pays the leases for the whole period.

Now, you get one of those (and you get one of those because you have no money and no good credit record) and after 25 weeks/6 months you give it back.

You pay US$3,300 (25*122+250).

Xchange has in its hands a six month old car with (say) 20,000 miles on it.That still has a market value, but maybe since you sell it wholesale to some second hand dealer and you only get - say - US$8000/9000.

So, 3,300+8500=11,800

So in this case Xchange seems like having lost - roughly - US$ 4,500 per car, half the US$ 9,000 stated.

There must have been some large avoidance of repayment (and repossession of the cars, etc.) to make that number on average.

<comment><USER10> > a 2.5 years (high mileage) old Corolla may still have some minimal residual > value, let's say US$ 1,500.

Even on the wholesale market, I'd wager it's several time that amount...

<comment><USER9> I don't know, but I would expect 7,500 to 10,000 miles per year on a normal car, hence that would have in a 130 weeks/2.5 years some 25 thousands miles top.

If (as it is reported here and there) an Uber driver _needs_ to make 3,000 miles per month, the car after 30 months would be more likely to be in the 90,000 - 100,000 range, i.e. the same as a 10-12 years car, i.e. an "end of life" car.

Even if only 2.5 years old, upholstery, seats, plasric accessories, etc will likley show the wear from use.

Such a car can only be sold to "particular" customers.

But if the value is bigger, then it is another reason why the 9,000 US$ lost per car are simply too much.

<comment><USER10> A 2014 Corolla with 120k miles in "average" condition books at $5-7k "trade- in" value (which tends to map pretty well to wholesale value).

<comment><USER9> Good, then if we use the lower US$ 5,000 as a reference, the "complete cycle" turns to be actually advantageous for Xchange.

15,860+5,000=20,860 against a cost (adding the costs of "basic maintenance", assuming an intervention every 5,000 miles of 100 US$ each) of 16,500+20*100=18,500

That is 2,360 over 18,500 in 2.5 years, roughly 13% or 5%/year interest (excluding administrative/managing costs).

</comment></comment></comment></comment></comment><comment><USER11> Uber is playing both sides of the table which is ok if you are profitable overall. But not ok if you are losing money on both sides. Uber will go a full Groupon soon.

<comment><USER12> You mean they haven't already? I have no idea how an idea as simple as Uber, where they clearly don't give a fuck about rules, regulations, or paying taxes, _still_ can't make money.

It's like a mob running a casino that's laundering money and it bankrupts itself, you know, like the Taj Mahal in New Jersey. It takes an astonishing lack of talent to make that happen.

</comment></comment><comment><USER13> I saw -$9000/vehicle and 40,000 vehicles and thought, that's only $360 million of losses. At the scale of Uber, that's just a cost of doing business. It's half of what it paid for Otto, and probably less than 1% of the startup costs for producing self-driving vehicles. To put it another way, $360 million one way or the other is noise on Apple's bottom line. It is 0.05 of the variation in GOOG market cap over the past five days (~$7 billion).

I'd bet it provided far more bang for the buck than $360 million spent on advertising...with more bang for the buck over online advertising being a four star lock. The interesting story of Uber's subprime leases is not the losses, but the predation on driver partners.

<comment><USER14> $360 million is, though, a substantial portion of their ~$3b/year of losses.

If I were an investor, I might question how many of these types of decisions were driving losses. The model may depend on subsidizing rides, but there's no reason to bleed more than needed.

<comment><USER13> Concern over local losses at one company in an investment portfolio is what separates ordinary investors from the class of investors Uber allows to invest. The Saudi Sovereign Wealth Fund is not going to sweat this. The value of Uber is the distribution of possible outcomes weighted for probability. The worst outcome is $0 and that was accepted going in.

The reason companies like Uber stay private is to keep out ordinary investors and for the ability to ignore the traditional haymaking of Wall Street analysts. All those subprime leases let Uber gain market and refine its product. The widely published per ride loss numbers reflect those leases because they are baked into the overall losses.

<comment><USER15> Are there any metrics on how well these sovereign wealth funds are actually doing?

I often see them making big bets, with some definitely paying off (e.g. Kingdom Holding and Twitter), but I wonder how well they do across the board.

<comment><USER16> Not that they are doing badly, but to some degree they don't have to perform well to be successful. Their primary goal is to transform a currently- limitless stream of oil money into a sustainable source of wealth and income when the spigot turns off in a generation or two.

Same for China overseas investments, it's a way to turn RMB-denominated cash into hard assets in democratic countries with stable political environments. Value-for-money comes second.

<comment><USER15> This is true. I had a friend, who pretty much built a shovelware game, talk a chinese publisher into doing a deal. He banked $200k. I don't even get how that deal even could be made. Hell, he didn't even understand it.

<comment><USER17> The Chinese mobile gaming market is one of the hottest in the world right now. Tencent (the people who make WeChat) pull in USD $1BN each quarter just from games.

There was and possibly still is a lot of dumb money in that space right now.

</comment></comment></comment></comment></comment></comment></comment><comment><USER18> This article seems to ignore the added revenue from a driver having a car and driving people around for Uber. The better metric is probably the average profitability of a driver with a leased vehicle.

<comment><USER19> The numbers in the article came from Uber. If there was a better metric they could have used you'd think they would have done.

</comment></comment><comment><USER20> Uber won't just be out the $360 million on the cars. They'll be out the 40,000 drivers who may not be able to get another leased car.

<comment><USER5> I wouldn't worry about that too much. Their entire business model is predicated on the at-will disposability of their "employees".

</comment></comment><comment><USER21> When I first heard about this program my first thought was "Hahahahaha did nobody at Uber talk to dealership sales department?"

Now my thought is "Hahahaha. I was right."

Uber basically made a subsidiary that specialized in loans that everyone expects to end with the car repo'd and at auction. It's no surprise they got burnt.

<comment><USER22> Even more hilarious is that there are companies that _do_ make money out of this kind of predatory lending. Uber can't even get usury right.

<comment><USER23> That's the end goal of the "We finance everyone!" car dealers, right? Get you in a high interest rate loan and either the client eventually pays it off (paying $15,000 for a car worth $4,000) or they default after 6 months and you take the car back and sell it again.

</comment></comment></comment><comment><USER24> > A 2014 Toyota Corolla was recently being offered for a term of 130 weeks at > $122 a week, totaling roughly $500 a month, according to marketing materials > distributed by Uber.

Only Uber could lose money on a $500/month 2014 Corolla lease.

<comment><USER14> _" drivers...will be able to return the car with only two weeks notice, and limited additional costs. The program allows for unlimited mileage...with routine maintenance also included."_

The core problem for Uber is that the terms made it more like a car rental than a lease. Uber pays the maintenance, unlimited miles, and there's almost no penalty for bailing on the lease. $500 a month (~$17/day) to rent a 2014 Corolla is actually well below market.

<comment><USER25> I'm currently renting a 2017 Corolla from Avis for just over $23/day all taxes and fees included.

<comment><USER14> There are great deals for certain locations.

</comment></comment></comment></comment><comment><USER26> The smoke is thick and the flames are really starting to show..

</comment><comment><USER27> Wow, if even half of that is accurate that is pretty amazing. I always wonder about such stories on how much oversight is involved. Clearly for a company moving fast you have to trust the people closest to the situation to make the best decision, but do you do that when there $600M in play? Do you review their plans and pencil out the math?

It sounds like it will be especially challenging to unwind as well.

</comment><comment><USER28> The author mentions "sub-prime" borrowers several times but I don't see any indication that borrower quality had anything at all to do with Uber's problem.

I always thought sub-prime borrowers were unfairly blamed for the mortgage crisis. There were a lot of average & prime borrowers walking away from ridiculous "nothing down, 1%" mortgages.

<comment><USER29> A house would have to be staggeringly overpriced for a 1% fixed loan with no down and no points to not make sense. Especially if they qualified for a prime rate.

Hell, if I had that loan available I would totally take it and run with it.

<comment><USER30> Well, 1% loans never existed. They were just teaser rates. After a time period (say, 3 years), it would reset to awful ARM rates that the borrower couldn't possibly afford.

The loan agent: "No problem, just refi before then."

<comment><USER29> So people were running away from loans that were about to get way more expensive? Who could have ever seen this coming?

IIRC you can't refi if your house value has dropped below your equity in it, meaning those people didn't really have a choice.

</comment></comment></comment></comment><comment><USER31> Uber is about externalizing the cost to others. It's no surprise they bleeding red once they take on the cost themselves.

</comment><comment><USER32> Do people actually care that Uber is running at a loss with rich investor money? It seems like a good form of income redistribution. You would think the left-tech scene would be in favor of this.

</comment><comment><USER33> Does this mean there is (or will soon be) a glut of Priuses on the market?

<comment><USER34> There is a tidal wave of used cars coming into the used car market due to substantial subprime defaults, including these Uber vehicles.

</comment></comment><comment><USER35> Uggh read below (edited my 1st comment after fully reading the terrible details that will hugely and negatively affect a friend)

<comment><USER35> Also, wow my friend whose parent made him go bankrupt at 18 (put his name on deed of their house & didnt tell him) is going to lose his car he uses to make money and support/transport his family.

Whoever votes me down has no heart. Uber is run by criminals!

</comment></comment><comment><USER36> >"The Xchange Leasing division had been estimating modest losses of around $500 per auto on average, these people said. But managers recently informed Uber executives that the losses were actually about $9,000 per car — about half the sticker price of a typical leased vehicle."

So their accounting was off by almost two orders of magnitude?

My first thought was "how was this even allowed to happen?" But then I read:

>To fund these leases, Uber obtained a credit facility of $1 billion last year from a consortium of banks including Goldman Sachs, J.P. Morgan Chase, Citigroup, and Morgan Stanley."

I think this is what happens when its all funny money. Uber loses hundreds of million of dollars a quarter and yet big banks have no problem writing them a check for another billion. I'm guessing none of the banks asked what the credit facility was for or even any details about the leasing plan it was intended to fund?

<comment><USER37> In all fairness, 2 orders of magnitude over $500 is $50,000. They're a lot closer to 1 order of magnitude ($5,000) than two.

<comment><USER36> Sorry yes, definitely not a factor of 100. That's what I get for being up late :)

But still it's greater than even a single order of magnitude which is a substantially large accounting discrepancy.</comment></comment></comment>