Dwarf Fortress is coming to Steam with graphics - <AUTHOR> https://www.polygon.com/2019/3/13/18263905/dwarf-fortress-steam-graphics-workshop <comment><USER2> Three points of interest:

1) Full developer announcement on their Patreon page -> [https://www.patreon.com/posts/25343688](https://www.patreon.com/posts/25343688)

2) They are putting on steam largely because of the USA's shit healthcare system "after Zach's latest cancer scare, we determined that with my healthcare plan's copay etc., I'd be wiped out if I had to undergo the same procedures . . "

3) Cool to see that they are going to use graphics built by two of the most popular community modders:

-=> MayDay built one of the most popular current graphics packs @ [http://goblinart.pl/vg-eng/df.php](http://goblinart.pl/vg-eng/df.php)

-=> And Meph has built a fairly massive tile set as well @ [http://www.bay12forums.com/smf/index.php?topic=161047.0](http://www.bay12forums.com/smf/index.php?topic=161047.0)

Will be interesting to see how they change with native support.

<comment><USER3> > They are putting on steam largely because of the USA's shit healthcare > system "after Zach's latest cancer scare, we determined that with my > healthcare plan's copay etc., I'd be wiped out if I had to undergo the same > procedures . . "

I have mixed feelings about this.

On the one hand, it totally sucks.

On the other hand, I suspect that as as consequence of this crappy pressure, Dwarf Fortress will reach a substantially wider audience and bring joy to a greater number of people.

I'll be interested to see how Tarn looks back on this moment in, say, five years.

<comment><USER4> Hey, look at it this way: Capitalism in healthcare _does_ drive a better consumer experience!

<comment><USER5> I think the other response was flagged for language, but the included link was really interesting. I'd never even heard of medical "lodge practice" before seeing this video and reading through some of the references.

They're basically voluntary, mutual aid societies – many of them were basically small unions. The were strangled by the bigger, consolidated organizations:

[https://m.youtube.com/watch?v=fFoXyFmmGBQ](https://m.youtube.com/watch?v=fFoXyFmmGBQ)

The video is probably good for most audiences, but if (like me) you prefer to read, it looks like this is the short essay it's based on: [http://www.freenation.org/a/f12l3.html](http://www.freenation.org/a/f12l3.html)

The references at the end of the essay include some really interesting historical accounts which I've enjoyed reading over the past few hours.

<comment><USER6> Video seems to hand wave the actual issues of healthcare which are treatment costs and scalability.

The only issue addressed was basically labor rate of doctors (and AMA artificially limiting the pool of doctors by raising standards).

The tone of the video was horrible -- no thanks. I don't need scary cartoons to tell me how to vote.

The end conclusion is basically "what if gov't is the problem?" without offering a solution (or even evidence based critique of modern systems -- what happened over 100 years ago is not the most relevant to my interests. As others have pointed out, the practice of medicine was a lot different then). Total waste of time and attention.

I honestly cannot understand how people look at the health care situation in America and think "if only health insurance had less restrictions, that would solve everything!"

</comment></comment></comment></comment></comment><comment><USER7> One thing that amazes me about Dwarf Fortress is that the creator(s) don't use version control[1] (as of 2014, things may have changed):

"I don't use version control -- I didn't like the feeling of having the code get committed into a black box thingy with no immediate upside."

I can't fathom how you can manage the complexity of a game like DF without a VCS.

[1] [https://www.reddit.com/r/IAmA/comments/1avszc/im_tarn_adams_...](https://www.reddit.com/r/IAmA/comments/1avszc/im_tarn_adams_of_bay_12_games_cocreator_of_dwarf/c919fo8)

<comment><USER8> Honestly, for personal projects where I'm the sole developer, I only use git nominally. I mean, it's there, and sure, I commit; but it's not like I'm spawning feature branches or anything like that. It's a rather linear set of commits, functionally almost equivalent to having a zip of the source every now and then. I'm sure many people are the same.

<comment><USER9> Sort of.

I've used git for so long and so deeply that it's ingrained in the way I think about code - I break things into atomic commits, and regularly traverse and edit the commits in the feature branch that I'm working on. That doesn't change when I'm working solo, nor do my commit message style rules. I find it very useful to be able to investigate the history of a piece of code, even as it moves across multiple files, and figure out what happened and why.

That said, when I'm working on a team I generally don't care how many concurrent branches are being worked on - it's not a problem at all if the threaded view is n levels deep. When I'm working alone I tend to have a linear (single threaded) history, with tags for each release or deploy.

<comment><USER10> _" I break things into atomic commits"_

This is something that I struggle with. And it sets me apart from the apparent majority of (younger) programmers.

At best, once I've baked something enough that I'm satisfied, I can go back and break up the work. But then what's the point?

From my perspective, the agile/scrum mindset (velocity!) leads to spamming the code base with poorly reasoned trivial changes, frequently just kicking the can down the road, happily accumulating technical debt like an accretion disk.

Alas. I think the youngsters are more correct. Code bases are now so short lived that anything more than the bare minimum is just wasted effort.

I miss the days of product development and burning CD-ROM gold masters and people at least tried to hammer nails straight.

I know, I know, get off my lawn and all that.

</comment></comment></comment></comment><comment><USER11> I've played DF a lot.

Biggest problem that I had is that it eventually becomes a challenge to manage the framerate. I realize there are ways to fix this that are intertwined with the gameplay, but I'd rather play the game instead of butchering kittens and other things in an effort to keep the game performant.

Second issue is with military organization. I never really became confident in my ability to get the squads doing what I wanted them to do (wearing the proper uniforms, training with a crossbow).

Despite this, I've had a lot of fun with the game. Building, farming, and managing a metal industry is a lot of fun. The barrier to entry is still pretty high, and I don't think the announced additions are going to change that.

(haven't played in the last year or two, so my criticism may be outdated)

<comment><USER12> Multithread w h e n ???

Also, early embark setup fatigue is real. Setup the stockpiles. Plan the rooms. Have the plans outpace your current productivity and have it take way too long. Do this every time.

Once that's over, though, you get to enjoy sorting through droves of migrants, assigning each to the tasks they're most appropriate to or which need the most dwarves right now (the game actually approximates this automatically in that it generates migrants vaguely in reflection to the fortress's needs, but it's not like it assigns all burly, tough, slow-to-tire dwarves to your melee squads or that talented bonecrafter to more useful crafting jobs, so it's up to your manic OCD). Do this every season.

Somewhere in there, have some !FUN!.

<comment><USER13> Multithread never. You know in your heart of hearts that DF wasn't built with modularity in mind and that the code is a horrific mess of dependencies everywhere and making it multithreaded would require a near complete rewrite of the system.

<comment><USER14> Actually, one of DF's biggest CPU-sinks is AI pathfinding, which is a: embarrassingly parallel and b: highly speculatable[0], so the only hard part would be keeping map walkablity data in-sync or read-lockable (depending on whether you want a separate copy or not).

0: ie, you can fire off a pathfind from your current position, keep walking for several steps (many game ticks) before getting the result back, and just do some minor fixups to make it work.

<comment><USER15> > the only hard part would be keeping map walkablity data in-sync or read- > lockable

I suspect that this is entirely the problem. For quite a while not I've gotten the impression that all of the game state in in a single data structure.

Also I'm pretty sure that there are update anomalies galore even now. It's almost certain to be a herculean task. I might be wrong, but the fact that Tarn has never even attempted it makes me suspect that I'm right ;-)

</comment></comment></comment></comment></comment><comment><USER16> I've never been able to get into DF but I would suggest people check out RimWorld. I've heard it described as "Dwarf Fortress is Rimworld for people who hate fun" [0] and people often draw parallels between the two [1].

[0] [https://www.reddit.com/r/RimWorld/comments/7dm7j8/how_does_r...](https://www.reddit.com/r/RimWorld/comments/7dm7j8/how_does_rimworld_compare_to_dwarf_fortress/)

[1] [https://www.reddit.com/r/RimWorld/comments/6xeie3/coming_ove...](https://www.reddit.com/r/RimWorld/comments/6xeie3/coming_over_from_dwarf_fortress_i_feel_like_my/dmfb8rm/)

<comment><USER17> Rimworld is kinda lame if you've played DF. They are not even comparable.

<comment><USER18> how so? the production chain is almost as deep. the damage model it's close in detail, and it's not terribly broken (whips anyone?) which should count as far as features go. you can actually caravan, explore people and exterminate faction without being restricted into adventure mode. and when you ask a neighbor for something in the caravan, you get what you asked. weather and climate is much more prominent, including more dangerous event like dry thunderstorm; the storyteller driven game is also quite ahead of seasonal invaders. husbandry is about the same and farming has terrain and light modifiers.

as far as game mechanics go rimworld lack building on multiple z levels and fluids.

and then you have gnomoria....

the real differentiation is the depth world history that df has that's quite unique.

I love dwarf fortress, but let's not put that on a golden pillar.

<comment><USER15> For the way many people play DF, I think Rimworld is a better game. However, one of the core features of DF is that the world persists and has history. That's why there is no winning condition. Rimworld has a kind of lame winning condition (get off the planet), but it's there for precisely the reason that it doesn't exist in DF: Rimworld is a game with mechanics optimised for good gameplay. DF is a fantasy world simulator where you immerse yourself in the world and do whatever you want.

Again, for a lot of DF players that point is lost. They want to set up their efficient workflows or build their wonderful creations or they want to slaughter wave after wave of goblins. However, DF is set up in a way that the player is not necessarily important to the world. You die and the world just continues. You explore the world as an adventurer. You get killed by a duck. Life goes on. Your fortress falls to a weregopher. Life goes on. You explore the ruins of your fortress, track down the weregopher and get your revenge. That's DF. Rimworld has _none_ of that.

Rimworld is a good game. DF is more like a toy.

<comment><USER19> The way I see it, it's like the difference between people who follow a Lego manual (RimWorld), and people who are creative enough to just build awesome things without it (DF). It's 100% what you make of it.

There's an amazing channel on YouTube, called Kruggsmash, that does DF lets plays. In his current series, he initially founded a new settlement based entirely on bee agriculture and trading - no fighters. He kept the population small so they were under the notice of the local goblins, and got set building an awesome looking place with custom bee related statues, engravings and the like. Unfortunately the other dwarf settlements around him (NPC ones) die off because of the local goblin fortress, and refugees start flocking to his settlement. (SPOILERS AHEAD!) He ends up throwing a vampire goblin down the well, and stabs him with spikes which ends up bloodying the water. The dwarves that drink the water then end up turning into vampires themselves, so he now has a fortress of vampire dwarves! He also has a massive prequel to this fortress series where he plays in adventure mode as a boar man and his compatriot goblin buddy (the one now down the well...), going around stealing artefacts and building his own role-play story, with some amazing illustrations to show what's happening in through all the ASCII graphics.

Honestly, he's more than worth a watch. You get very attached to all the characters, especially the dwarves that have been there from the beginning. He's one of the few YouTubers I've ever contributed towards on patreon.

</comment></comment></comment></comment></comment><comment><USER20> Kitfox Games is run by Tanya Short, who's co-authored a book on procedural generation in games.[1]

She gave a pretty interesting talk in Vancouver about how it integrates into her studio's production methodology. A lot of Kitfox's games employ procgen, so I feel like they're a good fit for the title. [2]

[1] [https://www.amazon.ca/Procedural-Generation-Design-Tanya- Sho...](https://www.amazon.ca/Procedural-Generation-Design-Tanya- Short/dp/1498799191)

[2] [https://m.youtube.com/watch?v=TH11Q7VPXj8](https://m.youtube.com/watch?v=TH11Q7VPXj8)

<comment><USER21> Co-authored with Tarn Adams, the co-creator of Dwarf Fortress.

</comment></comment><comment><USER22> I've often wondered if DF will ever get an open source version that tries to recreate the same experience but focuses on consistent interface design, performance and multithreading, and ease of extensibility.

DF has a huge head start, and two of the most incredibly passionate developers out there, but it's also clear they prioritize expanding the model first and foremost rather than trying to tackle any of the user experience issues that have plagued the game forever.

(To be clear, I _adore_ DF. I've put many, many hours into DF. It's a truly amazing game and I continue to wish the developers success.)

<comment><USER9> I feel like every time someone sets out to create a F/OSS successor to DF, they end up mired in creating dungeon and world generators and never produce a functional game.

Really, that's what DF _is_ anyhow; they even call it a "story generator" IIRC. Tarn just managed to put enough of a playable game together before getting lost in the details of world generation, and people have stayed engaged enough with it to keep him involved in the project.

<comment><USER23> Yeah, and with FOSS this is all the more important. No one is going to play your game, if it's not fun. Few people are going to play your game, while it's not yet in some tangible way better than DF.

And if people don't play your game, they're not going to contribute to it.

</comment></comment></comment><comment> crooked-v "No access to the source code" is a seriously weird thing to note. Is this going to be like one of the existing memory-injecting/manipulating mods, with all the downsides that implies?

<comment><USER24> It's a roundabout way of assuring the existing community that the integrity of the simulation/game is the same as always. All of these mods are memory injection/watching, but nothing is being done to circumvent the modders.

<comment><USER25> In fact there's some work done to support them. For instance, it calls SDL_NumJoysticks once per frame to give DFHack a convenient hook location... ...

...that's my fault.

</comment></comment></comment><comment><USER26> I've never played it but it sounds like a compelling game with an in-depth model.

I started out playing games on a monochome amber monitor + Hercules graphics. But I still think that going beyond ASCII characters is a nice touch that will make the game easier on the eyes.

> in today's FAQ, the pair said that they're selling this premium version in > part to pay for health care for ailing family members.

That's too bad that it's come to this but perhaps it will bring the game to a wider audience.

<comment> crooked-v The gameplay model is extremely elaborate and compelling, but the UI is wildly inconsistent and vigorously inscrutable, even compared to "every key is a separate command" classics like Nethack.

<comment><USER15> Not to mention the seemingly millions of bugs and oddities that you have to keep in your mind when you play. Lots of stuff just doesn't work, or works weirdly enough that it's better off avoiding it. Becoming a "good" DF player involves a lot of learning how to avoid those landmines.

I still love it though! There is nothing like it.

</comment></comment></comment><comment><USER27> Buy through Patreon and they get a much larger portion of your payment.

<comment><USER28> I think you mean Itch.io: [https://kitfoxgames.itch.io/dwarf- fortress](https://kitfoxgames.itch.io/dwarf-fortress)

<comment><USER29> [http://www.bay12games.com/support.html](http://www.bay12games.com/support.html) is the best place to donate directly and ensures they get the biggest cut.

</comment></comment></comment><comment><USER30> Its great they're bringing DF to a larger audience and adding graphical tile sets will sure help but I found the most inscrutable thing about this game wasn't how it presented the graphics but the menu system. I'm curious if the Steam release will do anything to make that less impenetrable.

</comment><comment><USER31> From the article:

 _Kitfox said that it has "no access to the source code, and will have no influence on the design, programming, or updates to Dwarf Fortress."_

Interesting approach, they're basically making a commercial client for the DF "server". From what I know of Dwarf Fortress mods, even though tile sets and data definitions are data driven, a lot of the functionality is hard-coded, so many mods\viewers work by reverse engineering and reading or modifying memory at run-time. Indeed looking at the Dwarf Therapist code this seems to be the case still ([https://github.com/Dwarf-Therapist/Dwarf- Therapist/blob/mast...](https://github.com/Dwarf-Therapist/Dwarf- Therapist/blob/master/share/memory_layouts/)).

With a commercial release with Steam Workshop support and no source access for the primary developers does that mean DF will get a proper mod system? Steam is likely to bring in a lot of new users that don't necessarily have the patience to deal with "truths" the existing community has been dealing with for 14 years...

</comment><comment><USER32> Direct donations (maybe Patreon, too?) are rewarded with a narrative blurb & ASCII art or a crayon drawing. I treasure my drawing of a minecart barrelling toward a goblin tied to the tracks.

</comment><comment><USER33> The problem with DF was never the graphics but the UI itself. See Rimworld which is hugely popular but much more "playable". Basically the UI is holding back the game to become a much bigger success

<comment><USER34> Rimworld is also a MUCH simpler game. It's simpler to the point when I played it Rimworld felt "dead" as compared to how "alive" the DF simulation felt.

<comment><USER35> Rimworld is a much simpler game, but it would not be improved if, instead of the incredibly straight, user-friendly forward military system that it has, it had the insane morass of uniforms, schedules, equipment menus, burrows, that Dwarf Fortress does. It's an incredibly roundabout system that has too much complexity in the UI, for too little complexity in gameplay.

You could add features to Rimworld, to reach feature parity with Dwarf Fortress, and it's easy-to-use UI would still hold up.

</comment></comment></comment><comment><USER36> I always read about Dwarf Fortress in HN and it always interested me. But some elements, like the ASCII art, always seemed to me as entry barriers purposefully built to maintain a protected subculture that I had no interest in being part of. I just wanted to try out a good game.

So this comes as good news to me, I'll probably give it a try now with the tile graphics.

<comment><USER13> IMHO, the graphics aren't nearly as much of a barrier as the interface. If you just install DF and open it up you will be overwhelmed and there's no help system holding your hand. The word "inscrutable" gets tossed around a lot with Dwarf Fortress, because it is the prefect encapsulation of the first time player's experience.

<comment><USER37> The interface is part of the charm; you get dopamine hits not just for knowing what to do, but also figuring out (after trial and fun^H^H^Herror) _how_ to do the things you're trying to do.

<comment><USER13> Or you know, even _what_ you are supposed to be doing. The game asks you a whole bunch of questions about how to create the universe that you have no idea about, then it plops you down with a bunch of dwarves in some kind of environment, and you know you're supposed to dig a home and I guess you need to task the Dwarves to do that (they're just wandering around aimlessly), but when you try to give the Dwarves a task they just wander around aimlessly still for no apparent reason.

</comment></comment></comment></comment><comment><USER38> > But, in today's FAQ, the pair said that they're selling this premium version > in part to pay for health care for ailing family members.

"Name one positive thing about the US health insurance setup."

"Uh... it got us Dwarf Fortress with graphics, I guess?"

<comment><USER37> DF already has graphical tilesets, right? This is just a packaging of them?

<comment><USER39> The graphics are new, as far as I can tell. From a Patreon post on the same topic:

> She's contracted Mike Mayday and Meph, who've both

> been with the modding community for many years.

> Zach and I are working closely with them as they

> create a tile set that fits the game and meshes

> well with our underlying code.

<comment><USER40> Graphics have been available for a long time, now, they've just never been bundled with the game itself.

</comment></comment></comment></comment><comment><USER41> [https://twitter.com/moonpolysoft/status/1105872843475030016](https://twitter.com/moonpolysoft/status/1105872843475030016)

>In a just universe the dwarf fortress dudes would've gotten notch's money

([https://www.gamebyte.com/creator-minecraft-admits-ripped- off...](https://www.gamebyte.com/creator-minecraft-admits-ripped-off-another- game-creating-minecraft/))

<comment><USER42> This is true, but Tarn Adams was in fact offered a big commercial deal before and rejected it. He really values the independence of his vision.

</comment></comment><comment><USER43> I was consumed by df for about six months to the detriment of everything else.

I've never been able to go back, but I always remember it as the best gaming I ever did.

Df is a piece of art comparable to anything created by mankind to date. In a 1000 years I believe df will be compared with Mozart and the Mona Lisa.

And hopefully they've improved the efficiency... I want my descendants to be able to build that 1000 dwarf fortress!

<comment><USER44> >Df is a piece of art comparable to anything created by mankind to date. In a 1000 years I believe df will be compared with Mozart and the Mona Lisa.

you're not the only one who thinks so: [https://www.moma.org/collection/works/164920](https://www.moma.org/collection/works/164920)

</comment></comment><comment><USER45> I wish they would release on gog too, but I guess that kind of loses the benefits of the steam workshop. Maybe an independent mod manager?

<comment><USER46> If you want a DRM-free version without Steam integration, they're also releasing on itch.io.

<comment><USER45> Awesome! Also do you happen to know if it's coming to Linux too?

</comment></comment></comment><comment><USER47> Oh no. There goes everyone's productivity, killed by catsplosions.

<comment><USER48> And by killer carps. Never turn your back on carps. They want you dead!

Explanation: [http://dwarffortresswiki.org/index.php/40d:Carp](http://dwarffortresswiki.org/index.php/40d:Carp)

<comment><USER49> They fixed that though. I think the current most problematic bug is that your dwarves can't kill undead heads if they're decapitated from the body. The dwarves just gather around and endless keep beating it the zombie head.

<comment><USER48> Presented like this, I'm not sure if it's a bug or a feature.

<comment><USER49> Yep, it's great !FUN! but it essentially kills the fortress since any dwarf in viewing range will drop everything and fight until exhaustion.

Kind of sucks if you like the challenge of evil biomes :(

</comment></comment></comment></comment></comment><comment><USER50> The corner grass in the pics looks weird. Are they supposed to be cliffs?

I've heard of this game but never tried it. I've only played nethack on a terminal. I'll definitely try it!

<comment><USER51> Those are cliffs. The grass is at a lower elevation than the mountain.

</comment></comment><comment><USER52> I wonder if the steam/itch.io versions will support linux? It only has windows on the steam page so far and nothing about platforms on the article or FAQ. I would enjoy a version integrated with the steam workshop with automatic updates and to help them out some more.

</comment><comment><USER53> Interesting choice of Steam and itch. I'd be very interested to hear more about their selection process on platform once they decided to Get The Money. Specifically I wonder if they explored the new Epic platform, guess I'll have to tune into the AMA tomorrow.

<comment><USER54> Its not that interesting to me to pick Steam and Itch since they have many more users than anything else including something that barely launched.

</comment></comment><comment><USER55> How is it possible that reasonable people are OK with this kind of bullshit healthcare policy?

<comment><USER56> because capitalism lets people charge accordingly to supply and demand, and America will defend capitalism till the end

<comment><USER55> It's not capitalism, half the world has capitalism and much saner health systems.

It's some kind of extremism.

</comment></comment></comment><comment><USER57> Dwarf Fortress seems to be way beyond me. It takes ages reacting to any keyboard input I make and once I get to the actual game screen, I can't even find my character. Maybe the Steam edition will finally be usable for me.

</comment><comment><USER58> Great news! I'd bet they make tons of sales from this on reputation and additional visibility alone and given their methods that should fund development for the rest of their lives at least.

</comment><comment><USER59> Another Roguelike game called ADOM that has been around since the 90's was brought to Steam with upgraded assets and sounds a couple years back.

<comment><USER56> And it highlighted how aged the game was. It's a roguelike masterpiece, but there has been many more playable ones since. DF hasn't aged as badly, but standing up in Steam to more playable games will be challenging.

</comment></comment><comment><USER60> Even if you don't plan on buying it on Steam, wishlisting it there will help the devs.

</comment><comment><USER61> Maybe I'll finally try playing it. It always seemed fascinating.

</comment><comment><USER34> I hope they can included TWBT as the multi-level view is kind of needed for any proper graphics visualization.

</comment><comment><USER62> Dont know why this remembers me a Story from HackerNews...

I call this story by the xiaoming of "The Black Dice on White Table"

In October of 1994, I'd just started as an honest-to-goodness videogame programmer at a small startup called SingleTrac which later went on to fame and glory (but unfortunately not much in the way of fortune) with such titles as Warhawk, the Twisted Metal series, and the Jet Moto series. But at the time, the company was less than 20 employees in size and had only been officially in business for about a month. It was sometime in my first week possibly my first or second day. In the main engineering room, there was a whoop and cry of success.

Our company financial controller and acting HR lady, Jen, came in to see what incredible things the engineers and artists had come up with. Everyone was staring at a television set hooked up to a development box for the Sony Playstation. There, on the screen, against a single-color background, was a black triangle.

"It's a black triangle," she said in an amused but sarcastic voice. One of the engine programmers tried to explain, but she shook her head and went back to her office. I could almost hear her thoughts… "We've got ten months to deliver two games to Sony, and they are cheering over a black triangle? THAT took them nearly a month to develop?"</comment>


Flutter: High-performance, cross-platform mobile apps in Dart - <AUTHOR> http://flutter.io <comment><USER2> Can someone shed some light on the architecture. Is this cordova based with dart2js compilation?

<comment><USER3> No. It's a runtime based on some low level chrome internals like Skia, and with the Day VM on top. There's no built in HTML or CSS.</comment></comment>


Would You Pay $5 to Apply for a Job? - <AUTHOR> https://medium.com/@mgav/would-you-pay-5-to-apply-for-a-job-d558b1687e52#.y7da6jsuw <comment><USER2> I already pay, usually, north of half a kilobuck in lost wages to interview, so the fiver doesn't matter except as a signal.

That said, I would never apply for a job that asked for cash up front, just because it is a signal that it operates like a mlm or other sales related thing, and that isn't something I have to tolerate.

</comment><comment><USER3> I would pay if it would speed up the recruitment process, as I hate not having an answer to my applications. The 'We will contact you within 7 working days' or 'If you haven't heard from us in 14 days consider your application unsuccessful' automated responses have to end.

<comment><USER4> Also, if I could be guaranteed completely honest and helpful feedback on any rejection.

Not just "not the right experience", but "we need someone who has built a product with xyz framework", or "looking for someone who has had a bigger leadership role before".

<comment><USER5> The problem is some people give good feedback, other people don't.

Even if you pay the $5, it doesn't mean the person giving you feedback is any good at it.

Made-up feedback is worse than no feedback.

</comment></comment></comment><comment><USER6> Absolutely NOT.

A better question is whether companies would pay for the time a candidate spends to interview (e.g. an onsite interview takes a whole day requiring the candidate to use up a PTO) or as restitution for the pain caused to the candidate of having to talk to the companies' recruiters before getting to a hiring manager.

</comment><comment><USER7> No.

The idea is interesting and there are, in fact, many firms I'd gladly pay $20 - $50 for an audience with (often in the form of buying someone lunch to network) but there's far too much potential for fraud and abuse here.

I won't pay someone $5 to add my resume to their database.

$100 for an introduction to a highly qualified prospect for my services is actually a bargain (an obscene, under priced one at that) in the B2B sales arena....

The problem, of course, is it can be hard to tell the difference between the two in advance....

And nobody will sue over $5 (so limited options to control fraud)

Finally, in the company's defense, you need a way to screen out completely unqualified applicants...

</comment><comment><USER8> I replied to the form, but I think this has to be more transparent than 'some charity'. Also, there is no incentive for the recruiter to put up a quality job posting (aside from hiring a good candidate), but there are recruiting "farms" who will just put anything on the web. The incentive here is for the platform to have as many job postings as possible.

I think a better approach may be charging both the seeker and recruiter the $2.5 fare (recruiters can set a cap, and does not have to be 50/50... could be seeker $2, recruiter $10). But there needs to be painful and incentives on both sides.

<comment><USER9> I'd be more amenable to this if all $5 went to a charity of my choice (and if I'm the one credited for the donation). I'd be even more amenable to this if I could pay the $5 by some other means (e.g. by volunteering for a charity, or perhaps by donating blood).

</comment></comment><comment><USER5> Hahaha.

I think you would be selecting the exactly wrong applicant. Why would one pay for a chance to make _you_ money?

Anyone you want to hire probably has enough other places where application is free.

If anything, you should be paying people for the time they spend interviewing. That would 1) make sure you are incentivized to only bring in people who have a good chance, 2) give you a chance to woo great people who might already be happy where they are.

</comment><comment><AUTHOR> Survey Results: Would You Pay $5 to Apply for a Job?

Sixty people responded to the survey, or left definitively "yes" or "no" comments. As the chart above shows, 40% were yes, 53% were no, and the remaining 7% were either mixed or neutral.

The whole article and maybe 100 comments are here: [https://medium.com/@mgav/survey-results-would-you- pay-5-to-a...](https://medium.com/@mgav/survey-results-would-you-pay-5-to- apply-for-a-job-e39c041eb480#.ipsxvzvht)

Thank you so much to all who participated!

</comment><comment><USER10> No. presumably they are hiring because they NEED my services. When somebody needs something from you, they pay you, not the other way around.

</comment><comment><USER11> No.

Even if you could guarantee accurate feedback from the employer (which you likely can't, since companies avoid giving it to avoid things like potential lawsuits), it'd just feel counterproductive to pay money on the off chance I'd get a job afterwards.

It'd also be rather costly (especially if you're not making money as it is) and would screw things up by taking away the mass submitting applications thing. I mean, at the end of the day, job hunting is a numbers game. It's not all about having the first person through the door with the right skillset hired on the spot.

</comment><comment><USER12> No.

Not the worst idea, but if i want to donate $2.50 to a charity (and who picks the charity?) I'll just do it myself.

The biggest downside I see here is that we already have a huge problem with recruiting agencies blasting job ads all over the place just to collect resumes. Robert Half, for example. Do they ever actually get back to anyone? Seems like all they do is collect resumes. Why would I pay to apply to something like that?

I think that companies should be responding to applicants no matter what. It's just the right thing to do.

</comment><comment><USER13> No way Jose. You have to ask how we've come to a state where people are bold enough to make suggestions like this and actually expect a level of acceptance. By adding a potential cost of $100s to the average job search (especially for those just starting out in their field) would certainly good for somebody, but certainly not good for the job seeker, society or anyone in a temporary financial rut. i.e. even more distribution of wealth to the wealthy.

</comment><comment><USER14> I think maybe it should be "pay $5 and you will get a guaranteed response, or don't pay $5 and you can still apply but there's no guarantee you'll get a response". That way I'll pay to be able to hear from the people I know I want feedback from on a case by case basis.

Hell, i might be willing to pay upwards of $20 for a company I really cared about if I was guaranteed detailed, honest feedback.

<comment><USER15> Freemium applications. That feels a tad surreal.

</comment></comment><comment><USER9> I'll pay the $5 if I'm paid a living wage for my time spent in the interview process.

Also, I find it amusingly disturbing that the response to such a scheme giving wealthier candidates a disproportionate advantage is "lol tough luck bud".

</comment><comment><USER16> Yes if I get a guaranteed and timely response from a human with real feedback. Not just a yes/no as described.

I don't care about donating to charity when I'm applying to jobs.

I am already basically already paying with my time and sanity.

</comment><comment><USER17> No.

Would you pay me $5 per unsolicited recruiting email/message you send?

</comment><comment><AUTHOR> Interestingly, it's quite expensive to apply to college (where the applicant is hoping to become the customer).

</comment><comment><USER18> How to create a job board/recruiting firm:

1\. Create a website with a simple form 2\. Put "NOT a recuriting firm" all over the website 3\. Write a controversial blog post about tech interviews/recuriting 4\. Submit the blog post to Hacker News 5\. Spam the post to anyone on Twitter with a lot of followers

<comment><AUTHOR> @hacker_ads, There is ZERO mention of my startup here, OR on the linked Medium article.

I've tagged SIX people on Twitter, ALL connected to this issue ([https://twitter.com/mgav](https://twitter.com/mgav)). How is this "spamming anyone on Twitter with a lot of followers"???

<comment><USER18> Right well here's an idea for the next article.

The Problem: 90℅ of job seekers are unqualified

The Idea: Every applicant submits both an IQ test from a Mensa testing center and SAT score no older than 60 days

<comment><AUTHOR> troll (trōl)

noun: troll; plural noun: trolls

> a mythical, cave-dwelling being depicted in folklore as either a giant or a > dwarf, typically having a very ugly appearance.

synonyms: goblin, hobgoblin, gnome, halfling, demon, monster, bugaboo, ogre

<comment><AUTHOR> I apologize @ad_blockers. I woke up feeling bad about my comment and realized I can't delete it. In the moment it felt like a slightly clever nudge back, but I see now I shouldn't have written anything at all. Lesson learned.

</comment></comment></comment></comment></comment><comment><USER19> No

</comment><comment><AUTHOR> Thanks for your responses. I'll summarize all the feedback from the Medium article survey and here into another post and link to it in a comment below.

</comment><comment><USER20> Nope. Point by point, I have a few comments:

> Two guaranteed responses: (1) confirmation your application is received, and > (2) if/when you are no longer a candidate for the job.

This should be common decency.

> Responses might be automated emails from "no reply" addresses.

So I'm paying to apply for a job, and not even guaranteed human contact?

> At least half of the $5 application fee goes to a charity

There's something cringy about this. Something along the lines of knowing that someone is profiting from this, but at the same time they don't want to seem like they're profiting on your unemployment and desperation, so they go for the textbook "oh, (some of) this money will be donated to some charity", treating the "charity" as just a generic economic/marketing tool.

> Even this small fee will cause many job seekers to opt themselves out of > applying for jobs they aren't qualified for, resulting in much fewer > unqualified applications for HR to deal with (huge time savings).

Say this is hypothetically in place. You effectively transferring some of the cost of HR from the company to the applicants, now that companies can have smaller HR departments. But who has the upper hand here? Companies that suffer from this "too many applicants" problem aren't your small mom-and-pop shops; they are the big players, everyone wants to work for. It makes sense to assume then that these companies have the resources to hire bigger HR departments and solve their issue. Applicants, they are seeking for job because they NEED a job; morally, doesn't it make sense that the important company takes on the toll of this issue, its recruitment issue, instead of the applicants?

Now, lets think about the applicants. What I see this doing; take two people with the exact same qualifications.

The first one, applicant A, is well-off, will buy himself a better recruiting experience. He will throw his resume everywhere, apply 50 times, cause $250 is like pocket change. In a bigger pool there could well be more hits, so potentially more offers, which not only increases confidence and reduces stress, but also gives the applicant leverage to get even more and better subsequent offers.

The second one, applicant B, has the same qualifications but is not as well off; he thinks twice before throwing each hook. He wants to keep it under $100, so 20 applications theoretically would yield half or less than half the offers applicant A got. This translates to more stress, for there are fewer backup options, less confidence which could yield to even less offers, and much less leverage to get more or better offers.

Is this fair? It just makes the process harder inversely proportional to how big of a deal $5 is to you, and the difficulty of the application process can translate into differing results, even if both applicants have the same qualifications.

Hold that thought, and lets explore another comment I have to make. This one is a bit more speculative, but its worth mentioning too. If none of the money is going to the company, but only half is going to charity, it must be because theres an intermediary who is organizing this whole operation in behalf of the company. This intermediary is arguably another company, a startup, and as it tends to be with things here, for profit.

It needs to grow, so what stops it from changing the $5 tag? What if it's a really desired company we're talking about? Why not $10 or $15? In fact, why a flat rate and not some sort of auction? Surge pricing and all?

Now, go back to that thought you were holding. The unfairness only gets worse as this intermediary becomes more profitable. Suddenly one applicant can still do 50 applications, but the other one is stuck with even fewer shots. Same qualifications, very different opportunities.

Lastly, a closing remark. This is an interesting idea, but it sounds too much like companies selling the opportunity to work for them, which IMO, is just not a good notion. And there's a solution at hand already. As I mentioned before, one can assume that companies have the upper hand and those suffering from this issue have the resources to fix it. If recruiters are suffering at all today, it's because companies would rather save a buck and have an understaffed HR department, or are dumb and overly zealous with their recruitment and spreading the net wider than they can handle.

</comment><comment><USER21> No.

</comment><comment><USER22> Yes

</comment><comment><USER23> No.</comment>


Who can I hire to hack me? - <AUTHOR> https://shkspr.mobi/blog/2019/03/who-can-i-hire-to-hack-me/ <comment><USER2> A somewhat related and interesting read is Jameson Lopp's [1] efforts to make himself vanish: [https://www.nytimes.com/2019/03/12/technology/how-to- disappe...](https://www.nytimes.com/2019/03/12/technology/how-to-disappear- surveillance-state.html)

His goal was to make himself relatively anonymous in the real world and scrub his (actual) personal info from public/for-sale databases. And while he didn't hire anyone to pentest his digital identity, he did hire a PI to try and find him.

 _To make sure he didn't make any mistakes, Mr. Lopp paid private investigators to try to find him. It was an investigator who helped him figure out that his D.M.V. registration was making him vulnerable, which led him to getting a decoy address._

[1] [https://twitter.com/lopp/](https://twitter.com/lopp/)

<comment><USER3> So it's ok to lie to the DMV about your address? I had to give them three documents to prove my address to get a license and my wife did as well to get a state ID. Is the assumption that he knows he's breaking the law and ok with it or is there some scenario where you can provide a false address and that's ok?

Maybe ir differs state to state?

<comment><USER4> Do you need to get a new driver's license every time you move?

<comment><USER5> In at least some states, yes, your driver's license needs to have your primary residence on it, or so an officer told me when I was pulled over and i hadnt updated mine yet.

<comment><USER6> How would the officer know that unless you told him? My address goes to a mailbox in a different state. If asked, I'm just living in the area temporarily for business.

<comment><USER7> I think you run into problems when your current vehicle registration expires and you need to update it.

<comment><USER6> Luckily, the state where I have it registered has online renewal.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> > If not, is this a million-dollar start-up idea?

The niche market of folks with enough security-savvy to know they need the services of a pen tester is pretty small. That said it's also a pretty wealthy niche, so a boutique "personal security coach" business could probably thrive.

<comment><USER9> Companies spend lots of money on security. But then it happens that they're vulnerable when an employee is hacked. I can see in the future companies paying to test their employee's individual security. They might even promote it as an employee perk.

I already know of a company that was hacked due to an email exploit. So they cleaned things up and gave employees specific training. Then six months later they launched their own email attack, something like ten percent of their employees failed that test!

<comment><USER10> If the question is, are there services that target individuals (or individual employees in a corporation) to help protect them from attacks, yes, that exists. Tall Poppy is one of them (tallpoppy.io).

<comment><USER11> Thought it was going to be a phishing testing service which I don't remember the name of (maybe [https://www.getusecure.com](https://www.getusecure.com)).

(Seems like tallpoppy is focused on harassment)

</comment></comment></comment></comment><comment><USER10> You probably can't reasonably pay someone to attack third parties that protect your information. For instance, at several of the startups we run security for, even with your password, a suspicious new pattern of login anomalies will generate an investigation that will consume resources on our end, and we'd be pretty pissed to find out that we'd done it because of a stunt you paid for.

<comment><USER12> While I agree with the general unfairness of this, on the other hand we currently have an ecosystem where SaaS products are used by most people to get their work done and generally manage their lives.

Shouldn't we have the right to know or be able to check how secure our data and identity is on these services?

<comment><USER10> No. As a matter of fact, you do not have the general right to "check" how secure a SAAS provider is.

<comment><USER13> > _Shouldn 't we_

> _you do not_

I don't think this answers the question. Of course unsolicited pen testing is already illegal; that's not an interesting question imo. What I'm more curious about is security industry opinions about whether or not the current law is a good idea.

Are there any changes you would make to the law if you had the ability to do so, or do you see a more general danger in allowing customers to attack their own accounts?

<comment><USER10> I would change the way CFAA charges are sentenced. I would not eliminate the general prohibition on hacking other people's computers.

</comment></comment></comment></comment></comment><comment><USER14> From my years of working in big Banks, none would appreciate a stunt like "hi I gave the approval to hackerX to try and steal money from my account in YOUR bank."

Apart from an obvious black list you are looking at a world of pain both by the bank's lawyers AND the authorities. It may be YOUR money but tampering with a bank's systems is very much criminal activity in most countries.

<comment><USER14> Also... play this imaginary dialogue between you and a Judge:

Judge: who gave you the right to invite someone to hack a company's e-banking security process or Facebook's security processes?

You: it is my data

Judge: it is THEIR system, see you and your friend in 5-to-10 (or whatever the penalty is in whichever country)

<comment><USER15> I do not think it is that clear cut. Unless the bank assumes full responsibility for _any_ kind of security breach, including social engineering, you need to be allowed to take care of protecting yourself (including the crucial step of testing the measures). It falls to the systems, both the banks and political/judicial, to have measures and rules in place to allow and account for that.

If they don't, I feel there's a rather lopsided situation.

<comment><USER16> How does that translate to the physical world? What happens if I pay someone to break into the bank and access my safety deposit box? What if they break into the branch manager's home to steal their key?

<comment><USER17> I'm not saying physical security is easy, but it's better understood in general, and at the very least, it's pretty easy to insure against. Most banks offer insurance on safety deposit boxes so if your item goes missing, you are compensated.

I was talking to a guy who provides online security services for financial institutions. I asked him what happens when someone loses money due to a hack. I found his response amusing and horrifying.

"When someone breaches your online account and steals money, if the amount is $50, the bank will restore it at their expense to keep you happy as a customer. If the amount is $50,000... well, the bank doesn't care about having you as a customer that much."

<comment><USER14> > When someone breaches your online account

The bank will seek to see who/what was at fault. If you handed someone your passwords etc, they carry no responsibility and kiss that 50k goodbye. Your pin/passwords are yours and yours alone. You should protect them. At least in the UK there have been plenty of cases were people were tricked to hand in their passwords. They never got anything back from the banks.

If someone breaks in physically and steals the contents of your safety deposit box they will hunt-them-down. If you come forth and you say "I know who it was, I helped him/her as part of a pen-test" then you are going down with them.

<comment><USER17> And yet I get much more assistance in keeping my login secure from a two-bit social media site than I do from virtually every bank I've had an account with (speaking of banks in the USA).

Two factor using something like Google Authenticator? Nope.

Two factor using a less-secure text messsge? Rarely.

An email asking for secondary confirmation when logging in from a new device or IP address? Forget it.

A history within my account that shows all logins and login attempts, along with the request IP address and location? I wish.

I'm sure banks do stuff behind the scenes to secure my account. But it seems they could do a lot more to empower me to help in the process. I understand that it's difficult to pin the blame on a bank for a password stolen by a virus a customer picks up that had nothing to do with them. But it seems they'd do a whole lot more to help me protect my account.

I'm generalizing, I know, but I find it comical (and frustrating) at how often I see banks _attempt_ to do things in the name of security that don't help at all, but go a long way to destroy UX, or even decrease security.

\- Prevent paste on the password field.

\- Security questions, often with ridiculous questions.

\- "Security" phrase and image.

\- Shocking password restrictions.

<comment><USER14> > \- Prevent paste on the password field.

For Firefox users, I use "don't f... with paste" addon. It works like a charm.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER18> >>I can find some which claim to test the security of CEOs and celebrities. But I can't find anything for ordinary people.

Those are the services for "ordinary people". The thing is, they advertise to celebrities & CEOs because there aren't many people willing to pay for pentesting. That will always be an expensive service, since it by definition requires highly-skilled employees. A service that advertises to celebrities would almost certainly be willing to work with an ordinary individual, but how many people are willing to pay for the service? Certainly not enough for this to be a million-dollar idea.

<comment><USER19> A service for "ordinary people" would likely involve targeting services which are not operated by the customer (e.g. brute forcing gmail or fb creds).

The tester would be taking on legal risk for performing any kind of account takeover.

Consequently, I don't see this as a viable service offering.

</comment></comment><comment><USER20> > When an organisation asks me to set a recovery question, I generate a 32 > character passphrase

This is not actually the best way. For some services eventually you get to a person in a call center who can actually check those security questions to perform a password reset (when all else fails). Having a random string opens the door for someone to claim "oh I think I put something random in there, I really forgot what" and it's likely they'll pull it off. Especially if the hacker _knows_ (somehow[0]) that you put a random string there and it's exactly 32 characters long.

Just go with a plausible name that's still not straightforward to guess.

[0] You may blog about it... Or discuss it loudly and is overheard.

<comment><USER21> No, this is the best way.

I go another step and do not keep that recovery answer once put into the form. Does wonders to make sure everything else does not fail.

In your scenario the service is already broken and the door is wide open no matter what you choose as the recovery answer.

<comment><USER20> > In your scenario the service is already broken and the door is wide open no > matter what you choose as the recovery answer.

You'd be safer with this assumption anyway. But again, after telling the whole internet you're using random 32 character strings for that it's likely that you just lowered the bar a little for social engineering. It is easier than you think to call a call center and convince someone to perform a password reset or a SIM porting (for hijacking). At least don't give them another plausible avenue.

</comment></comment></comment><comment><USER22> I would go with a company that has a reputation. If you go find some randoms in an IRC channel they might take advantage of anything they find. A little crowdsourced service that offers rewards for finding vulnerabilities in your system might be a success but good luck managing that and dealing with the people you got tricked into hacking.

One thing to consider is the password manager generated security questions. Half the customer service agents out there will accept "it is just a bunch of random characters i typed". Security questions should go the "correct horse battery staple" route.

<comment><AUTHOR> My security answers are often random "junk". I've tried to social engineer my way into my own accounts a couple of time - and _all_ of them have insisted on me reading out the full "answer".

<comment><USER18> This doesn't work for Wells Fargo, at least IME as of 9 months ago. I didn't have access to my main password manager (only a phone, I was on a trip), but they did just accept my answer of "random chars generated by a password manager". After that, I went and changed security answers on anything important, I just made a script that pulls random words from a dictionary.

While some services are secure, without testing it isn't safe to assume that any particular service is. And even with testing, it can vary depending on the particular CSA. So in general, I don't think this is a good idea, since there is no way of knowing if any particular service will be secure.

<comment><AUTHOR> Looks like it is time for you to switch bank :-)

Here in the UK, it seems that most reputable organisations are GDPR conscious. I've deliberately got my birthday slightly wrong to see what they do - 100% of the time they refuse to proceed.

Perhaps I'm just lucky.

<comment><USER18> Oh God, I already did. Believe it or not, they don't check for case-so at some point the password is in plaintext. So Asfd=asdf

</comment></comment></comment></comment></comment><comment><USER23> I would love to find a service like this. I, and some individuals I know, would definately pay for this.

</comment><comment><USER24> The real question:

Is this service available to public figures like:

* John Podesta (of the US Democratic National Committee, phishing target)

* John Brennan (former CIA director, whose AOL account was pwnd by teenagers while he held that job)

Of course it is. But these sorts of powerful people always think somebody else is the target.

Mr. Eden's proposal is a good one. Too bad such a business would need more lawyers than pentesters.

<comment><USER25> > John Podesta ... always think someone else is the target

You're aware that Mr Podesta flagged the email as being suspicious, sent it to their security person, and was given the all clear before following it?

<comment> who-knows95 it was a typo right "this email is legit" which was meant to said illegitimate

<comment><USER25> I mean sure, whatever, I'm not trying to beat on the guy, but Podesta did the right thing

<comment> who-knows95 oh no, sorry i agree, it was more just putting it out there. a typo led to that infection.

</comment></comment></comment></comment></comment><comment><USER26> I went to an event recently dedicated to CIOs/CTOs/VP's of Engineering where they had a few talks about cyber security.

It's amazing how those people don't really have much clue about it all. Imagine who's not in the tech field.

I had the same idea at the time. I am not sure if people would pay for such service, but they definitely need it.

<comment><USER27> Those people would likely benefit much more from the awareness trainings pentest shops usually offer as well, snake oil reports without changes in behaviour really don't secure anything.

</comment></comment><comment><USER28> Do you need expert help in gaining access/passwords to Facebook, gmail, Instagram, bbm, yahoo-mail, snap-chat, twitter, Hotmail, badoo, zoosk, various blogs, icloud, apple accounts etc. Password retrieval, breaching of bank accounts: (for local and international banks, block transfers, make transfers), clear debts, pay for bills at give a way rates also provide cheap Holiday booking, breach of web host servers, firewall breaches, application cracks, change of school grades, professional hacking into institutional servers, clearing of criminal records, mobile airtime recharge, keylogging, smartphone,tablet portable device hacks, pc hacks on any OS and ip tracking and general tracking operations..........contact :email@example.com

</comment><comment><USER29> Was going to talk a bunch of smack about pen-testing, but instead, if someone were offering this service, I'd love to go head to head with them to determine who delivered more value over time and money, a pen-test vs. a risk assessment.

</comment><comment><USER30> Simulating a highly targeted attack is expensive, and the protection most people have against those is that they're not interesting enough to spend so much effort on.

For the average person, the main threats are various forms of social engineering, mostly the kind that is really obvious to anyone who has a rough idea how security works ("This is a secure document, please click yes when it asks you to allow this document to execute arbitrary code"), and software so far out of date that common exploit kits have pre-packaged exploits.

</comment><comment><USER31> Most people probably forget how you could use a "stalk my ex" russian bulletin board service for $50 to stalk yourself. Russian script kiddies are probably happy to comply since the FBI can't really harm them.

But I think in most countries you would still be liable to Google/FB etc if the attack gets detected and linked to you.

</comment><comment><USER11> You could use "hacker for hire" services on Tor.

You could also hide a bounty somewhere (e.g. in an email, in a private Github repo, etc.).

You don't even need to mention this is your account, e.g. "I want the email password of X for Y bitcoins".

Both solutions comes with its own issues, but I don't think there is a legal way to do a full pentest.

</comment><comment><USER32> To make such a business profitable, you'd need to invent a slew of new techniques for bringing down the cost of pen-testing. This would have applications far beyond the scope of your business idea.

</comment><comment><USER33> i've done it for free. You can have your identity back by sending btc to ...

</comment><comment><USER34> If anyone decides to start a company for this, please sign me up as your first paying customer.

</comment><comment><USER35> This is a Bezos-level service, no? I mean it exists but is going to cost O($100k).

</comment><comment><USER36> Russian, China, North Korea, Saudi Arabia, UAE, NSA, 5 eyes spring to mind.

</comment><comment><USER33> the person who bezos used was mentioned in the articles v.v. his recent confidentiality breach

</comment><comment><USER37> > I can find pentesting services for companies. I can find some which claim to > test the security of CEOs and celebrities. But I can't find anything for > ordinary people.

I'm sorry to be harsh on this person but this is quite a dumb post. What is the difference between hacking a celebrity vs an ordinary person? None.

Any penetration testing / security consultancy will be able to do what you're asking for, provided you can pay their rate.

> Does this service exist? If not, is this a million-dollar start-up idea?

No it is definitely not a million-dollar startup idea. It also wouldn't be a startup it would be a consultancy. Penetration testing firms can easily charge clients up to around $1000 / day. How many individuals are going to pay multiples of $1000 to see how secure their online data is?

<comment><USER10> You cannot in fact pay a pentest firm to hack a SAAS provider that has your data. The companies claiming to do this for "CEOs and celebrities" are, to some extent, lying.

<comment><USER26> Please share more information on the "whys".

<comment><USER27> One why would be, as long as you don't have a clause permitting this in your contract with the SaaS provider (which "ordinary" people as in this context usually don't have) it would be considered an offense in most countries.

If you're a company and the SaaS provider is of similar or small scale you might be able to work with them if you have special security concerns that exceed their regular customer base. You could maybe even get them to hire a consultancy to check or recheck their services but in no case would you ever just go out and do that of your own volition.

Independent of that, even in a personal context, people use SaaS providers because they trust their ability to do a certain job better and/or cheaper than you could do yourself. That usually includes the factor of securing their data, if only because it's in their best interest not to have PR disasters and lose customers.</comment></comment></comment></comment>


HTML/CSS/script based IDE in 2mb - c-smile http://sciter.com/htmlcss-desktop-ui-solutions-distribution-sizes/ <comment><AUTHOR> If you _really_ want to optimize download size, you could go a step further and use each platform's native rendering engine. So, MSHTMl for Windows (the desktop platform, not WinRT/UWP which nobody actually uses for anything serious), and WebKit for Mac and Linux.

You've said before that some Windows antivirus programs use Sciter. I wonder why they didn't opt for MSHTML instead. Is COM/ActiveX that repulsive? Or is it because Sciter gives them a consistent feature set regardless of the version of WIndows and IE that the user has installed?

</comment><comment> c-smile (I am an author of Sciter)

I am comparing distribution sizes of would-be-sciter-based-IDE with Brackets/Adobe, Visual Code / Microsoft and Atom / GitHub.

Common for all them: they use HTML/CSS/script based UI.

Sciter's IDE uses Sciter Engine as it is.

Others in the set are Chrome/Node.js based. So they appear as include JavaScript runtime twice - the one in Chrome and the one in Node. But conceptually you just need JS once.

Sciter has a built-in option to style arbitrary text runs so syntax highligting does not require DOM change and so it can be done directly in standard <textarea> editor. Yet Sciter exposes existing HTML/CSS/script tokenizers to the script. That again makes highligting as fast as possible yet code reuse of the whole thing.

</comment><comment><USER2> Most of us don't care much about executable or distribution size. Bandwidth and storage are incredibly cheap. My time isn't. If an IDE has the features I need, I don't mind an extra 100 MB.

The comparisons made here are based on priorities that almost no one has anymore. VS Code is a great IDE -- I've never thought about its size.

Let's see some feature comparisons instead.

<comment> c-smile Agree of course. But if you have small distribution size _and_ feature set you need - the better.

Yet: I've been told once by UI/UX director of one of 100-top software companies that he has 40 seconds for the user to decide will he/she use the app or not. That includes also download time. They did special investigation of this.

<comment><USER2> I would bet a lot of money that it's more than 40 seconds when the app is a professional tool and the target audience is software developers.

<comment> c-smile It takes 2 minutes on broadband connection to get Atom for example. But these minutes/seconds are nothing of course in case of IDEs, I agree as I said.

All that just does not look right. Two JS instances while you can do the same in just one. A lot of code in script that is doubling functionality that is already there. So it is not just about size but effectiveness of the whole solution.</comment></comment></comment></comment>


My Girlfriend is a Lush and I Have the Data to Prove It :) - <AUTHOR> http://www.khalidabuhakmeh.com/my-girlfriend-is-a-lush-and-i-have-the-data-to-prove-it

<comment><USER2> Seems a little bit weird that untapped is charging you $50 for downloading your own data.

<comment><USER3> It's also strange that he didn't use scraping since he knew it in the first place (Although I acknowledge that for some people time saved > money) and had to use it later anyway.

</comment></comment><comment><USER4> Is this what you mean by "a lush"?

"lush. one who becomes intoxicated after a few drinks and flirts with everyone." [Urban Dictionary]

It's not a term I've encountered before in Australia.

<comment><USER5> A lush is someone who overindulges in alcohol enthusiastically, but doesn't rise to the level of being an alcoholic. It is commonly used to tease someone about their drinking without calling them a drunk.

<comment><USER6> I would say "may not rise to the level of being an alcoholic." I would not think it weird for the term "lush" to be applied to a (friendly/happy - as you say, "enthusiastic") alcoholic.

</comment></comment></comment><comment><USER7> This reminds me of this research:) [http://homepages.cae.wisc.edu/~jamieson/me/BeerMapper.html](http://homepages.cae.wisc.edu/~jamieson/me/BeerMapper.html)

</comment><comment><USER8> Untappd is great. Another awesome beer tracking app is BeerTab ([http://beertabapp.com/](http://beertabapp.com/)).

</comment><comment><USER9> I had never heard of Untappd. Thanks -- it looks awesome.

<comment><USER4> Not sure if it's improved, but I found it a very slow process to add past beers (rather than only add them as I went) and abandoned it.

It did however beat my previous method which involved adding beer names to a list in the Notes app on my phone and then having limited idea of when and where I'd tasted it, or no search option to check whether something was already on the list.

</comment></comment><comment><USER10> Gotta love programmers and their abilities to solve awesome problems like this :)

</comment><comment><USER11> Everyone needs a hobby.</comment>


Ask HN:  How to change HN's password - <AUTHOR>

I have forgotten my password, and my browser doesn't store it either.
Then I did not find any  "change my password" link.
Thanks for any advice. <comment><USER2> Attempt to login. Use any password. When you try to login with an incorrect password, it will prompt you to try password recovery over email.

<comment><USER3> This only works if you provided an email in your profile. If you didn't, you're generally out of luck.</comment></comment>


Hacker says security flaw let him access any Facebook profile - <AUTHOR> http://news.cnet.com/8301-1023_3-57570811-93/hacker-says-security-flaw-let-him-access-any-facebook-profile

<comment><USER2> Facebook's OAuth2 implementation is so broken. Homakov found a X-XSS- Protection-related issue: [http://homakov.blogspot.no/2013/02/hacking- facebook-with-oau...](http://homakov.blogspot.no/2013/02/hacking-facebook- with-oauth2-and-chrome.html).

After reading Homakov's and Nir's discussions I started looking for some bugs myself. And guess what? ~10 hours later I found _another_ access_token- stealing exploit that has the same implications as Nir's exploit (although mine doesn't work in all browsers). Reported it 2 days ago.

Wouldn't surprise me if there's more bugs/exploits to be discovered :(

<comment><USER3> And since Homakov gave quite a detailed description of the class of bugs, it would be quite dangerous to use a browser with an active session to facebook now.

</comment></comment><comment><USER4> No proof of the exploit?

<comment><USER5> Facebook acknowledged it and the researcher who found the vulnerability got a bounty from FB.</comment></comment>


Ask HN: Do you actually read cover letters? - <AUTHOR>

When you're selecting candidates for interviews, do you bother to read the cover letters?
Do you think cover letters are important?
Do you even ever get cover letters along with resumes? <comment><USER3> Simple answer, yes.

It really is the first impression for me. I begin to develop my views as to whether or not the applicant can communicate in an effective and compelling way. When I hire, I assume I need to teach some job-specific skills (especially related to in-house tools), but I really dislike teaching communication skills. Applicants can overcome a lack of specific experience if they have demonstrated the ability to learn quickly and communicate effectively.

</comment><comment><USER4> I do, and I read them.

Proof read yours carefully, and make sure the cover letter is not a form letter. You might use the same resume for all applications, perhaps with a few tweaks, but the cover letter should show that you did some research on the company and the position.

</comment><comment><USER5> Absolutely, yes.

If you don't include a cover letter, chances are very high that you'll go to the bottom of the pile.

If your cover letter has spelling or grammatical errors, chances are you'll go to the bottom of the pile.

If your cover letter doesn't speak to my company SPECIFICALLY, chances are you'll go to the bottom of the pile.

Basically, if you can't tell me why you want to work for my company and why you're a perfect fit, it tells me that your only interest is in a paycheck, and that you'll take no pride in your work and will show no initiative.

If you can't be bothered to proofread your cover letter and have a friend check it over, it tells me that you're sloppy and don't follow through.

If you can't even be bothered to hit the "spell check" button, it tells me that you're lazy.

</comment><comment><USER6> Don't get cover letters very often, but I always read them, and they do make a big difference; they tell me whether someone's merely sending their resume to every job they can find without much thought, or if they've thought hard about and are invested in this job in particular.

</comment><comment><USER7> Cover letters are a great way to stand out from the crowd.

Most resumes I see don't have them, and a good portion of those that do have a generic 'I want to work for <insert_company_name> and I'm sure I'm a good fit' boiler plate.

Give me some indication that you have studied the company web site, thought about the position and you'd probably get the interview with the cover letter alone.

</comment><comment><USER8> No, but I'm a few steps removed from candidates initial contact. Honestly, I usually don't read resumes either because I don't think they're very valuable in assessing technical skill.

That said, if you're doing initial screens, it's probably worthwhile to read both.

</comment><comment><USER9> Yes, for two main reasons:

1\. Can they write/communicate well? e.g. flow, cohesive thought, attention to detail, proofing

2\. Can they follow simple instructions? e.g. if asked for in the job posting, did they include a cover letter?

</comment><comment><USER10> Absolutely, its a really good indicator between the excellent and good candidates, usually because the person has looked at what you do and relates their own experience to what the company does

</comment><comment><USER11> Yes.

Yes.

Yes, in the form of an email.

</comment><comment><USER12> Fuck Yes

</comment><comment><USER13> From a restaurant perspective, a cover letter can be the deciding factor before performance is proven. Some employers don't require them, but most will. Its your chance to show communication skills and possibly spark interest before your resume is viewed. I've read cover letters that have been so appealing, I only used the resume for contact information - <USER2>

</comment><comment><USER13> One more thing...some online postings don't reveal the company hiring, but, if they do, access their website, pick 2 points about their company that requires yours skills (if possible) and give your point of view as if you already worked for them, of course don't be negative, maybe even just compliment the situation. BROWNIE POINTS..</comment>


Ask HN: Funding for friends that are planning a manned space mission - <AUTHOR>

Copenhagen suborbitals (www.copenhagensuborbitals.com)is a private, open source organisation whose mission is to launch human beings into space on privately built rockets and spacecrafts. The project is funded entirely by  donations and sponsors. The project is around two years old and things are progressing as planned. There have been numerous successful booster tests, and the first planned unmanned testflight is scheduled for this summer off the coast of Denmark. Last summer there was an unsuccsssful launchattempt where, believe it or not, the mission was jeopardized by a hairdryer that didn't work.
Amazingly they're doing this on a miniscule budget . As it is right now these guys are working fulltime and not getting a dime for their efforts. Their budget for the first half of 2011 is $51.000.
I've recently been involved in starting a support organisation for Copenhagen suborbitals, since their economy is extremely tight. The goal is to secure funding for their endeavour and help them with whatever they may need in the form of equipment, management, press, etc. A project as crazy and amazing as this deserves some support, both financially and otherwise. Since we started this support organisation we've gotten 257 members that each pay $20 a month. All of these members are Danish.
The question is: How do we raise more funding for these guys and their amazing project?
questions we're thinking about:
- Would other nationalities consider becoming a member of the support organisation and pay $20 a month? (In the unlikely event you really want to support this right now my e-mail is in my profile :-))
- Would it be possible for us to get one-time donations from individuals? Either high-worth people or just normal people that think this is cool.
- Should we try to run some kind of international campaign to get users? Since this  is all very low budget an international campaign will be a creditcard enabled website and posts on reddit and HN :-)
- Would there be a market for well-paid speaking arrangements where these guys come in and talk about how to build a spacerocket on a budget? (here's a talk one of the guys did on TEDx in Copenhagen: http://www.youtube.com/watch?v=ua9oGxNNGd0)
- Would a kickstarter project work?
- Any other ideas for how to raise money for this?
FAQ:
Launching a human being into space is difficult and expensive, can these guys really pull it off? - I'm personally convinced that they will. They've built the worlds largest private submarine as a hobby project (http://en.wikipedia.org/wiki/UC3_Nautilus, http://www.uc3nautilus.dk/), have had several successful booster tests (http://www.youtube.com/watch?v=I-RT8QfVYc4) and other tests (http://www.youtube.com/watch?v=o_W_g878EdY) so it seems obvious that they know what they're doing.
How exactly will they do it? - They're building a small rocket (64 cm. in diameter, 3.5 meter high, weight 300 kilos) that has a half sitting half standing space at the top for the astronaut. The top of the rocket will have a plexiglass dome so the astronaut has an excellent view. The rocket will propel the astronaut past the barrier to space (100 km) and then parachutes will bring the astronaut safely back to earth.
Isn't this dangerous - Yes.
Where will the money from the support organization go? - All money raised is transferred to Copenhagen suborbitals, except for small amounts used for webhosting, etc. Noone in the support organization is paid. <comment><AUTHOR> Clickable links:

Homepage: www.copenhagensuborbitals.com

TEDx talk: <http://www.youtube.com/watch?v=ua9oGxNNGd0>

Submarine Wikipedia page: <http://en.wikipedia.org/wiki/UC3_Nautilus>

Submarine homepage: <http://www.uc3nautilus.dk/>

Booster test: <http://www.youtube.com/watch?v=I-RT8QfVYc4>

Parachute test: <http://www.youtube.com/watch?v=o_W_g878EdY>

</comment><comment><USER2> Have a raffle, winner gets a trip to space. Or have a subscriber-only raffle for the same prize.

If the project succeeds, you have an awesome commodity- the ability to send people to space (and hopefully bring them back safely). Some people would be willing to pay a lot for this. So I would play around with models that sell this commodity.

<comment><AUTHOR> Great idea in theory, but unfortunately there are a few problems:

\- There is no scheduled date for when the first manned launch is (It's ready whenever we damn well feel it's ready, and safe...)

\- The people riding the rocket will most probably need to go to a physical check. It's a hard ride.

\- There are probably a ton of legal implications that have to be worked out.

<comment><USER2> The "no scheduled date" and physical check points are a non-issues- anyone contributing to the project is aware that this is a self funded endeavor that potentially will not succeed, anyone that wants to go to space, is likely aware of the physical requirements that such a trip would require.

There definitely are legal implications.</comment></comment></comment>


Apple Will Spend $848M Building a Massive Solar Farm in Monterey - <AUTHOR> http://techcrunch.com/2015/02/10/apple-will-spend-848-million-building-a-massive-solar-farm-in-monterey/

<comment><USER2> I suspect that stuff like this, that tends to be more behind the scenes, is what starts separating Apple from all of its competitors operationally. Healthy margins come from low costs

<comment><USER3> More like they tapped into a nice tax credit. Solar power is hardly worth if on its own merits alone, at least currently.

<comment><USER2> Yes, I meant keeping their costs lower overall by doing things like taking tax credits and/or grants to get cheap electricity in the longer term.</comment></comment></comment>


How to Find Product Market Fit – founder of Segment (2017) [video] - <AUTHOR> https://www.youtube.com/watch?v=_6pl5GG8RQ4 <comment><USER2> Really great video and lots to learn here. I think this may be the third time I've seen it, and I'm still getting more out of it.

The biggest thing that hits me this go round is that staying alive is key. PG may have said, you burned $500k and have nothing to show for it, but if they had quit then, they would never have made it through the Great Startup Filter(tm) [https://en.wikipedia.org/wiki/Great_Filter](https://en.wikipedia.org/wiki/Great_Filter). The lack of great businesses (90% failure rate) reveals that the hardest part of building a company is starting a company.

In earlier times when there was more low hanging fruit, the hardest part of starting a company was scaling it. You had to have government backing (e.g. East India Company) or sit in an important part of the supply chain (e.g. Standard Oil) or cover really high capital expenditure (e.g. FedEx). Now that it's easier than ever to start a company, the good ideas are mostly already picked, so finding one is harder.

In economics, this called the explore/exploit or multi-armed bandit problem. What is so interesting to me on this viewing is that Peter Reinhardt's unrelenting enthusiasm and self delusion were a feature, not a bug. There is no way they would have stayed in the game long enough to find product market fit without that. Even though the kernel of the idea existed early on, they needed to taste true desperation to humble themselves enough to do the simplest, stupidest thing that customers wanted.

<comment><USER3> Finding an "idea" is a mistake that most startups make. Ideas alone are worthless. The phrase you're looking for is "finding a need", preferably the kind you can address and charge a lot of money for solving. This is the hard part that most startups fail spectacularly at.

<comment><USER2> throwaway84742, you are correct. That is why I said, "thing that customers wanted" and not "idea." Even having the kernel of the idea was insufficient.

</comment></comment></comment><comment><USER4> I've been thinking about striking out on my own, having both run a contract software business and worked for a startup recently.

I'm inclined to think that the best way to find fit is to make sure people are willing to _overpay_ you for services. For instance, I have a great deal of expertise when it comes to graphics, and I could probably insist on being overpaid in this realm.

If I could automate what I am overpaid for at scale I might have a business.

<comment><USER5> What does "over pay" here mean? More than what you perceive the value of the product or service to be?

I think the key here is shifting your mindset to see value as percieved by the customer.

Percieved value is actual value.

</comment></comment><comment><USER6> As an example the iPod solved an problem people had. As a counter-example the iPhone solved a problem people didn't know they had.

<comment><USER7> The iPhone solved known problems. It was a phone, It was a media player, It was an Internet browser. People knew the problems, the iPhone was just one of the early convenience focused products on the market.

<comment><USER6> Easy to say in retrospect, but solving many problems in one device was revolutionary. Earlier PDAs weren't actually that personal which was the tipping point.

</comment></comment></comment><comment><USER8> I believe every accelerator should show this video. Very helpful!

</comment><comment><USER9> Everyone should block Segment requests when browsing. If you have EasyPrivacy installed, then you're all set.

<comment><USER10> Can you elaborate?

<comment><USER11> Same reason people block google analytics, ad analytics pixels, facebook iframes, etc?

It helps keep more of your data out of the hands of 3rd parties. The website you're actually using will still usually work just fine.

(though as a developer, many of these, including segment, are quite useful...)

<comment><USER12> Seems a bit disingenuous to lump Segment in with ad pixels etc.? We don't use it, but I know of several other SaaS apps who use them to integrate their web app with support tools like Intercom etc. If you block Segment in these cases, sure the web app will work, but the in app chats etc. won't.

<comment><USER11> True, but segment provides many integrations and the user won't know where that data is getting sent or for what purpose. See the list of advertisers with integrations here: [https://segment.com/catalog](https://segment.com/catalog)

</comment></comment></comment></comment></comment><comment><USER13> Fantastic video, the best on the topic of pm fit if you ask me.

</comment><comment><USER14> he's probably very smart and works hard, but is humble about his success, which most people would attribute to the former.</comment>


Ask HN: Do you still support IE7? - <AUTHOR>

And how did you make that decision? We don't, and occasionally that means turning down an enterprisey customer. Sometimes I wonder if we should put a little effort into IE7, since it's not the pure hell that IE6 is. <comment><USER2> Heh. We still support IE6. It's 6% of our users. It doesn't need to look good on IE6, but it needs to work.</comment>


CERN gets new cloud computing platform at the LHC - <AUTHOR> http://www.datacenterknowledge.com/archives/2012/03/02/european-research-forms-the-science-cloud/print/

<comment><USER2> > Close to a petabyte of data is generated every second

True, but misleading. Most of this data is processed realtime in hardware within the detector(s) and the majority discarded (proton-proton collisions are messy with a lot of uninteresting debris). I believe the volume of data actually written out to disk is ~1GB/sec.

[Edit: it's actually 0.5GB/sec <http://public.web.cern.ch/Public/en/LHC/Computing-en.html> ]</comment>


The Truth About Mutual Funds: Fees vs. Returns - <AUTHOR> http://www.vuru.co/blog/2012/01/18/the-truth-about-equity-mutual-funds-fees-vs-returns/

<comment><USER3> As a layman who has done a lot of research, I have 3 pieces of advice for people investing their 401k/IRA:

1) No Load Index Funds.

2) No Load Index Funds.

3) No Load Index Funds.

Seriously people. If your fund selection is so poor in your company's 401k that they don't have a single No Load Index Fund, lobby your HR to get one added, and put your money in the lowest load Index Fund, and put only the very minimum in there to get your company match, and put the rest in an IRA at a company that gives you the option of a No Load Index Fund.

<comment><USER4> Can you explain what you mean by a No Load Index Fund? Can you give an example or two? Thanks.

<comment><USER3> A type of fee commonly levied on mutual fund investors is called "Load." It's a fee you pay either when you buy shares of the fund (front load), or when you sell them (back load). Load is evil and should be avoided.

Index Funds are mutual funds that are not managed. That is, there's no manager and team of assistants that spend time curating the assets in the fund. These peoples salaries and their trading activities cost money and that comes out of your gains.

Index funds are simple: Take a snapshot of the market, say the NASDAQ or S&P 500. Determine the total pie -- add up the market value of all the companies in the index. Suppose AAPL is 15% of the total value, MSFT is 10%, etc. Take all the assets in the fund and spend 15% on AAPL stock, 10% on MSFT stock, etc. Rebalance periodically as needed.

Index funds have historically out-performed most managed funds. There are some winners. Some managed funds that have huge market-beating gains. But trying to pick these big winners is not a sound investment strategy.

</comment></comment></comment><comment><USER5> Comparing the returns of a basket of all mutual funds to the returns of one large-cap stock index over a highly volatile period isn't very meaningful. The mutual funds weren't even 100% equities, so you're partially comparing the returns of entirely different asset classes.

As the article mentions, it's impossible to invest in the total mutual fund market. There is no index fund of mutual funds, nor is there any need when you can diversify across the entire market through existing index funds.

See also The Arithmetic of Active Management: <http://www.stanford.edu/~wfsharpe/art/active/active.htm>

</comment><comment><USER6> If you're interested in a very good exploration of this topic(in the broader context of managing a large endowment), David Swensen's book Pioneering Portfolio Management is worth a read. Swensen manages Yale's very successful endowment and has been a thought leader in investment management. He is also an outspoken critic of actively managed mutual funds and supports his argument with solid data.

<comment><USER7> he also has a book for individual investors, 'Unconventional Success', which is very good, and also skewers active fund managers.

the opportunities in the context of an endowment are somewhat different from those facing individual investors, ie alternative investments are less practical, tax and time horizon considerations are different.

</comment></comment><comment><USER8> "We chose to look at this figure instead of the compounded return because individual investors often move from one fund to another."

Comparing returns over 10 years without re-investing dividends is just not right.

</comment><comment><USER9> Hedge funds are in the same situation, and their fees are even higher - <USER2> of 2% of total Assets Under Management PLUS 20% of any gains are common. For all of that, they have experienced challenges beating indexes as well (down 6.4% for 2011, as measured by the Dow Jones Credit Suisse All Hedge Index - according to the article linked below).

[http://www.forbes.com/sites/greggfisher/2012/01/23/chasing-t...](http://www.forbes.com/sites/greggfisher/2012/01/23/chasing- the-mirage-of-hedge-fund-returns/)

<comment><USER10> Hedge funds' original purpose was to stay negatively correlated with the market, not to beat it consistently. Each is hard enough that doing both probably isn't possible, and it seems to me they aren't keeping their clients' expectations realistic.

</comment></comment><comment><USER7> If you invest for n years and the fee is i%, at the end of the period you will have paid n x i% of the average balance.

or, compared to the final amount you would have had, the amount foregone with compounding is 1 - (1- i) ^ n.

a big number. for instance, after 30 years, for every dollar you would have had without fees, at 1% fees you would have 76 cents.

(for sufficiently low i, (1- n*i) would be a close approximation, but the fee i is usually not low enough LOL)

</comment><comment><USER11> It is surprising that mutual fund returns, after fees, were better than the S&P.

<comment><USER12> It is hard to tell unless all the funds in question only picked S&P tracked instruments. It could be for example, that some funds invested heavily internationally so international market in general delivered better returns than S&P tracked market?

</comment></comment><comment><USER13> That is why I prefer IT's with TERs much less than the ones charged by open ended UT.</comment>


Why Apple Pay could be the mobile-payment system you'll actually use - <AUTHOR> http://www.macworld.com/article/2607181/why-apple-pay-could-be-the-mobile-payment-system-youll-actually-use.html

<comment><USER2> The only reason I'd like to see it "succeed" is that whole tokenization thing that keeps all credit card data private. That's a huge advantage over anything else in my opinion, and if it succeeds, others like Google will have to replicate it.

I know Google wallet creates a virtual credit number, but that remains "permanent", so in terms of tracking, it's not that much different than using the real credit number. It protects you against theft, but not tracking.

Now that I know this kind of tokenization is possible (and more importantly _acceptable_ by the financial industry) even if I'm not going to be in the Apple ecosystem, I'm not going to use anything else that doesn't use the same method.

<comment><USER3> What sort of tracking are you worried about?

If you're worried about merchant-level tracking, I think tokenization makes little or no difference. Quoting from the article:

"Tokenization is typically handled by the payment network, which (in some implementations) encrypts the credit card number right when you swipe it, sends it back for the token, and then provides that to the merchant to keep for things like refunds or customer tracking."

The only potential merchant-level tracking difficulty I can see is that tokens can be merchant-specific, which might make unified customer tracking more difficult after a merger. And even if financial institutions didn't provide services like post-merger token-matching (something I wouldn't bet on), plenty of merchants have quite a bit of experience using other signals to approximate that kind of matching.

<comment><USER4> Contactless EMV also doesn't send the name, making it much much much much harder for companies to try to guess who you are to add you to their mailing list (why do you think companies ask for your ZIP code so much? Name + ZIP uniquely identifies a lot of the population).

(Contactless MSD doesn't either - it normally sends something like "VALUED CUSTOMER" or "NOT AVAILABLE")</comment></comment></comment>


My weekend project: alarm clock that makes you prove you are really awake - <AUTHOR>

I've been reading a bit about sleep cycles, timing, and trying to be more awake lately, and I had an idea - an alarm clock that makes you do a simple math problem before it will turn off.  That way, you wouldn't turn off your alarm while still half asleep, without consciously realizing it.
A few hours with heroku and twilio later, I have this: http://www.getwakeupcall.com
I kind of like it, because it seems simple and useful.  But if I do pursue it, I'm not really sure how to.  A subscription web service is easiest and simplest for me, but if I go that route I would have to charge much more than I would for, say, an iPhone app with similar functionality (since the web app calls the user's phone, potentially many times per day, and a local app would probably not have so many ongoing costs).
I'd love to hear your thoughts on 1) whether this idea is worth pursuing and 2) if so, in what format?
Many thanks! <comment><USER3> Services make sense when you add value on an ongoing basis. Since it's not only possible but pretty simple to build this as an app, it makes much more sense to sell it as an app.

More importantly, anything that depends on having active service is much less reliable, and an alarm clock should be reliable above almost all other factors.

<comment><AUTHOR> That's a very good point. Really the only benefit I can think of to providing it over the phone is that it would work with any (well, _almost_ any - <USER2> wouldn't work with a rotary phone) phone, not just a smartphone.

Thanks for the feedback! I will get started now :-)</comment></comment>