Show HN: An API to extract texts from images and PDF files - <AUTHOR> http://www.stamplin.com <comment><USER2> What's the benefit to using this over `pdftotext` and/or `pdfimages | convert | tesseract`?

<comment><USER3> The benefit is stamplin.com gets insight on what people are viewing and reading. They get to see what the user sees. They can compile a database and use or sell that information to be used for marketing purposes.

Also, it's an "API" (looks more like a url poiting to a CGI program to me, but whatever). API's are "cool" and "fun", while running local programs that you have control over is old and boring and not the future of computing.

<comment><USER4> our API is quite new and we understand it doesn't give an outstanding value for everybody as it target easy of use for the moment but next release is going to add more advanced things.

About us using your data, our privacy policy will clarify that.

</comment></comment></comment><comment><USER5> [http://www.stamplin.com/api/](http://www.stamplin.com/api/) returns 403 when clicking on the API docs after confirming an account via email link

<comment><USER4> sorry, the correct url is [http://www.stamplin.com/api/docs/](http://www.stamplin.com/api/docs/)

</comment></comment><comment><USER6> I come bearing gifts, if anyone would like to host some of this themselves.

This follows the API documented by Stampin (minus the throttling errors)--it does not currently do the OCR, but as mentioned elsewhere by zdw you can probably get tesseract to get you like 80% of the way there. If you wanted to use that, you'd likely just replace the hacky `pdftotext` callout with your preferred toolchain.

You'll need Ruby, Sinatra, and the Xpdf tools, I believe.

Dual-licensed under the AGPL, BSD, and WTFPL licenses. idklol.

The code:

      require 'sinatra'
      require 'json'

      use Rack::Logger

      post '/extracttext' do

          begin
          status 204 and return unless params["file"] != nil

          type = params["type"] || "text"
          lang = params["lang"] || "en"

          tmpfilename = params["file"][:tempfile].path
          `pdftotext #{tmpfilename}`
          File.delete(tmpfilename)

          convfile = File.open("#{tmpfilename}.txt","r")
          lines = convfile.read.split("\n")
          convfile.close
          File.delete(convfile.path)

          content_type "application/json"
          {"text"=>lines}.to_json

          rescue
              status 500 and return
          end
      end

EDIT:

For God's sake run this in a jail and only on an internal network!

</comment><comment><USER7> I like the concept and it is a good start. Pulling text from PDFs is especially painful. I think the output format needs improvement. It is just a large array of strings. It seems like the strings are sometimes a single line, and sometimes not. My particular use case is extracting raw data from a PDF. I would like to see more structure to the output. For example, knowing where new lines, tabs, etc are located would be very helpful for parsing raw data.

Here is the PDF I used to test: [https://www.gov.uk/government/uploads/system/uploads/attachm...](https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/211934/sanctionsconlist.pdf)

Is there a technical reason for the 1-2MB limit or is it arbitrary?

<comment><USER4> Thanks for your comment!

That's something we can provide pretty easily and we would try to provide that in our next release. If you want us to help you with your specific problem, please send us an email at email@example.com.

The limit has been set to prevent our server from crashing as we do not have, for the moment, the financial capability to support a massive server farm. Again, if this limit prevent you from using our API, we might move the limit up if you ask it by email.

</comment></comment><comment><USER8> The OCR is really useless. I tested it with some reddit "advice animal" memes (because there is a need for transcriptions). You would think that text is pretty simple and easy, but the output I got was like:

        /\n\nnmrs wn\ufb02qyi mm mm\nTlIIEI\ufb02|\ufb02llllM\u2018l co

<comment><USER4> Sorry that didn't work properly for you. We are working on improving our OCR results quality. Could you please send us at email@example.com the file you used to get this useless result?

</comment></comment><comment><USER9> The upgrade button doesn't work, and nobody is going to hover long enough to see the "Not Available Yet" title. And the current 10 requests isn't even enough to test with.

I'm excited to try this.. so figure out a way to take my money soon.

</comment><comment><USER10> This looks nice except for having to depend on your servers as a middle man.

Any chance you could release the code as Free or open source so that its users can use it standalone on their own machines?

<comment><USER4> That's not planned at the moment but if we wouldn't find a way to monetize it, we would do it for sure.

</comment></comment><comment><USER11> Why would someone want to use an API instead of a library?

<comment><USER4> some langages might not have an appropriate library, some might want to not have heavy processes on their device (mobiles). We also think that's easier to use as there is nothing to install. That mainly depends on your case.

<comment><USER11> I agree that there might situations where it can be useful, but:

1) Mobiles have pretty good CPUs. I think uploading and waiting for response would be slower and less reliable.

2) If the mobile user doesn't have an internet connection, the app won't work.

3) As a developer, I would be dependant on an external service, that could stop working someday.

</comment></comment></comment><comment><USER7> Can I assume API keys are on the roadmap? I don't particularly like using my username and password.

<comment><USER4> Yes, we'd like to increase security on each releases. It should be available in one of the next release.

<comment><USER7> Great!

</comment></comment></comment><comment><USER12> Nice. Are you using the Tessaract OCR lib at the core of the extraction?

<comment><USER4> yes we do

</comment></comment><comment><USER13> Any custom requests? Let us *know.

<comment><USER4> thx, I am gonna fix that

<comment><USER4> fixed

</comment></comment></comment><comment><AUTHOR> Any Feedback Welcomed

<comment><USER14> Looks good - does it do data tables? That's a big issue and something I've heard about (run into) many times...

<comment><USER4> Thanks for your comment! We would really appreciate if you could explain us in more details problems you faced. I am sending you an email if that's ok for you to discuss that.

<comment><USER14> responded to your email. good luck.</comment></comment></comment></comment>


REI to shut on Black Friday to have employees go outside - <AUTHOR> http://optoutside.rei.com/ <comment><USER3> For those who don't know, this fits really well into everything REI stands for. They are a Coop where you can join and as a shareholder a customer can make back a percentage of what they purchase. Both them, the products by vendors sold in their store and their competitors (LLBean, Patagonia) pride themselves on reuse by offering many loose warranties, these are often lifetime warranties.

As someone whose father worked retail for 30 years, and working several Black Fridays myself, I can't say I wasn't moved.

<comment><USER4> Are they really a co-op any more, or has the organization been co-opted by executives?

Members can vote for board members, but only after they have been approved by the "Nominating and Governance Committee". Executive pay is also not disclosed.

REI used to offer a lifetime guarantee on every product they sold. Sadly, this was abused by many people which I believe left no other option than to limit it. This used to make up for paying full retail for everything. Backcountry.com soon followed suite by reducing their warranty accordingly.

As a climber, I've noticed their selection in that department has dwindled quite dramatically over the years.

Maybe these things aren't practical in today's world. For me, they are slowly transitioning from an amazing store I would plug every chance I got, to just another retailer.

If you're ever in Canada, be sure to check out MEC. They still have a lifetime guarantee and their house brand is top-notch and of exceptional value.

<comment><USER5> I was told by an REI employee that a large motivator for the change in return policy was the 2008 financial crisis. She mentioned a lot of people were returning decades old equipment. I personally feel a year is more than fair, and I have absolutely no reason to demand more from them in that regard.

<comment><USER4> From my view, the lifetime guarantee meant that REI's incentives were aligned with mine: stock only the highest quality items and have an extremely knowledgable staff to access my needs and pair me with said products.

I've had a couple instances were a product failed well outside of 1 year. I could have warrantied through the manufacturer, but REI handled it for me and I had a replacement in 5 minutes. That outstanding service is no longer.

<comment><USER6> No piece of equipment will last forever, though, and that lifetime guarantee wasn't sustainable.

Sure, if I take care of my boots they last a while. Should I get my money back or have them resoled for free if the glue fails 2x or 3x after the manufacturer said it was guaranteed? Probably not. If the DWR on my rain jacket can't be refreshed, or a plastic connector on an extendable hiking stick fails after a thousand miles in the mountains?

A year feels like a big change from "forever". Maybe 2 or 3 would have made a better headline, but again you've got people that will have learned about the program (I've been a member since 2003 and never knew about the lifetime guarantee...) and will pick stuff up with the express purpose of beating it up then getting it replaced or returned. That's not good to me as a co-op member, either, because it puts pressure on the company to raise prices to cover the cost of returns and repairs.

<comment><USER7> > No piece of equipment will last forever, though, and that lifetime guarantee > wasn't sustainable.

Not in theory, but it _was_ sustainable if it was really just a mutual contract of quality transactions.

The majority of REI members wouldn't have returned a worn out pair of boots, I suspect. But then the economy crashed. :/

<comment><USER6> Yeah... unfortunately they should have / have to build their business around those sorts of situations.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> Good for them. I'm old enough so that I've been to enough Black Friday sales that I know nothing but shit is offered. I don't even leave the house on Black Friday simply because it's such a pain to go anywhere. I'd rather pay extra and avoid the lines, so good on REI for hopefully starting a trend that rolls back Black Friday a little.

<comment><USER9> As a non American.. it really confuses the heck out of me that Black Friday sales are starting on the preceding Thursday at like 6pm in some cases.

<comment><USER10> As an American, it confuses the heck out of me, too.

I sometimes think of the "retail ruining of Thanksgiving" as a pretty good argument against libertarianism. That is, if government mandated that stores can't open on Thanksgiving, pretty much EVERYONE benefits: stores don't really WANT to open early, they just want to open before their competitors. A mandated open time prevents the "race to the bottom... of Thanksgiving morning". Similarly, bargain hunters don't want to miss out on Thanksgiving either - they just want to get the best deals.

<comment><USER11> Merchants and consumers _voluntarily_ doing something on or around a holiday you personally revere is _definitely not_ an argument against libertarianism. Your "pretty much EVERYONE benefits" line is though, since libertarianism is very much concerned with individual rights over majority rule.

Keep in mind that some people not only like to stretch their dollar, but they don't have the luxury of shopping online, or when the malls are open. Not everyone works 9-5 on weekdays. Not everyone owns a computer, has broadband, or is computer savvy. And not everyone saves their "thanks" and family time for the last Thursday in November (some people actually bond during Black Friday shopping!). Majority opinion, thank God, is not how we run this country.

<comment><USER12> Keep in mind that stores employ people, and those employees don't often get a say in whether they work black friday or not (not if they want to stay very long at that store).

Ultimately, that's why I kind of finally got on board with the fact that most stores (and even restaurants) are closed on Sundays in France - <USER2> since the rule on whether a store can be open on Sunday is that the _owner of the store_ needs to be present during all business hours.

<comment><USER13> How are they defining ownership? If someone takes out a mortgage on their store do they have to get the bank manager down there whenever they're open? Can a big firm nominate some putz to be the owner of record?

<comment><USER12> No on either, from my knowledge. Local towns also have stricter ownership laws and less franchises.

<comment><USER13> The point is that the two are economically equivalent.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER14> My first thought was to figure out the strategy to improve earnings here. It wasn't until a few minutes later that it hit me, there _isn 't_ one (gasp).

And then it occurred to me that, isn't it weird that we live in a world where this is almost unthinkable? Running a business like it's just something you want to do? Just...weird.

<comment><USER14> @existentialcoms has a pretty relevant tweet to this perspective six hours ago:

I don't know what the meaning of life is, but if it isn't "working hard so the shareholders can make more money", then we are in trouble.

<comment><USER15> Well, the "shareholders" here include employees and customers. From that perspective, some of the shareholders _are_ gaining something from getting a paid day off (arguably even the customers are gaining from having happy retails workers to help them in-store).

</comment></comment></comment><comment><USER16> At some point the Black Friday arms race becomes so insane the only move left is to quit. REI is too cool for this bullshit anyway.

<comment> rkuykendall-com Not the ONLY move...

[http://static1.businessinsider.com/image/52a1db6969bedd87275...](http://static1.businessinsider.com/image/52a1db6969bedd87275aaf04-500-322/cardsale.jpg)

</comment></comment><comment><USER17> Dear REI,

When I need something "outdoor-sy", I come to your store. The staff can always answer my questions, they do it wirh respect and passion. You are a little more expensive than ordering online, but I pay the extra money for the detailed service I always receive.

I applaud closing on Black Friday and having the employees go outside. I mean, you sell outdoor gear, this lets your employees get a no stress day to enjoy what they sell. This gesture and demonstration of your core beliefs will continue my dedication to shop at your locations.

Thank You,

A Customer.

</comment><comment><USER18> "The owner, the employees, and the buying public are all one and the same, and unless an industry can so manage itself as to keep wages high and prices low it destroys itself, for otherwise it limits the number of its customers. One's own employees ought to be one's own best customers."

\-- Henry Ford

<comment><USER15> This can't apply generally though. For example, how many workers that manufacturer yachts are going to be able to afford them? What about cruise liners or oil tankers? What about (e.g.) dental supplies? Should all employees in the manufacture and distribution of those supplies be licensed dentists?

<comment><USER19> While I applaud the principle of the quote, the overall philosophy always remind me of Office Space:

Peter Gibbons: Our high school guidance counselor used to ask us what you'd do if you had a million dollars and you didn't have to work. And invariably what you'd say was supposed to be your career. So, if you wanted to fix old cars then you're supposed to be an auto mechanic.

Samir: So what did you say?

Peter Gibbons: I never had an answer. I guess that's why I'm working at Initech.

Michael Bolton: No, you're working at Initech because that question is bullshit to begin with. If everyone listened to her, there'd be no janitors, because no one would clean shit up if they had a million dollars.

</comment></comment></comment><comment><USER20> Maybe Black Friday is developing the GroupOn problem.

It's a great way to lose money on the worst customers that will never come back anyway.

<comment><USER21> They don't lose money on Black Friday. In fact, they make a tremendous amount of money. That's why it's "black" \-- going from red (negative earnings) to black. This is because they sell the products at a low price, but they're still profiting.

Also, retailers _gain_ loyalty from low prices, rather than lose it.

<comment><USER22> The only reason they make money, is simply they are adding more days to the "retail calendar." Those loss leaders are still getting traffic through the door when there use to be none. Something is greater than zero.

<comment><USER23> The problem is that the loss leaders go on sale at some ridiculous hour (I'm not waking up to go shopping at 5am when there's a big crowd). Unless you're willing to get up very early for cheap stuff, the shelves will be picked clean.

<comment><USER21> Not true. Many retailers have their Black Friday deals online as well. The only difficult thing about getting the loss leaders is timing the purchase before the supply runs out.

</comment></comment></comment></comment></comment><comment><USER24> When I was in retail I loved working Black Friday - the day went by fast, and you could usually snag overtime.

<comment><USER25> Me too. I feel like it's a rite of passage as an American teenager. I guess the people who have families of their own are the most affected, but Black Friday was at least exciting compared to every other day of the year.

</comment></comment><comment><USER26> Dear AppleStore, I dare you.

<comment><USER27> Apple doesn't even pretend that they care about anything other than money.

<comment><USER28> And REI has some history of caring for the employees and customers more than profits. Apple doesn't have this history, and would get ridiculed for having ulterior motives.

</comment></comment></comment><comment><USER29> In case anyone at REI corporate is reading;

I applaud this move and will likely be getting a membership as a result.

</comment><comment><USER30> What an excellent way to get and retain quality employees. Too bad REI can't suck all the good workers out of Walmart.

<comment><USER31> I'm sure both of them would come over with a decent offer :)

</comment></comment><comment><USER32> It would be funny if REI employees ended up going outside to camp at electronic and department stores as a result...

It'd be nice to see their employees sharing stories as a result.

p.s check out [http://www.hipcamp.com](http://www.hipcamp.com)

<comment><USER33> _" if REI employees ended up going outside to camp at"_

They're certainly well equipped for said camping.

</comment></comment><comment><USER34> Enjoy the outdoors.. in late November?

<comment><USER35> The old adage, "there's no such thing as bad weather, only bad clothes" is especially relevant to REI staff and customers.

Some activities work better than others of course.

</comment></comment><comment><USER36> Seems like a genuinely cool move and good business at the same time. Good for them.

</comment><comment><USER37> Won't they all just go shopping?

<comment><USER37> Wow... tough crowd.

</comment></comment><comment><USER38> They're a co-op and can't afford to discount on Black Friday. Seems fairly straightforward.

<comment><USER39> REI has sales, clearances, warehouse sales, seasonal sales, discounts, "garage sales" (used/returned/rental gear), etc. all the time.

</comment></comment><comment><USER40> REI changed their return policy from effectively "forever" to one year. Sounds like perhaps that move gives them the freedom to pay all their employees for a day during their slow season.

<comment><USER41> One year still seems like an overwhelmingly liberal return policy. They're just trying to find the balance between being fair to customers, and being taken advantage of as a rental agency.

<comment><USER42> Heh. I was shocked at how bad consumers have it in NA - [https://www.accc.gov.au/consumers/consumer-rights- guarantees...](https://www.accc.gov.au/consumers/consumer-rights- guarantees/repair-replace-refund)

<comment><USER43> Umm... that's different. REI is known to allow you to _return a product for a refund even when nothing is wrong with it._

Your links infers to a law that gets you a refund _if something is wrong with the product._

<comment><USER42> Right - but REI is unusual, right? I believe Costco has the same policy.

</comment></comment></comment></comment></comment><comment><USER44> Will their website not be taking orders as well? I love REI, but this is a pretty transparent marketing ploy.

Also relevant:

[https://en.wikipedia.org/wiki/Buy_Nothing_Day](https://en.wikipedia.org/wiki/Buy_Nothing_Day)

<comment><USER45> I have witnessed the folks on this site being nitty, but this is just a whole new level. Because a company gave all of their employees the day off, they have to either take their website down or be called hypocrites by some HN user...? How on earth is this a remotely sensible position to take?

<comment><USER46> Not terribly germane to this this OP but there _are_ people who "close" their online stores at times.

One example is B&H Photo - [http://www.bhphotovideo.com/](http://www.bhphotovideo.com/) On the footer of their pages it says: "Please note that B&H does not process web orders from Friday evening to Saturday evening." I would assume that in the sect of Judaism the owners belong to letting your site take orders constitutes work.

Another example is my Girlfriend - she closes her Etsy shop when she goes on vacation because she'd rather not take orders and have customers wait for her to return for them to be fulfilled.

<comment><USER47> "assume" oh goodness you have no idea.

I live in the Brooklyn Hasidic neighborhood. A couple weeks ago, one of the gentlemen flagged me down on a Friday night. He needed me, a complete stranger, to come into his home at 11pm, go down to the basement, and push the "open" button on his dryer so his wife could retrieve clean towels for their (many) children.

Operating a machine of any kind, to the extent of pushing a button, constitutes work in their culture. There's a whole wikipedia page about the ongoing controversy over whether it's okay to use light switches during Shabbat or not. [https://en.wikipedia.org/wiki/Electricity_on_Shabbat](https://en.wikipedia.org/wiki/Electricity_on_Shabbat)

(they thanked me with a slice of cake, which was nice)

<comment><USER46> Great anecdote! He just needs some sort of Rube Goldberg device to do it for him.

There's the whole Shabbat Technology industry - finding Kosher ways of using modern conveniences in accordance with the Sabbath laws.[1] For example, these folks make a bunch of devices: [http://www.zomet.org.il/eng/](http://www.zomet.org.il/eng/)

[1] I'm reminded of the non-electric tools the Amish adapt and use. [http://www.npr.org/sections/money/2013/02/22/172626089/insid...](http://www.npr.org/sections/money/2013/02/22/172626089/inside- an-amish-trade-show)</comment></comment></comment></comment></comment>


'Silicon Valley Is Coming' Warns JP Morgan CEO - <AUTHOR> http://americasmarkets.usatoday.com/2015/04/09/jp-morgan-warns-silicon-valley-is-coming/ <comment><USER2> For sure, defeating banks in the matter of customer interaction seems like low-hanging fruit. As the article says, they are too slow, too cumbersome, and I'll add that they are too unfun, and their sales departments are pushy and intrusive.

Do we even need monolithic financial entities in this day and age? Most transactions would be better handled by smaller, specialized and modern service companies. Banks are to financial startups what taxi driver unions are to Uber.

And the financial sector definitely deserves a shakedown, after they essentially plunged the rest of the world into a decade of misery with their securities fraud during the housing crisis, and went unpunished for it.

<comment><USER3> >Do we even need monolithic financial entities in this day and age? Most transactions would be better handled by smaller, specialized and modern service companies. Banks are to financial startups what taxi driver unions are to Uber.

You forgot one of the most critical functions of banks like this-- large scale institutional lending.

A business needs to borrow $2 billion dollars -- are you going to crowd fund that?

A state government wants to borrow $800 million in bonds for a new arena, can you GoFund that?

A major government wants to store $30 billion of their own currency in a financial product that will decrease in value against the dollar more slowly than their currency. Is there an app that helps governments store 30 billion in assets (or are we naive enough to suggest that bitcoin is a smart investment?)

A major pension plan serving 100,000 retirees needs their 100 billion dollars in assets to be managed responsibly, can a 24 year old Stanford grad manage that?

I think calling Banks the "taxi union against Uber" is painfully naive in the sense that it only looks at small transactions and consumer transaction while ignoring the very large institutional business-to-business and business-to- governments side of banking.

Maybe small business will get their lending needs with new technology but I just don't see a Fortune 50 company taking a multi-billion dollar loan through crowdsourcing.

<comment><USER4> > A major pension plan serving 100,000 retirees needs their 100 billion > dollars in assets to be managed responsibly, can a 24 year old Stanford grad > manage that?

Judging by the NYC pension fund, I could manage 100 billion better.

[http://mobile.nytimes.com/2015/04/09/nyregion/wall-street- fe...](http://mobile.nytimes.com/2015/04/09/nyregion/wall-street-fees-wipe- out-2-5-billion-in-new-york-city-pension-gains.html?referrer=&_r=0)

<comment><USER5> Wow, no kidding! For the huge discount over their current guys at a mere $1,000,000 a year, I'd happily put the pensions into some Vanguard index funds... :D

</comment></comment></comment></comment><comment><USER6> I worked for JP Morgan Chase a couple of years ago, as part of the main technology division for the entire bank. If I remember correctly, this 'IT department' had the same headcount as Apple. It was an interesting place. There was a lot of technologies being used through the organisation, lots of python and Java code, perl with Mojolicious, puppet and cfengine, desktops were Linux based terminals connected to virtualised Windows desktops, Hadoop and Cassandra was being rolled out, interesting things with FPGAs were being done e.g. [http://web.stanford.edu/class/ee380/Abstracts/110511-slides....](http://web.stanford.edu/class/ee380/Abstracts/110511-slides.pdf) I worked with many skilled and experienced people, and nice people too. I have worked for many multinationals before, and this bank was certainly the most nimble of them all while being the biggest and most stable at the same time.

<comment><USER7> Why did you leave?

<comment><USER6> I got persuaded to join a start up full time, one I co founded years before joining the bank. In retrospect I should have remained at the bank.

<comment><USER7> Cool I am starting at GS this summer so I was curious if you decided to move on from banking or of it was more you deciding to try something new.

</comment></comment></comment></comment><comment><USER8> "Building financial technology is hard. Really hard. Startups are always hard, but fin tech is a whole different level of self-inflicted pain. You'll be regulated. You'll deal with big banks. They'll see you as little and cute until you're meaningful. Once that happens, they'll want to crush you out of existence."

\- Max Levchin [http://fortune.com/2015/03/27/max-levchin-hates-credit- cards...](http://fortune.com/2015/03/27/max-levchin-hates-credit-cards/)

<comment><USER9> This has been my experience in most industries. Once you gain traction the main players will do everything they can to stop you. Frivolous lawsuits are probably the most annoying tactic.

</comment></comment><comment><USER10> Most people take SV/WS as a geographical identity, starting a war between the two. However, rather than war, we've been seeing a confluence. WS is nothing but a group of workers, morality, tradition and culture.

Right now, WS is not being destroyed: it's merely being mixed into the SV. Either by bringing its top executives or fostering a 'brogrammer' culture, the similarity between the two are becoming clearer and clearer.

<comment><USER11> It's been going on like that for years. Think of all the wall st folks who made their careers on tech stocks of the past, like Rick Sherlund at Goldman with Microsoft, and Mary Meeker. The funny thing about the overwhelming attitude regarding the financial industry on HN is that the venture capital business is just another area of the financial industry and it has all of the same (mis)behaviors: managers benefiting from information asymmetry, high fees for questionable returns / risks, etc.

</comment></comment><comment><USER12> I wonder sometimes what is left for banks to do that couldn't be fully automated (at least on the consumer side). Creating accounts, making deposits, withdrawals, transfers, paying bills can all be done online or through apps. Getting a loan or credit card seems to largely be a matter of 1) obtain credit score 2) calculate terms. Investments can be done through the likes of Vanguard/Wealthfront/Betterment. I feel like I must be missing something here, or maybe people really like talking with someone they know at the bank when getting a loan or mortgage.

<comment><USER13> Agreed. At least from a consumer standpoint. I use an online only bank account after switching. And there's plenty out there. Better service, fewer fees, and without a physical "bank" location in the traditional sense it can keep costs lower. Haven't looked back. I don't need a physical bank to accomplish 99.9% of my banking needs. With offerings like Ally, Simple, etc I think the traditional and big banks will only be necessary for non consumer facing stuff: large investments, mass ACH, trading (including high frequency stuff), etc

<comment><USER14> I was nervous before switching to Simple, but then I thought about how the only time I went to my physical bank in the last 3 years was to exchange currency, and in that time they charged me $300 in fees for one reason or another. It's been almost a year with zero fees and zero regrets.

<comment><USER15> I've been using Simple since January of last year, and I am incredibly thrilled with them overall. I could ramble for days about their outstanding customer service, how their "Goals" system has significantly improved my own ability to save money, yadda yadda. Chase was the bank I had to suffer with prior to switching to Simple, so I have to admit that it makes me ridiculously happy to see Dimon legitimately concerned about companies that actually give a fuck about people.

</comment></comment></comment></comment><comment><USER16> It's not just that startups are identifying cool new technologies like cybercurrencies, and it's not just that they're using new models to offer loans faster. Startups have started to take on markets which banks pretty clearly knew about, but refused to touch - you can refinance a federal student loan with SoFi or commonbond now, which was unheard of five years ago.

The problem is that the little guys' competitive advantage seems to lie only in their willingness to enter the space. Once the market is proven, Wells Fargo and JP Morgan won't really have a difficult time stepping in with boringly normal technology and using their giant pile of money to dominate the market.

What can finance startups do to avoid being squeezed out by the older, established banks?

<comment><AUTHOR> The pile of money will be used to buy dominant players of the new technologies, but they may had problems with margins like record labels.

</comment></comment><comment><USER17> The problem with starting a new institution these days is that the regulatory & audit issues mean that you'll be a small bank, with the overhead of a large bank.

There's also the package integrations to deal with. Banks tend to buy packages for their core functions, and then (try) and integrate them. There's an opportunity here for someone who can offer a "Bank In A Box" \-- all the software needed to start a bank/credit union that is well-integrated and complete -- from GL/AP to lending, depositor management, ACH + Fedwire connections, and disaster recovery.

<comment><USER18> I've been thinking of developing a "Betterment in a box."

</comment></comment><comment><USER19> >> "Rest assured, we analyze all of our competitors in excruciating detail – so we can learn what they are doing and develop our own strategies accordingly," he said.

Perhaps worrying more about analyzing their customers needs and less about their competitors would be better.

I also found it amusing he considers PayPal a "new payment technology"...

</comment><comment><USER20> Wall Street, Silicon Valley - what's the difference?

<comment><USER21> The dress code. That is all. Vampire squids on both coasts.

<comment><USER22> Hey, hey. No need to judge vampire squids just because they look funny.

</comment></comment></comment><comment><USER23> One reason I don't think JP Morgan or traditional banks can compete effectively with smaller startups is the regulatory framework that they operate in. New startups can structure themselves outside this framework and be more nimble.

For instance, Lending Club essentially passes through all credit risk to its investors with its assets and liabilities perfectly matched. So every dollar loss in loans is a dollar less to the holders of the notes.

If a bank tried to have this sort of structure, it would be incredibly leveraged and would require a large amount of capital reserves.

There was a great Bloomberg article addressing just this [0]

[0] [http://www.bloombergview.com/articles/2014-08-27/lending- clu...](http://www.bloombergview.com/articles/2014-08-27/lending-club-can-be- a-better-bank-than-the-banks)

</comment><comment><USER24> His only mention of Bitcoin:

 _Competitors are coming in the payments area._

 _You all have read about Bitcoin, merchants building their own networks, PayPal and PayPal look-alikes. Payments are a critical business for us – and we are quite good at it. But there is much for us to learn in terms of real- time systems, better encryption tech- niques, and reduction of costs and "pain points" for customers._

</comment><comment><USER25> Everyone in the tech world, specifically the investors, has known this for a while. Marc Andreesen could have told this to Jamie Dimon ten years ago. "Software is eating the world" holds just as true today as it did when he first said it.

The problem is that "software is eating the world" only in the long term. It's easy to get behind the mantra when you're imagining software in an idealistic, abstract sense. After all, just look around you. Software is disrupting industries left and right. It's cheap, reproducible, and highly leveraged with low marginal cost. Software is more economically efficient than the incumbent operations of every industry it disrupts.

The financial industry is unlike any other industry software is "disrupting." The operations are irrevocably complex because they are inherently driven by human operators. Each year, more tech creeps in between the operators and the operations, and software gradually "eats" the industry. But bankers are not losing their jobs. Why would they? Software is more efficient, it makes them more money. It gives them more time to focus on improving other efficiencies. Bankers see software as a resource they can leverage just like anything else. The more it eats their industry, the more they feed it. As long as it continues making the bankers money, they will keep their own jobs. As long as they keep their jobs, they will keep leveraging their resources, which inevitably increases the complexity of the financial system.

The longer humans are in charge of the financial system, the more complicated it becomes. I see very little chance of humans relinquishing complete control of the system to algorithms. There is always a human, or group of humans, at the top -- that is the nature of politics and civilization. Perhaps the human has less input as technology improves, but politics still requires that human to occupy the seat at the top of the economy. Somebody needs to be responsible for the system. We cannot relinquish all control to the robots.

<comment><USER26> Bankers are not one homogenous group. Tellers are different from quants.

</comment></comment><comment><USER27> Relevant to discuss the viability of different fintech startup ideas:

[https://news.ycombinator.com/item?id=9321019](https://news.ycombinator.com/item?id=9321019)

[https://medium.com/bull-market/a-cynic-s-guide-to- fintech-3c...](https://medium.com/bull-market/a-cynic-s-guide-to- fintech-3cd0995e0da3)

I agree that there is some naivety when attacking huge institutions as mentioned in the article. Particularly when it comes to dodging regulation. Rather than putting you on top dodging regulation is probably going to put you out of business when it comes to Financial Institutions.

[P.S. will the Gods of HN please upvote my comment so I can have the slightest visibility here]

</comment><comment><USER28> So Facebook basically gave everyone a personalized website and social graph.

Twitter, everyone got their own chatroom.

Instagram, a photo-album.

Perhaps the next killer finapp is to allow everyone to become their own bank?

</comment><comment><USER29> Banks have one advantage in this area. The have government regulations and many other laws making it hard to organize competition, such as anti-money- laundering and know-your-customer laws.

Look at what happened to E-Gold. It was a threat to traditional banking, laws were changed, and the business was declared illegal (and many of the operators went to prison for violating laws that were passed after they started operating).

</comment><comment><USER30> On this subject, from the finserve side: [https://medium.com/bull- market/a-cynic-s-guide-to-fintech-3c...](https://medium.com/bull- market/a-cynic-s-guide-to-fintech-3cd0995e0da3)

The author applies heavy skepticism, but does rate some of the fintech business models as worthwhile.

</comment><comment><USER31> I find it curious that pain points is given the inner quotes treatment whenever the JP Morgan CEO uses that term. It's almost like such a concept didn't exist before startups started addressing it.

</comment><comment><USER32> I think what is especially interesting about this comment is that Wall St, which is on the East Coast, uses the internet in very different ways than Silicon Valley does, which on the West Coast. Both have ground to make up in this sense; Silicon Valley could be much more in tune with their East Coast counter parts...

<comment><USER33> >the East Coast, uses the internet in very different ways than Silicon Valley does, which on the West Coast

In what ways?

</comment></comment><comment><USER34> Maybe this will result in banks upgrading their systems from COBOL/FORTRAN to something slightly more modern, like... Java/C++.

Or are they just going to skip a generation, and move directly to io.js/Node.js?

<comment><USER8> that made me chuckle

<comment><USER35> Indeed. #ShitHNSays worthy.

<comment><USER36> What makes you say that?

<comment><USER37> HN likes to promote upgrading technology stacks to the new hotness (which at one time was Java, and is now Javascript/Node.js) for no other reason than the old standard being old. This is often under the guise of "Disruption" when the good trolls are doing it.</comment></comment></comment></comment></comment>


Binary Stream Parsing in Node.js - <AUTHOR> http://substack.net/posts/cb328d/Binary-Stream-Parsing-in-Node-js

<comment><USER2> Handling binary data in Javascript will soon get a lot better with the new Typed Arrays spec: [http://people.mozilla.com/~vladimir/jsvec/TypedArray- spec.ht...](http://people.mozilla.com/~vladimir/jsvec/TypedArray-spec.html)

It was invented for WebGL but is already being used by the guys doing raw audio APIs and will hopefully see wide adoption wherever binary data is found (2D Canvas, sockets, XMLHttpRequest, Web Workers, storage, local file access).

</comment><comment><USER3> Good stuff! I was thinking about implementing a SPDY server in Node the other week, but I couldn't figure out a good way to do the binary framing part.

This looks highly useful.

</comment><comment><USER4> Very interesting approach.

Is this already taking care of releasing buffers after they've been tap'ed into?

<comment><USER5> When advance() in BufferList gets called, the linked list of buffers behind the scene advances so that all the unused buffers can get garbage collected. Binary has a flush() method too that calls advance().

<comment><USER4> Nice, I'll definitely take this lib on my next binary adventure : )</comment></comment></comment>


Bank Sends Email to Wrong Gmail User, Sues Google For His Identity - <AUTHOR> http://mashable.com/2009/09/24/bank-sues-google-identity/

<comment><USER2> This begs the question, what was the bank doing emailing bulk sensitive data in an insecure fashion?

It seems like the bank needs better security policies and thinks that it is acceptable to go after innocent people rather than admit that they don't take data security seriously. I understand getting caught in a situation like this. It happens and while it might be a sign of bad policies, it might also just be unlucky. What matters is how one handles these situations - and the bank isn't handling it well. You have a data breech. Do you notify account holders affected, help them change their account numbers, take responsibility, and put in place policies that will prevent it from happening again? Or do you yell at Google and go after some innocent Gmail user trying to hide yourself from responsibility?

Heck, they even wanted their lawsuit to be confidential: [http://www.informationweek.com/news/internet/google/showArti...](http://www.informationweek.com/news/internet/google/showArticle.jhtml?articleID=220100410)

At least the judge decided that their embarrassment wasn't cause to keep the lawsuit private.

<comment><USER3> <http://en.wikipedia.org/wiki/Begging_the_question>

<comment><USER4> People use "this begs the question" to mean "this begs [you to ask] the question", and while it's not historically correct accurate, it's modern usage.

People 100 years ago would have thought that Americans using "mad" to mean "angry" instead of "crazy" was equally reckless.

<comment><USER5> This is not only historically inaccurate but it is currently inaccurate. The fact that a lot of not very smart people use it does not mean we should add it to the language.

I am usually not a stickler for these things, but this is very important because the actually correct phrase "begging the question" has a very specific meaning which is very difficult to convey in other words. Thus, if we allow a bunch of idiots to hijack this phrase in their hopeless quest to sound intelligent, we will lose a very useful phrase for which there is no present substitute.

<comment><USER6> Actually the meaning is not that specific. To someone who hasn't had the "official" meaning explained to them, the new one is much more natural.

If you're relying on this phrase to convey that idea then you're communicating badly, because many readers will misunderstand.

</comment></comment></comment></comment></comment><comment><USER7> I actually have a similar story. As it turns out, I share a first initial and last name with an incumbent congressman's campaign manager.

During their last campaign, I received quite a bit of wholly unsolicited email bound for the manager. Despite a couple "I'm not the guy you're looking for" emails, (i even sent one directly to his 'official' address on the campaign website) I continued to receive the emails.

Most were fairly benign. Some were harmless, but definitely from the sausage- making side of politics. Quite a few were... very personal. I can easily imagine they'd leverage this precedent if they realized what I was getting.

So this whole topic hits pretty close to home when I wonder about what extents these rulings might go to.

Would they turn over my account itself? Would they scour my outgoing messages to see if I forwarded it? Would they pop open every archive I emailed to see if that might contain the information? Would I be compelled to turn over passwords and keys for secured archives? (violating my client's privacy as well) Would they supply a list of IP addresses where I viewed the messages (and might have made copies)? Would they demand access to those machines?

Exactly how much of mine (and thereby my associates) privacy would these courts be willing to violate due no fault of my own?

<comment><USER8> In this case they're suing google to acquire the users identity, and google has said they're willing to give the user the chance to oppose the order.

As far as I know ownership of email hasn't been contested in court, but the email was addressed to the accidental recipient, which even under mail tampering laws wouldn't mean he had done anything wrong. The laws for mail are to prevent me mail-box diving my neighbour or opening accidentally delivered mail, however if the mail was mis-addressed to me then it's legally mine through and through.

This email was mis-addressed, which wasn't the fault of the recipient. I highly doubt the Judge will rule in the companies favour and risk setting a precedent against federal mail laws for email, it would seem kind of absurd.

<comment><USER7> If you're familiar with these laws: if I misaddress something to a PO Box, will the government reveal the identity of the accidental recipient? Will they if I ask nice, or must a court compel them? Is there any sort of requirements that need to be met?

I realize that in this case they haven't asked for anything beyond identity _yet_. But I'm forced to wonder what happens after they've ascertained identity?

There's no need to _compel_ Google to reveal that person's identity unless there's a follow-up action that they feel they can't execute unless they know the identity of the unintended recipient.

So what is the follow-up action of stripping away this innocent person's privacy? I'm forced to conclude it would be yet-another injustice.

<comment><USER9> I'm assuming that they want to 'have him by the balls' to use as a scapegoat if any of that information is ever used for identity theft. The problem with this is that I feel if they have such a convenient scapegoat, they will probably rush to crucify him before investigating whether or not the information could have been obtained through other avenues.

</comment></comment></comment></comment><comment><USER10> Imagine that you are the owner of jgc.org and that there's a popular web site called igc.org. Now imagine that amount of email you receive daily misdirected to jgc.org.

A lot of this mail is mailing lists that didn't do double opt-in and hence *@jgc.org got added to the list. But quite a lot is just personal mail.

For a while I used to receive the itineraries for the private jet of a famous entrepreneur because they were meant to be CC:ed to someone at igc.org but came to me instead.

<comment><USER11> I imaging if you owned noreply.com you'd get a hefty amount of private correspondence in as well. I bet there are plenty of services out there that use firstname.lastname@example.com thinking it's the email equivalent of /dev/null for some magical reason.

<comment><USER12> I wrote an article a while back on this topic and whether the owners of test.com, check the email account email@example.com.

Didn't get a good answer but I would imagine they _could_ see a lot of very personal information come their way as many geeks I've known use that to test their software.

<comment><USER13> Best practice as I understand it is to use emails that have the TLD "invalid", or one of a couple of others that have been explicitly set aside as "never will be issued" by RFCs. They also have the advantage of looking very out-of- place, where @test.com may slip by.

<comment><USER14> Full list, and what they should be used for, here: [http://en.wikipedia.org/wiki/Top- level_domain#Reserved_domai...](http://en.wikipedia.org/wiki/Top- level_domain#Reserved_domains)

For testing, I usually use firstname.lastname@example.com. I've so far managed to avoid no-reply. If someone tries to reply to one of our message emails, I want to know what problem they're having, and the context to go with it from what message we sent them. "noreply" emails are anti-user-friendly.

</comment></comment></comment></comment></comment><comment><USER15> Wouldn't it make more sense to link to the source?

[http://www.theregister.co.uk/2009/09/23/google_sued_for_gmai...](http://www.theregister.co.uk/2009/09/23/google_sued_for_gmail_user_identity/)

<comment><USER16> Not if you're driving hits to your own blog posting.

<comment><USER17> Doesn't look like the poster works for Mashable. On the other hand, Mash is where he saw the information, so why not post the link there? It's not a bad thing to link to the site that you personally rely on for news.

</comment></comment></comment><comment><USER18> Maybe they should be sending secure links to sensitive files rather than the files themselves. At least they could regenerate the links rather than just hope that the files get to the correct place.

<comment><USER19> Not 100% sure on this, but emailing sensitive customer info doesn't sound PCI compliant. Maybe customers should look into suing this bank.

<comment><USER15> PCI compliance has nothing to do with how you handle your loan information.

</comment></comment></comment><comment><USER20> This makes sense. The bank is doing what it should be doing, by bringing the matter through proper legal channels. If Google just handed over the information, they would be liable to the account holder. I personally hope that the legal system finds the bank was negligent and denies access to the guy's personal information.

Also, what are the 1,300 bank customers doing about this? I'm sure that a class-action suit will be filed against the bank.

<comment><USER9> Apparently the bank didn't want them to know about it. Pursuing the gmail- account owner is their way of dealing with the issue.

<comment><USER20> The bank has a duty to inform their customers that their identity may have been compromised.

<comment><USER9> I agree, but apparently that bank doesn't.

</comment></comment></comment></comment><comment><USER21> I had this fun idea of registering an email address with an username being a common noun. Although I found it strange that the address was still available, but I didn't care too much about it, I was happy to have the account. (You know, new inbox smell).

And then emails started to arrive to the address. Of course, lots of them were spam-spam-spam-spam. But there were also some personal letters. For a while I thought it was some mistake, and replied nicely to them pointing it out, and tried to inquire about what could be the reason behind the confusion, but never really figured out.

The mails kept coming, and I realized that they weren't even addressed to the same person. Up to now I have at least 30 alteregos, giving out my email address to their friends, relatives, and using it in an attempt to register on web sites. Most of them seem to be female, so I get many mails trying to hit on "me" after that talk on im or seeing my profile on some website, etc. Also pictures of nieces, invitations to bbqs, and questions about my iron and if I can bring it to "the club" next Tuesday.

I just hope I won't get sued one day.

</comment><comment><USER22> So in order to find out who's behind a (Gmail) email address, all I have to do is send an email and then claim that I didn't want to send it to that person.

</comment><comment><USER23> This may actually be a good thing in the long run. Assuming Google wins the case, this would set a good legal precedent around unsolicited email.

</comment><comment><USER24> My gmail account happens to be my first initial and last name. I get more mail addressed to other P. Welch's than I get addressed to me, but probably because I don't really use the account (I foolishly got it back when gmail accounts were considered a status symbol and used it for online file storage).

</comment><comment><USER25> There has to be some sort of precedent for this with physical mail.

On the other hand, I don't think that the bank is being unreasonable when you consider that Google said, "Sorry, no, you'll have to file a suit about this and proceed through legal channels."

<comment><USER26> The bank is being unreasonable by pursuing this at all.

Whatever the outcome, they should contact the people with the accounts involved and start changing details, and should update their data handling practises.

Even in the best case that Google logs prove the user did not open the email, it's still been through who knows what unsecured SMTP servers and is who knows where in Google's replication and backup systems and available to an unknown number of system and mail administrators.

What do they hope to gain?

</comment></comment><comment><USER27> If anything, I think the identities of the bank employees should be revealed just so this nightmare gets put on their permanent records (the internet).</comment>


Collections agency for small amounts? - <AUTHOR>

I occasionally have clients who disappear owing small amounts (usually less than $100).  To this point I've just let it go, but lately there have been some particularly egregious cases that I'd like to turn over to collections.  Does anyone have experience with this? <comment><USER2> Less than $100 is too small for a collections agency to bother with, unless you've got a big pile of such clients.

I'd suggest charging dodgy clients in advance, or better yet, not doing business with them in the first place. Over the years, you'll get better at detecting the "vibe" of the non-paying client.

</comment><comment><USER3> [http://online.wsj.com/article/SB1000142405270230451070457556...](http://online.wsj.com/article/SB10001424052702304510704575562212919179410.html)

I don't have any personal experience that I can offer, but I recalled reading this article a few months ago and it might be of help.</comment>


New Payment Solution for Australian Merchants - <AUTHOR> https://www.fatzebra.com.au

<comment><USER2> looks interesting - its about time there were some new options for aussie merchants</comment>


Building a backdoor with Node.js - <AUTHOR> https://snyk.io/blog/what-is-a-backdoor/ <comment><USER2> Excerpts:

"So the only requirement for the victim is to install the library browser- redirect and add it to Express app, like a regular middleware:"

[...]

"I [Article Author] just published the malicious package to npm using npm install email@example.com. _However, in Github you can't see the malicious code_ — see Master Branch and release 1.0.2. The reason for this is because npm does not check against Github or any other source control repository."

Security Perspective Takeaways:

1) Downloading and building source code, where authentication is performed between the downloaded source and the exact GitHub branch (rather than downloading a pre-built package or even source code where this branch authentication is not performed) would at least guarantee that the source code could be matched to the source on github, and could be subsequently audited...

2) The broader class of this attack (which includes such things as Windows Update, software auto-updaters, installers and package managers - both Windows and Linux) is basically: download malicious code - inside of a (user) believed non-malicious binary or library...

3) There are some very strong arguments here towards:

       a) Always use open source for whatever you can;

       b) Always download and compile the source for whatever you can;

       c) Always audit source that you've downloaded...

I know; easier said than done...

<comment><USER3> Currently, I'm building a very simple webpage using Gatsby.js for a project I'm on.

It only has around 10 direct dependencies, but if I look in the node_modules folder...760 distinct modules required in the dependency graph.

Should I be doing security audits on every single one of the 760 modules?

<comment><USER4> >Should I be doing security audits on every single one of the 760 modules?

Yes, ideally.

I know this isn't practical. The fact that you have so many dependencies and any one of them could do something bad should be a sign that something is deeply wrong in the ecosystem.

<comment><USER3> The JavaScript ecosystem is famous for bloat like this. Python is much better, though there is still an O(n^m) dependency tree. Languages like C/++ and FORTRAN commonly have effectively O(n) dependency trees.

I suspect it's related to the ease of use to add new libraries/modules.

</comment></comment></comment></comment><comment><USER5> The problem with Snyk and other automated vulnerability detection tools is the rate of false positives. For my open source library, the false positive rate so far (over many years) has been 100%. Not one of the many reports pointed to a single exploitable vulnerability in my library.

The reason is that a lot of vulnerabilities are context-specific. For example, a common one in JavaScript is Object prototype pollution; this is not an issue at all if the affected function is only used with trusted input.

Just because a function is vulnerable under a certain specific condition, it doesn't mean that it's generally vulnerable.

That's like saying that chainsaws have a critical security vulnerability on the basis that if you put your foot in front of it, you will be badly harmed... and then you use this as justification to warn millions of tree removal experts (and their customers too) all around the world that their businesses are critically vulnerable and fundamentally unsound because they happen to use chainsaws.

The other common problem is when it flags a vulnerability with a specific function within a library, but that function is not actually used by the project. It's not fair to label all downstream projects as vulnerable on the mostly false assumption that the project actually uses the vulnerable part of the code.

I think Snyk does this because it gets them attention and that's how they turn a profit, but they have to get wiser because this strategy is compromising the quality of their service.

</comment><comment><USER6> Really astounding to see them publish this article today. I have a CVE that's about to go live regarding auditing tools like this one.

I contacted Snyk a week ago to point out that their audit tool (just like npm audit, and others) cannot fundamentally protect you from attacks like this when installed to the same environment as a malicious package. Almost feels like they are trying to get ahead of it.

I was withholding the CVE while other tools are wrapping up their mitigation strategy. NPMJS and Snyk folks basically shrugged their shoulders. This is kind of forcing my hand to publish now.

Well, here is the blog post explaining:

[https://mulch.dev/blog/CVE-2020-5252-python-safety- vuln/](https://mulch.dev/blog/CVE-2020-5252-python-safety-vuln/)

And here is the snyk proof of concept:

[https://github.com/akoumjian/npm-audit- vuln](https://github.com/akoumjian/npm-audit-vuln)

TLDR; Don't ever use the `npm install` version of Snyk. Use the binaries or the dockerized version.

<comment><USER6> Here is PyUp (safety) response: [https://pyup.io/posts/patched- vulnerability/](https://pyup.io/posts/patched-vulnerability/)

</comment></comment><comment><USER7> One can hope that with GitHub supporting signed commits and signed tags that now that they've acquired npm there'll be a way to match up a signed release with an npm release.

Signed releases on npm in general would be a start as then we could at least increase the reliability of security vulnerability notifications.

That being said, as pointed out in another comment, the amount of false positives for instance for regex vulnerabilities in libraries that are only used in the devDependencies of a repository are too high.

</comment><comment><USER8> Slightly off topic (but considering this is promo article from Snyk):

What is the value of Snyk now that Github and NPM have built-in dependency security audits?

I was a customer of Snyk before auditing was built in to NPM / Github (and before Snyk's price shot up to $750/mo for private repos). Was always confused how they justified that price point now that their main value prop is built in to npm for free.

</comment><comment><USER9> Bud, screen-space is scarce. Why does that header permanently take up a third of vertical space?

<comment><USER10> _What if you 're halfway down the page but you want to click to another page on the site? How else are you to do that unless the nav menu is on the screen all the time???_

Sticky headers are stupid and annoying. Easily the worst UX pattern in the last decade. I bet no one has even tested to see whether they even increase "engagement".

<comment><USER11> how about something less sinister like not designed for mobile first, and it looks just fine on a desktop with plenty of pixels to be used? like everything else in the world, a decent idea implemented badly makes the idea look bad. also, opinions are like noses. everyone has one and they all smell.

</comment></comment></comment><comment> w-ll Why Node? Why make a backdoor with a 90MB payload?

Sorry guys, I should have fully read the article.

<comment><USER12> either because they think they have a bigger potential audience if Node is used, or because Node is what they know best.

<comment><USER13> I think you can make a case that Node/NPM is more vulnerable to this than usual due to the huge number of packages pulled in by even simple applications. Can anybody really audit what 10k different packages are doing, and if any of them has had malicious code snuck in at some point?

<comment><USER14> It's not just more vulnerable, it's incredibly so.

<comment><USER15> Which platform do you use which does not rely on large amounts of open source libraries?

<comment><USER16> Powershell has a security model. Also, Ryan Dahl (creator of node.js) is working on Deno as a replacement because he thinks he made a mistake with node.

10 Things I Regret About Node.js - Ryan Dahl [https://www.youtube.com/watch?v=M3BM9TB-8yA](https://www.youtube.com/watch?v=M3BM9TB-8yA)

<comment><USER15> Ryan is one person and not involved with node anymore. Deno also has many mistakes IMO, so fine to agree to disagree on this one.

<comment><USER16> Interesting. You think he is making mistakes again? He complains about "second system syndrome." I've been using Deno for hobby projects and find a lot to like about it.</comment></comment></comment></comment></comment></comment></comment></comment>


Ask HN: How do I startup if I'm not a developer? - <AUTHOR> Some friends and I have an idea for a web startup that we really believe in, but we have no way to execute because we definitely need at least one real developer. What would you propose we do? I'm experienced with PHP (but not frameworks: I'm horrible with MVC) and design. We have another good designer onboard. And the third leg is the business leg, the guy who gets us incorporated and pitches our idea to our customers.
We have no real, hardcore developer though.
I know the easy thing to say would be "just learn to code!" And yes, that's our current approach. But is there a better way? It's going to take a lot more time than we'd like to become proficient enough at either Django or Rails (which is what we're looking at) or even Cake, CodeIgniter, or Symphony (all of which are last resort, more for speed since I'm good with PHP right now and just need to learn more in the OOP/MVC area).
Is it possible to outsource our product (rentacoder, getafreelancer, etc)? The lingering question with this is, how do we call it our product if we had no hand in building it, or that's not even really the biggest problem -- without giving our hired coder equal equity stake in our startup? What's to stop the coder from just taking the finished product and running?
Is there a way to protect the code as proprietary intellectual property of the company? <comment><USER2> What's your team so far?

1) you: the "idea guy"

2) a designer ("another" designer ... so you're a designer too?)

A great hacker is more key to making something great (and profitable) than a great designer.

IMO, the team should be either:

1) hacker, hacker

2) hacker, semi-hacker/semi-bizdev/semi-designer

3) hacker, bizdev

or something like that.

* Hewlett Packard was #1.

* Google is #1.

* Apple was #2: Woz and Jobs.

I think you've got the fundamental mix of your team wrong.

Put the idea on hold and start networking to meet hackers.

Go to Ruby and Rails get-togethers with a stack of business cards. Look for the crufty kid who looks like he sleeps in a cardboard box with his skateboard. Look for the fat guy with the ponytail and beard. Look for the quiet guy who never talks much. Chat these folks up, give them your card, and find out why they're studs (or, if they're not studs, find out who they regard as studs).

Meet these folks for coffee. Throw your idea out there. Listen to their ideas (coming up with ideas is the hard part).

As a matter of fact, ignore your idea.

Keep networking.

Sooner or later you'll find one or two other guys who you click with, and with whom you've got a lot of mutual respect.

Then do something with them.

It probably won't be the idea you have right now.

<comment><USER3> "IMO, the team should be either:

1) hacker, hacker

2) hacker, semi-hacker/semi-bizdev/semi-designer

3) hacker, bizdev

or something like that."

I was planning to reply in detail, but the above expresses most of what I wanted to say very succinctly.

I am on the other side of this coin. A _lot_ of "idea people" contact me every day to "do enough coding for a prototype and then we'll make a shitload of money". This is how I separate the serious people from the non serious ones.

(a) Do you have (some) funding? If you don't have sufficient money to cover my expenses for a few months (and being in Bangalore, I can get by on significantly less than I could in the United States say, but otoh I get the more kooky "idea people") you have nothing to trade with. This question eliminates 90 % of the "I have a cool idea" folks

(b) Do you have _deep_ domain knowledge? If you've worked in an industry 20 years you are much more credible when thinking of a killer product than if you are a freshly minted MBA with no record of having done anything significant in life but has ideas about " a twitter for insurance" or whatever.

(c) What risk are you taking? I get a lot of "offers" from people holding down corporate jobs who want me to work fulltime (of course with zero or minimal compensation) on the "idea",but who will hold on to their jobs till "the idea gets some traction". :-)

(d) If I build a prototype for you in the next 3 months (say) what makes you think you can sell it or raise money? Are you just hoping or do you have customers lined up (read Steven Blank's "epiphany" book for the kind of customer you need). Do you know any venture capitalists or angel investors personally?

So in a nutshell, if you have enough money to fund my lifestyle for a few months while I work on the idea, if you have a really good idea, based on deep domain knowledge, if you can market/sell the idea, and you are working fulltime for your startup _then_ you get my attention.

Look at it this way. Most hackers add value by being able to build anything they can conceive of / believe in. They could be building anything. Why should they build _your_ idea? The good ones are probably working on other interesting/profitable things already.

Oh yeah don't please outsource unless you know the person to be a really good programmer. As mentioned above it is hard for a non programmer to judge programmers.

Good Luck.

</comment></comment><comment><USER4> Don't waste time looking for a technical co-founder. If all you have is an idea, you'll never find one. Ideas are a dime a dozen, and most programmers get pitched all the time with "build me my site, do all the work, we'll make millions, and you'll get half of equity!"

So unless you already have legitimacy by getting some funding, you'll just be wasting time.

The problem is that if the programmer truly has the entrepreneurial spirit to take the plunge, chances are that they are already doing their own startup, and don't need your idea.

I say go with one of those freelancer sites, get someone to build you something basic, and then when you have a more or less ready product..then you can try looking for that techie co-founder.

This way you'll actually have something to offer to the coder, and on the plus side, you won't need to give away most of your equity for something that'll cost you a few thousand dollars.

</comment><comment><USER5> 1\. Don't try to learn to become a programmer. You'll fail miserably since it's not your sweet spot.

2\. Don't go after elance and other pay-for-hire sites.

You need a technical co-founder, someone who believes in your product and is willing to work very hard and do whatever it takes to make the product a reality. Contractors do not fit that mold.

Personally, I started a community with some friends to help people find technical co-founders, so you may want to check it out (<http://fairsoftware.net>).

By the way, the problems you describe about protecting your IP are exactly why we put a strong legal framework in place (the Fair Project, govered by the Software Bill of Rights). Even if you don't use the SBR, feel free to post a description of your project. People have found technical co-founders through our site, so it can happen.

And then HN is a good place, although I'd hate to see it turn into a bulletin board of wanted ads.

<comment><USER6> Didn't Kevin Rose go to elance

</comment></comment><comment><USER7> You pay a contractor in cash, not equity. Henry Ford wasn't on the assembly line and he did just fine.

<comment><USER8> Yes, and don't place an ad on craigslist (or anywhere) looking for engineers if you're only going to pay equity.

</comment></comment><comment><USER9> 1) do not use rentacoder, elance, or similar services. you get what you pay for. if you're looking for help, look around the established developer communities. HN is a good start. i also like the job board at freelanceswitch. there are others.

2) Q: _"What's to stop the coder from just taking the finished product and running?"_ A: a contract

3) my suggestion would be to hire a freelancer or a development company and pay them their rate, and if you like their work, consider offering them an equity bonus to sign on full-time.

p.s. your website doesn't do anything. you should fix that ;)

<comment><USER10> It is very important that you recognize a simple fact here:

Nothing -- absolutely NOTHING -- can stop an unethical coder from stealing the code you've hired him to write. A contract will never prevent a dishonest person from doing what he wants to do. After all, it's only paper.

Therefore your primary focus should be to find someone you are absolutely sure you can trust. Only this type of person will stick to his legal agreements.

<comment><USER9> indeed. in the end, the law is only a deterrent. if someone really wants to murder, the law and consequences won't stop them. similarly, if someone really wants to steal your code, they'll do it. contracts are just a very nice, cheap way to protect yourself and your company.

</comment></comment></comment><comment><USER11> If you wouldn't be confident programming it yourself, try to find someone who can provide a resume and at least 3 good references.

As long as you do your research, you can increase your certainty that your coder is legit and not out to steal ideas.

To be honest, I would recommend learning a bit more about MVC and OOP and just creating it yourself. Most applications are pretty rough when first launched. Just make sure you plan the project out to the best of your ability and keep scalability in mind. It is inevitable that you hand the project over to a more experienced coder so you would need to prepare for that as well. Hope this helps.

</comment><comment><USER12> If you aren't a coder yourself, hiring a coder can be incredibly challenging. Recognizing a good hacker vs. a bad one on a site like rent-a-coder or elance when you aren't a good hacker yourself is pretty much entirely random. In fact, it might be worse than random, because the worst developers on sites like might be the best at fooling non-hackers. I've done (non-core competency) development jobs through both, and I've gotten pretty good at sussing out who's going to waste my time by delivering code I'll have to throw away, and I've been a programmer since I was a kid, but I still make mistakes sometimes.

I've noticed a trend that leads me to believe that non-hackers would end up choosing the wrong developer in more cases than random chance would dictate:

The best hackers have a tendency to be honest, even if it means they're less likely to get the job. They will point out their limitations, explain what they don't yet know about the problem domain, and talk about the interesting (to them) aspects of the problem domain (which are probably the least interesting to a non-programmer). Now, great hackers aren't the only people who are honest, of course...which further complicates things. Folks who just don't have the skills may be setting their sites a bit too high, and will fail without intending to do any wrong. So mere honesty doesn't do the selection for you. It just makes it easier for someone who understands what needs to be done to choose the person to do the job.

The worst hackers don't care, because they know they're going to deliver shoddy work no matter what they say. The worst providers on these sites offer the _world_ , and will claim tons and tons of relevant experience. They will rip off existing products or websites and slap a new coat of paint on it and call it a "prototype" that they made just for your bid. They will produce copious requirements and bid documents to snow you into thinking that because they can produce so much specific documentation about the job to be done it means they actually understand the problems.

So, while I've had occasionally good luck with outsourcing work via a site like that, I would not recommend it for someone that doesn't have some experience interviewing developers and then working with the developers after they've been hired, especially if you don't have a lot of development experience yourself.

</comment><comment><USER13> I wouldn't dismiss the "learn to code" advice altogether. Can you do/learn enough to build a prototype? Perhaps one iteration level beyond? Then you're good to go, IMO. Getting to that prototype, you learn what is difficult and what is impossible for you. During the time it takes you to build the prototype or first crummy version of your idea, you are learners and as such can more easily connect with your local gurus than as business types who WANT something. You learn what is difficult and what is impossible for you, that is you get a grip on your coding problem. You will also learn to appreciate who of your gurus is helpful or has the expertise you need. Not to forget, someone who "just" wants a stupid technical monkey to code his brilliant business idea will always be resented by the good monkeys. A modicum of knowledge or passion for the subject makes a huge difference in perception and respect, for both sides.

</comment><comment><USER14> I would either partner with a developer, which in effect would give them equity or you hire a contractor or fulltime developer. I would imagine that you would have to give them specs. Otherwise I'd assume they would take a hand in crafting your idea, which is something it sounds like you want to prevent.

</comment><comment><USER15> Wait... you know PHP? Why not just use PHP? Really, it may not be popular with the HN crowd, but use what gets the job done. Have confidence in yourself, and get a prototype done. That will give you the experience you need.

</comment><comment><USER16> A few thoughts:

\- Kevin Rose went to a coder on elance to build the first version of Digg, so that route can be successful \- Try posting fliers on the kiosks or in the CS buildings at college campuses. I'd recommend giving as much detail as possible about the idea on the poster; merely asserting that "I HAVE A GREAT IDEA!!!1!" isn't likely to get you far. \- Network, network, network.

</comment><comment><USER8> If you're not technical, best thing is to learn how, or be able, to raise a lot of money.

Re: protecting IP, you'd want to write up the contract as "work for hire" -- then the code is yours. You'd also want to read up on the various open source licenses so you know what kind of open source code, if any, you'd be comfortable with the developer including in the work.

</comment><comment><USER17> I can code Ruby/Rails/Merb (not an expert by far, but I may be able to get the job done), am in college looking for something cool to do, and would be willing to co-found (or develop at a fee) if I liked the idea.

Hit me up at the email in my profile if interested.

</comment><comment><USER18> Pay other people to code, or learn to code. Nobody is going to code for equity in your idea.

Another option is to join a hacker who is starting a company and work on their idea.</comment>


Declutter your downloads, one file at a time – Torimori Sweeper - <AUTHOR> https://coffeeboo.itch.io/sweeper <comment><USER2> Uh, almost all the text on the page appears for me in a single-letter-wide column on the LHS of the page. (i.e. unreadable)

<comment><AUTHOR> Huh, that's weird. Is this the download page? Where are you viewing it from?

<comment><USER2> os x 10.4.. :-) Yeah. But still, pages either work or they don't, never seen that effect before. It's the linked-to page.

</comment></comment></comment><comment><USER3> Awesome!</comment>


Ask HN: Can you transition from trade secrets to open source? - <AUTHOR> Mostly just looking for people submit ideas on the main topic, but if you're interested you can read about my specific situation below.
I have unique knowledge/experience about how a variety of industrial equipment and computer systems communicate, and how the software to allow them to communicate should be designed. Right now, it's very difficult to make these devices/systems communicate, but at the company where I work we're creating software which uses the knowledge I have to greatly simplify the process. Companies have happily paid us large amounts of money just for the beta version of our product. I'm currently the only active developer.
On the one hand, there is a need to protect critical portions of this code. But in an ideal world, there would be some way to profit from the useful software we're creating while opening source access to the world. I would absolutely be open to ideas about that, or experiences people have had.
At the very least, I would like to avoid internally segregating our code base for future developers. However, how would we prevent a VC funded competitor from poaching one of our developers and gaining access to knowledge it would have taken them years or decades to acquire?
Are some businesses only viable with closed source, internally segregated, software? Or, is it inevitable that all source will leak anyway, so you should try to create a model which does not rely on proprietary information? <comment><USER2> "I have unique knowledge/experience about how a variety of industrial equipment and computer systems communicate, and how the software to allow them to communicate should be designed."

Your knowledge is the foundation, but the real value is at the ease of use layer. That's what your customers are paying for - your software solves problems for them. If it's easy to use, they will solve their problems faster.

I work at a mid-cap ERP company in the Midwest, I'd be interested in hearing more about your software.

</comment><comment><USER3> [https://crypto.stackexchange.com/questions/241/what-is-a- whi...](https://crypto.stackexchange.com/questions/241/what-is-a-white-box- implementation-of-a-cryptographic-algorithm)

</comment><comment><USER4> I'm curious - what kind of industrial equipment and communication protocols are you talking about? PLCs? Something else?

<comment><AUTHOR> PLCs are one of the devices we might communicate with. Not the sort of thing I'd call a trade secret though. I don't want to go into too much detail, but we've done a good deal of work with undocumented/poorly documented/difficult to work with APIs and network protocols (and serial communications). We're able to provide more functionality than equipment manufacturers in some cases, and do so within a single piece of software which works with a large variety of machines. The idea is to provide a unified API for all equipment which provides stock functionality for customers too small to have developers on staff.

<comment><USER4> Sounds a lot like the OPC servers we already have in the industrial automation industry.

<comment><AUTHOR> Overlapping functionality for sure. I think the primary difference is that there's not stock MES built into something like kepware, which keeps a large number of smaller manufacturers from using it. An API on its own is useless to them. OPC (UA) is one of the protocols we offer as an endpoint, but to be honest I think OPC (again, UA) is too complex for most use cases. It's a good protocol, but there's not enough tooling built up around it yet, and it's very much geared toward large enterprise. Not to mention the saga of legal issues it just escaped from. We also offer an HTTP API which uses swagger and swagger UI for documentation and testing, and normalize data across machine types before storing it in a database. This allows a company to grow from our opinionated MES into their own customized system as they grow. Additionally, we offer two way integrations with ERP systems. There are some other common interconnectivity applications required by most of the manufacturers we work with (we've been doing services for a long time and have 1000+ active service customers). These are not commonly covered by OPC servers, but are covered within our software.

<comment><USER5> I'm reading this with some interest, as this is what my company and I do too! [http://cncdata.co.uk](http://cncdata.co.uk) what you have written here is almost scary like reading my own words.

To answer your original post, my opinion is in Industry & digital factory, for it to succeed we must look to whats come before in software.

It's inevitable long term that protecting the unique knowledge we have is not the model of success for the industry, hasn't it always been this way? Sure we can make good money but overall does industry win?

We're about to open source everything we do, that's a Web API for Machine Data, MES, Quality systems and all of our Machine connectors, OPC/UA and Propriety. check out [http://openindustry.org](http://openindustry.org)

<comment><USER4> I'll keep an eye on openindustry.org. I'm the author and maintainer of an open source OPC UA stack/SDK.

</comment></comment></comment></comment></comment></comment><comment><USER6> You could always do a non compete if you're that worried about employees taking knowledge to competitors.</comment>


What It Takes to Build True FPGA as a Service - <AUTHOR> https://www.nextplatform.com/2016/12/02/takes-build-true-fpga-service/ <comment><USER3> While it's nice finally having access to FPGA's on the cloud, it's still a shame that there isn't much going on with Open source development on FPGA's, on either the toolset or libraries/modules. Though this is largely due to manufacturer hostility. Maybe wider access and adoption might finally do something about this situation.

<comment><USER4> Yes, agree. Also, SDKs are quite expensive - while GPU vendors give theirs away for free. This might be one reason for relatively low adoption vs GPU.

<comment><USER5> I don't think that is it. The tools aren't open source free, but they are dollar free.

Xilinx is the leader in FPGAs and their tools are free. Lattice tools are also free. Not sure about Altera, who is #2.

I've worked multiple places that shipped products using only the FPGA vendor's free offerings. The FPGA vendors see the tools as a way to sell silicon.

<comment><USER6> Altera was acquired by Intel last year and they dropped the Altera brand - they are now Intel FPGA.

</comment></comment></comment></comment><comment> brian-armstrong If you're looking to learn an HDL on an FPGA, it's probably still cheaper and easier to just buy your own, maybe something like [http://store.digilentinc.com/arty-board-artix-7-fpga- develop...](http://store.digilentinc.com/arty-board-artix-7-fpga-development- board-for-makers-and-hobbyists/) ($99). And for that matter, you can also get started by just using a sim and no FPGA for free

<comment><USER7> If you don't care about the DSP units you can pick up a CPLD kit for ~$20 [1].

[1] [http://www.digikey.com/product-detail/en/lattice- semiconduct...](http://www.digikey.com/product-detail/en/lattice- semiconductor-corporation/LCMXO3L-6900C-S-EVN/220-1935-ND/5039065)

<comment><USER8> You can also get a "real" \-- albeit small -- FPGA from Lattice for $25:

[http://www.digikey.com/product-detail/en/lattice- semiconduct...](http://www.digikey.com/product-detail/en/lattice- semiconductor-corporation/ICE40HX1K-STICK-EVN/220-2656-ND/4289604)

The Arty is a much more capable board, though.

<comment><USER9> What do you like about the Arty?

I'm considering the parallella board, which is around the same price.

[https://www.parallella.org/board/](https://www.parallella.org/board/)

<comment><USER8> Between the two I'd recommend the Arty without hesitation.

The Parallella is intended as a demonstration board for the Epiphany SOC. The $99 model has no GPIOs or JTAG interface, making it essentially unusable for FPGA development; the higher-end models will still be awkward to work with.

The Arty is intended for FPGA development, and is much better suited for it -- built-in JTAG controller, lots of GPIOs on easily accessible connectors, user I/Os, etc.

</comment></comment></comment></comment></comment><comment><USER10> For reference (30 November): [https://aws.amazon.com/blogs/aws/developer- preview-ec2-insta...](https://aws.amazon.com/blogs/aws/developer-preview- ec2-instances-f1-with-programmable-hardware/)

</comment><comment><USER11> FPGA newbie here; How does this relate to toolsets that Cadence, Synopsys and Mentor Graphics and others make for chip design? Would you use tools from these companies to design VHDL / Verilog for the 'FPGAs as a service' or is this at all related?

<comment><USER12> Yes, you use EDA tools to synthesize (compile) and debug VHDL/Verilog code for FPGAs, although Xilinx provides their own tools.

</comment></comment><comment><USER10> "Each FPGA contains approximately 2.5 million logic elements and approximately 6,800 Digital Signal Processing (DSP) engines."

Can an FPGA guru provide a real-world example of the kind of processing power this provides?

<comment><USER13> Just from experience. Bitcoin mining 10x from gpu to fpga so there's a lot of potential. But then again we aren't even using gpgpu in web apps.

<comment><USER14> I do :)

</comment></comment></comment><comment><USER15> Perhaps we should rename them to CPGA (Cloud programmable) - <USER2> programmable seems a bit archaic when they're cloud-based</comment>


One of Apple's Best Ideas Ever -- Made Worse - <AUTHOR> http://pogue.blogs.nytimes.com/2012/07/30/one-of-apples-best-ideas-ever-made-worse/?gwh=0ED3E7F87E1976E655867F4970587D1C

<comment><USER2> Article raises a very fair point and I can apprecieate the frustration of how a company like Apple could step backwards on a design issue like this. Can almost imagine a fly landing on it and disconecting your power cord; Which would make for a funny video on youtube if anything.

The new connector does seem to look like a iPhone/iPad/iPod )iP[hao][do][n ][e ]) dock connector from the picture, at least from a physical appearance casing wise. Do wonder if a similiar type of connector will be used on the new iP toys that Apple are making and if this connector is more suited to a smaller device.

Still, be interested how this progresses and expect lots of wonderful non-duct tape approaches. Also do wonder if this is a faulty batch of connectors that have weak magnets due to shipping/handerling in production as we all know a magnet that is hit does tend to lose its strength and in that if this is the case. Time will tell.</comment>


How I'd Hack Your Weak Passwords - <AUTHOR> http://onemansblog.com/2007/03/26/how-id-hack-your-weak-passwords/

<comment><USER2> You don't need special characters if you can use a passphrase. I use a passphrase for all my encryption passwords (usually 5-6 words long), which results in a password which is 20-30 characters long. This is implicitly better than a 10 character phrase of mixed letters/numbers/symbols.

The problem of course is that so many password entry forms (I'm looking at you, most-of-the-internet) have limits on the lengths of passwords. This needs to change. Hell, some even limit your ability to use special characters (no spaces? wtf.)

The most egregious offense I've seen is an international banking site I use for my stock -- it limits your password to 8 characters, numeric only. I nearly shit myself. Of course, I immediately went in for their high security passcard that has a random 2d array of numbers in it, which is in addition to the password. Trying to perform any actions with the account requires you enter sequences from the array.

</comment><comment><USER3> I can't remember if it was here or on reddit, but someone posted an interesting article that said that the big flaw with these mixed character passwords is that people have a hard time remembering them. When you start demanding that they use a different oddball password for every site, most people just write them down or ignore the advice.

The article showed an alternative to all the crazy rules: Create pass phrases instead. "I break 4 hacker news!" is much easier to remember than "f6jjaASDJc%$1~", and it fits all the insane rules we have invented for good passwords (mixed case, numbers, symbols, length).

<comment><USER4> Whats wrong in writing passwords down? I, myself, keep most important passwords saved in my phone.

<comment><USER5> Nothing wrong with writing them down, but put them on paper and keep them in your wallet or a safe. We put our SSN cards, driver licenses and passports and credit cards in our wallets. Why not our passwords?

<comment><USER6> Isn't "Never carry your social security card in your wallet" standard advice? I was taught that since I was a child, before identity theft was even really a mainstream thing.

As to credit cards, if your wallet is lost or stolen, you can quickly cancel the cards. It is probably more difficult to quickly change all your passwords.

Keeping them in a safe, however, is probably a fine idea. Potentially a good one if you want people to have access to certain accounts if something happens to you.

</comment></comment></comment></comment><comment><USER7> This tip I found on lifehacker got me to greatly improve my passwords strength, while helping me to remember each of them.

[http://lifehacker.com/184773/geek-to-live--choose-and- rememb...](http://lifehacker.com/184773/geek-to-live--choose-and-remember- great-passwords)

</comment><comment><USER8> At uni doing computer science a dictionary attack on the departments password file threw up TWO people with: NCC-1701-D.

</comment><comment><USER9> This is probably how my World of Warcraft account got 'hacked' ('cracked' would be a better term).

I was using almost the same user/password combination for both WoW itself and WoW-related forums and guild websites. Stupid, stupid, stupid me. One sunday I logged in only to find all my level-80 WoW characters naked and skint.

Luckily Blizzard was able to restore my stuff, and since then I use an Authenticator.

<comment><USER10> Mine got 'hacked' a couple months back. Too bad I had stopped playing 2 years earlier and their attempt to charge character transfers were on an expired card. But now I get no end of junk emails about how I need to secure my non- existent WoW account.

</comment></comment><comment><USER11> Keeping separate passwords for everything is simply not practical - nobody can remember that much. So they write them down. And because they need to look up passwords constantly, they keep the list easily accessible, i.e. easily compromised.

IMO a viable alternative is to have a few separate passwords based on how sensitive they are. Personally, I use three: \- One for regular websites where I wouldn't mind losing the account (game forums, throwaway registrations, etc.) \- One for stuff that would be seriously annoying to lose or where money is spent (my personal site, various shops, etc.) \- One for everything where money is kept or which could be used to compromise other sites (banking, paypal, ebay, google mail)

</comment><comment><USER12> head -c 8 /dev/random | base64

After a couple tries, you'll have something that breaks into pronounceable syllables, insert some punctuation (there's a lot of punctuation on your keyboard besides those under the number keys) to break the syllables and you're good to go. There are many tools that generate pronounceable nonsense passwords, but I prefer this way. Another approach is to generate 5 to 8 word phrases ad-lib style (these take longer to type in, but some people find them easier to remember).

<comment><USER4> pwgen tries to make remembrable passwords

</comment></comment><comment><USER5> If you are really serious about passwords, then generate random passwords _offline_ on non-networked computers. There's an app called launch codes I use to do that. It uses random data from MS CryptoAPI to seed a Mersenne twister RNG. Letting people create their own password is like letting a child run with a knife in his hand.

</comment><comment><USER13> What no social engineering? No Mitnick approach? Please, many times the easiest way to get someone's password is to simply call them and ask for it.

Also, there should be a section about targeting geeks. If the person you're trying to hack is of the geek variety, 1337speak is where I'd start once the obvious ones were done.

</comment><comment><USER14> I do wonder, every time I see someone recommend 133+ing the vowels ("m0d3ltf0rd"), how many dictionary-attack programs and script try those as a matter-of-course. People who do that don't seem to do it "randomly" - just as in the example used, they tend to change every vowel to a number in a single word (or less often, phrase).

</comment><comment><USER15> tl;dr: use better passwords. Long the better, lower, upper, special characters.</comment>


RedisConf2020 – Takeaway - <AUTHOR> https://redisconf.com/ <comment><AUTHOR> RedisConf is online this year and is running right now. There's videos via youtube and live talks scheduled over the next couple days. And they have an interesting in-browser conference space where you have an avatar and can move around different rooms. Pretty neat.</comment>