Did you notice Github's Spamming? - <AUTHOR> https://github.com/Forexbrokers/Forex-Brokers

<comment><USER2> I've seen emails like these before, but I don't understand them.

Take the linked github repo. What's the point? I realize I'm not the target audience, but usually spam has some link that I'm supposed to fall prey to, some Nigerian royalty who desperately desires to transfer money to my bank account.

This, however, contains no links. No visible way to be scammed, or even purchase anything. It isn't even well written, to the point of almost looking like a bad Markov chain. Is this just a spammer testing the waters?

I suppose maybe they're related to the first Google hit for "Forex"? Too much work. (Of course, I'm extremely not interested due to the spam/scan aspect.)

<comment><USER3> I think the spammers are trying to pollute the (publicly) available text corpus with markov-chains (or similiar stuff). My guess is the intention is to get ranking of search results near the top places. How? Well, it's on github (credible site) doesn't have links (not spam) so a corpus like this probably isn't spam elsewhere.

Of course "elsewhere" there are links in the text. But now the ranking is better and more likely to be found. So in the end it's a win for the spam blogs because now they get more hits/traffic.

</comment></comment><comment><USER4> The title of this submission ("Did you notice Github's Spamming") implies that Github is doing this. Is that the case, or rather is it the case that spammers are USING Github?

<comment><AUTHOR> yes, Im sorry (eng. is not my native language). I do not want to imply it. Just create awareness that spammers are using it.

</comment></comment><comment><USER5> This just seems like spammers trying any publicly available outlet for spamming. It doesn't seem like a very successful one at that.

</comment><comment><AUTHOR> the big downside is that when you search in github all these adverts polute it. It seems there are many of them.</comment>


How to Make Text Look Interesting: Minimalist Web Design - <AUTHOR> http://getspace.org/typographic-contras-minimalist-web-design/ <comment><USER2> Though this article is a way for Space to sell their new theme, I can attest to the information provided being very useful in-and-of itself. It's a strong overview of the fundamentals of typography and basic rules to follow for strong visual hierarchy and content readability.

If you want to learn more about typography, I'd pick up (what is considered) the typographic bible, _The Elements of Typography_ by Robert Bringhurst. While it is largely intended for print, most of the rules and suggestions still apply to the web. Alternatively, some pioneering folks put together a web adaptation of Bringhurt's book, <http://webtypography.net/>

<comment><USER3> Isn't that the name of the game in this brave new world? Tie your marketing message to some relevant piece of information that people will _want_ to share. It's like product placement in movies, only informational.

Plenty of PaaS vendors post "how to" articles that contain information about a relevant topic, but are tied to the product they're selling. I don't see this as being any different.

<comment><USER4> It's the oldest form of marketing there is: _mutual benefit marketing_. The reason it's the oldest is because it works for both parties, hence, the name.

<comment><USER5> In the modern marketing world, this has been re-branded as _inbound marketing_.

</comment></comment></comment></comment><comment><USER6> There's some good advice in there, but mixed in with lots of not-so-good advice, errors, or overly broad claims:

\- "The classic typographic scale ... relies on the notion that these sizes, when used together, look pleasing to the eye."

The typographic scale has a fixed set of sizes because fonts used to be physical. Having a 71pt font would be a whole new box of lead.

\- "I generally take the largest font I want to use and the smallest font I want to use, and place the headers into that scale at even measures."

For something like scale, a geometric progression makes more sense so that relative sizes are at even proportion (say each is smaller than the previous by 15%) then a linear progression of sizes. The difference between 72pt and 70pt is unnoticeable. The difference between 10pt and 8pt is huge.

\- "One way is to adjust the kerning and tracking settings in your design program."

Another way, not mentioned, is to just choose a different weight.

\- The "stroke width should be as even and consistent as possible"

It says Georgia has a more even width than Krungthep, which is visibly not the case. Some stroke variation seems to aid readability but too much (like modern serif faces) harms it.

\- "Georgia features a larger x-height than Tekton Pro."

That isn't Tekton. WTF.

<comment><USER7> I agree with most of your criticism, but I think the point they were trying to get across with the "these sizes, when used together, look pleasing to the eye" was that that _particular_ fixed set of sizes was chosen because it looked better than any _other_ fixed set of sizes.

</comment></comment><comment><USER8> "Typography is not merely the process of arranging font on a page. It is a living creature; it feels joy in an exclamation point, ...."

Perhaps I'm just not as excited about typography as I should be, but isn't this a bit too much hype? When I'm told that typography is a living creature that feels joy, I'm immediately going to categorize the teller as a person I will not understand. Instant loss of credibility.

<comment><USER9> No offense, but the teller will then categorize you as a person lacking imagination. Instant loss of credibility.

Communication fails once again and the world is that much poorer. No one is to blame, but it's sad to see it happen.

<comment><USER10> I disagree: the author is to blame. Every message has an audience and the author must know that when they write. At Hacker News we are, well, hackers in the broadest sense. While some of us might appreciate typography for what it is, _I believe_ most want to know how it might improve their products and services. Allegoric prose does not help, in this case.

(Edit: to clarify what it is I disagree.)

<comment><USER11> In this case perhaps the audience should grow up and learn about the side of the world that doesn't follow strict formal logic. Hackers shouldn't be afraid of aesthetic arguments, with all of the desire for elegant solutions they profess.

<comment><USER10> Nobody is questioning the necessity of aesthetic considerations to solve problems of all kinds. What brought up this discussion was the usage of ornate but empty language to describe typography. Quicksort is an elegant solution but would you pay any attention to a text stating that "Quicksort is not merely a sorting algorithm. It is a living creature; it feels joy at a well- chosen pivot point?"

That notwithstanding, I disagree again. When the author disregards their audience, alienation ensues. To change someone's mind, I must first have someone's attention. It's _my_ job as the author to make the audience grow up.

<comment><USER12> "Algorithms can be beautiful", or "code can be beautiful" is certainly something I wouldn't be surprised to hear from a programmer. I don't see people freaking out over those usages, though.

<comment><USER10> Certainly, yes, and appropriately so. Furthermore, "code can be beautiful" entices attention and curiosity while ornate language does not. That's all I meant.

</comment></comment></comment></comment></comment></comment></comment><comment><USER13> Am I the only one that thought that was one of the least interesting and very hard to read (as in nothing drew my eye, lacked any motivation to read those big squarish, repeating, same blobs of text) webpages?

Single long column, not adapting to size of browser window. It's more like a book/article/magazine than a web page. Only color jarring red links. Subtitles identical leading/trailing whitespace so text looks continuous instead of broken into sections.

oh but OA used emdash, that's surely important.

<comment><USER14>
      Single long column, not adapting to size of browser window.

What? You want multiple columns? That would require scrolling down, then up, then down, then up... I'll take one column, thank you. Also, the idea that you must fill the entire browser window with content is nonsense. The column width should allow for a comfortable reading rhythm. Too short and you break rhythm from changing lines constantly. Too long and it's difficult to find the next line. Most people seem to like 60-80 characters. Why screw that up by letting the browser width determine column width?

<comment><USER15> > Why screw that up by letting the browser width determine column width?

Because I choose browser width, and I set it where I like. That's why the web is better than paper.

</comment></comment></comment><comment><USER16> Heh, I got one line of black-on-white text describing a database error. Thought it was some kind of joke

<comment><USER17> I am getting a database error too. "Error establishing a database connection"??

<comment><USER18> It looked really interesting though

</comment></comment></comment><comment><USER19> at first the page was an error message saying "Error establishing database connection" in 20pt bold black times... that was unintentionally funny.

</comment><comment><USER20> This is a great way to promote your product. I love that the creators are not only giving you useful information for your own work, but subtly offering up their theme as an option. It'd be nice to see other products/services marketed like this. It's subtle and smart.

</comment><comment><USER21> Is that really Tekton Pro in those illustrations? Doesn't look the Tekton Pro I used to know...

<comment><USER22> heh, that's most certainly not Tekton, which is very recognizable.

The script in the figures shown is Zapfino. They're both inspired by hand lettering, but stylistically are nothing alike.

It's a pretty crazy error for a post on typographic expertise.

<comment><USER23> It looks like Snell Roundhand to me.

<comment><USER22> Ah, you are quite right. Thanks for the clarification. So much for my pronouncements about looking closely ;)

</comment></comment></comment></comment><comment><USER24> There's plenty of general typography advice out there such as this applicable to typesetting walls of text like blog posts and magazine articles, but what about the more specific case of type setting in web application interfaces? When developing web apps I feel like I waste a lot of time fussing with CSS font settings and the end result frankly sucks. Are there any typography snob blogs out there that focus on web app typography guidlines?

<comment><USER25> I try to read as much as I can about design - try out the latest tricks (e.g. grids, golden ratios) and pay attention to what works and why - but somehow that's not enough. To get to the next level, web app developers need proper design critiques -- where good (or amazing) designers weigh in on designs that are still in their early stages. I wonder if such a service or community exists...

<comment><USER26> Quit dribbbling and start wandering the forrst .. you might ffffind what you're looking for, or at least tumbl upon it.

</comment></comment></comment><comment><USER27> A good tool to calculate the rhythm & scale of your website's typography is this one: <http://lamb.cc/typograph/>

For example(in px): 10-12-14-16-20-26-32-42-52-64-84

</comment><comment><USER28> \- The ragged-right doesn't work with titles that extend beyond the copy.

\- Don't use images for examples that are perfectly possible with just type.

\- Em-dashes—like this according to convention.

\- In one of your examples you combine sans small-caps with regular capitals. Not good style.

\- Come on, there are better fonts than Georgia on my mac. Make me look at them.

And there are more examples of bad style on this page.

Like endtwist said, get yourself _The Elements of Typography_ by Robert Bringhurst if you really want to learn.

<comment><USER29> You can't rely on the broad range of browsers and platforms to correctly represent a lot of the examples required to demonstrate typographical concepts - images make good sense here.

And not everyone has a mac...

<comment><USER28> Not everyone has a mac, but you can do

      font-family: Times, Georgia, etc

So that it falls back on Georgia if the user does not have Times or whatever font is specified first.

About images: I disagree, a lot of typographical details can be made to work even on IE6/7

<comment><USER29> How would you represent individual character kerning? Demonstrate hinting, anti-aliasing, Clear Type, points, fonts that don't exist on all systems, etc.

Plus, every browser is going to render things differently (and individual settings in browsers will cause inconsistencies between different installs of the same browser). A picture is simpler, and gives a consistent experience across all mediums.

</comment></comment></comment></comment><comment><USER30> Is it just me, or does this look uncomfortably similar to the celebrated iA3 template for wordpress, designed by Information Architects?

<http://store.informationarchitects.jp/product/ia³-template> <http://www.informationarchitects.jp/en/100e2r/>

<comment><USER22> Speaking as a visual designer, I would advise you that iA's template is heads above, and actually starts you off with the "stunning" typography this template attempts to describe and demonstrate.

Type freaks will tell you that the key to setting text is all in the negative space. The homepage in particular uses white space around the headline and button in a very static, uninteresting way. The huge misalignment of items in the footer looks like something got broken. Know why? Because although the footer category heads are evenly distributed into four divs, the text contained in each column has a different visual weight. The third column should be optically aligned (meaning you need to eyeball it), so there doesn't appear to be a gaping space to the right of the "Connect" list.

Moreover, the 'About Space' block is crashing into the text on the left. Even the Space logo is poorly kerned, causing the A to float in an ambiguous way.

Take away what you can from the article submitted as there are some sensible tips, but don't don't pay for this template hoping for something competently designed. My design advice is to trust your eyes. Designers use some rules of thumb but looking carefully for the places where the rules fail is how you get to be great at setting type. Even a great template can't guarantee to make _your_ content look great.

</comment></comment><comment><USER31> i made a minimalist web design for my project website <http://vsetech.ru/>

as i am not a designer at all, so i _had_ to be minimalistic in order not to be very ridiculous. but i tried to make it look interesting. seems i followed some of the advices of the article intuitively (and some was violated of course)

</comment><comment><USER32> Text size, color, and font are all conversion drivers in their own right:

[http://www.conversionvoodoo.com/blog/2010/08/3-font-tips- to-...](http://www.conversionvoodoo.com/blog/2010/08/3-font-tips-to-increase- your-conversion-rate/)

I've found that larger font sizes for copy-heavy sites almost always drive higher engagement

</comment><comment><USER33> Anyone else not really care for the line break in the title? Seems to me like it would have been better after the colon, so that "Minimalist Web Design" would be grouped together on the next line.

I wouldn't normally be so nit-picky, but it is an article about typography after all.

</comment><comment><USER34> This 'advertisement' misses alignment such as 960gs, this makes information easily readable (compare 960.gs sites to this theme).

</comment><comment><USER35> tl;dr

</comment><comment><USER36> 105 votes + top spot on HN + submitted by an account registered an hour ago? HN is easily gamed, I guess.

<comment><USER37> How to make text look interesting:

Some ASCII art at the top, paragraphs divided in to readable form in the body.

Seriously, the people who care about aesthetics when they are reading are the same sorts of people who would rather not be reading in the first place.

<comment><USER38> I beg to differ. _Because_ I consume vast quantities of text, seemingly small improvements in aesthetics make a disproportionately large contribution to my quality of life.

</comment></comment></comment><comment><USER39> Funny, a typography article written in one of the most distracting fonts i've ever seen.

EDIT: Obviously i have no idea what i'm talking about. I just thought that the widely varying heights and odd shapes of the letters was distracting from the content.

<comment><USER40> Georgia?! Really?!

I think it's fair to say that Georgia is uncontroversially one of the best screen fonts out there. Georgia is awesome. And since it was optimized for use on screens it looks great at any size on screens with wildly differing PPI. The world has to thank Microsoft for having shipped at least one "web safe" font that's great.

<comment><USER41> Make that two: Verdana. Both designed by Matthew Carter. You may remember him from the hit film, _Helvetica._

<comment><USER40> I don't like Verdana that much but I'm slightly irrational about that.

The reason are the curly quotes. "They are all weird for English text" (you might still justify the way they look somehow – I guess they are not technically incorrect) and flat out wrong "when you follow the German convention for curly quotes". (Since HN uses Verdana you can see right here how screwed up those curly quotes are.)

Those quotes should look like _66_ (beginning, top) and _99_ (end, top) for English text and like _99_ (beginning, bottom) and _66_ (end, top) for German text.

I guess you could use «guillemets» instead.

<comment><USER42> Perhaps this is somewhat heretical to typography-knowledgeable people (I honestly don't know), but I've always preferred quotes to be straight up and down, as in this preview box: "

It just looks cleaner to me. Curved quotes look good in large size print, but I'm really not a fan in smaller font sizes. Do you have any examples of _good_ quotes in small font sizes?

<comment><USER40> Curly quotes are problematic on low PPI screens. They tend to just become unidentifiable clumps. The features that make them distinct become unidentifiable, they only look slightly odd and uneven.

I do, however, think that as we are moving to higher PPI screens curly quotes do look better (and, as you can see from my German example, some languages require you to put quotes in places where you cannot put straight quotes). I, for example, really don't think straight quotes look any good in print which is high resolution. In print all the small features of quotes are always clearly identifiable.

I actually think that Georgia has nice curly quotes but they do clump up below 12px or so font sizes. I think no font is free of that problem. I still like to use curly quotes, well, just because. I certainly can understand why you wouldn't want to use them at small font sizes on the screen.

(There is one exception. I like to use Letter Gothic for my snail mail correspondence. Letter Gothic is a great monospaced typewriter font and to preserve that typewriter vibe I like to use straight quotes.)</comment></comment></comment></comment></comment></comment>


So You Want to Be a Programmer? - <AUTHOR> https://www.digitalmars.com/articles/b08.html <comment><USER2> I wonder if the Authors list would be different now, 11 1/2 years after writing this article. It seems to me that although the fundementals of programming have not changed the value of knowing them has dropped. Maybe this is a result of object oriented programming maturing.</comment>


Leaving Apple and Google: my "eelo odyssey". Part1: the mobile OS - <AUTHOR> https://medium.com/@gael_duval/leaving-apple-and-google-my-eelo-odyssey-part1-the-mobile-os-f378ee247315 <comment><USER2> The only thing that I don't get is this concept of free Apps ( software) , we don't deserve to be paid for our work as a software developers? and btw, all this "free apps" , all of them, have inside tracking frameworks such a google tracking services, mixpanel , you name it. So in the fantasy world that you are trying to achieve , I dislike as well what big, tech are doing with our data, you would have to create your own Store with strict polices of non tracking , and still you would not be able , because they will track you in their servers, so, unfortunately as you know, the battle is mostly lost.

And open source would not solve anything, we all know that google is tracking us (always) and we go with it, we don't need to read the code, is an open secret.

<comment><AUTHOR> The "battle is over" argument is exactly what we need to address. Actually this is voluntary slavery attitude (and you are totally free to choose this option).

<comment><USER2> I agree with you in 100%. I just want to address, that the 99% of the users don't care about privacy and security , not even a little, Otherwise the whole WWW would be https and people would be extremely concerned about the practices of google, not talking about what facebook does.

</comment></comment></comment><comment><USER3> About the suggestion of using 188.8.131.52 as DNS. Reading [https://www.globalcyberalliance.org/initiatives/quad9.html](https://www.globalcyberalliance.org/initiatives/quad9.html) it seems to be a DNS that will refuse to resolve addresses that are in a threat list. It's both a good and bad thing. We ultimately trust our DNS provider but in this case blocking and maybe censorship are built in by design.</comment>


New Alzheimer's treatment fully restores memory function - <AUTHOR> http://www.sciencealert.com/new-alzheimer-s-treatment-fully-restores-memory-function

<comment><USER2> Its not a drug; its not surgery; its not invasive. Why does it need FDA approval? It'll do something or it won't. We've been ultrasounding people for a decade.

<comment><USER3> It is an intervention applied to living tissue, claiming to have medical benefits. It's a principle of medicine that anything present in quantities/intensities sufficient enough to produce a beneficial response, is sufficient to produce a negative response (aka, side effects). Those need to be assessed and quantified.

If we changed the word "ultrasound" to read "laser", I suspect it would make the need for scrutiny more intuitive. "Ultrasound" has this connotation of being harmless.

<comment><USER2> So is massage, or orange juice. That definition way too broad. I suppose the FDA has lots of criterion for what they manage. This is neither food nor drug.

<comment><USER4> This device alters your brain tissue. Damn straight it's going to be regulated. Massage isn't even in the same ballpark. Neither is OJ, which is regulated, just not by the FDA.

<comment><USER2> Actually your brain alters itself, growing toward a more normal function. The treatment restores the ability to grow.</comment></comment></comment></comment></comment>


Alice for the iPad - <AUTHOR> http://www.youtube.com/watch?v=gew68Qj5kxw <comment><AUTHOR> Video would be better if we could really watch what's going on instead some sort of Michael Bay short film with movement and zoom and movement and zoom and movement and spins and zoom!

</comment><comment><USER2> Damn! Is this one of those moments (like Safari on the iPhone) when you realize what a particular form-factor is for?

In this case, living books...

</comment><comment><USER3> Maybe it's just a really bad promo video, but this looks terrible. All the bits that look good are just the public domain tennielle drawings.

</comment><comment><USER4> I thought this was going to be about the Alice online store:

<http://alice.com/></comment>


Can We Please Stop Pretending That Microsoft's Bing Is Doing Well? - <AUTHOR> http://www.businessinsider.com/microsoft-bing-losing-billions-2011-4

<comment><USER2> I've honestly never understood why Microsoft has invested so heavily in the search business but I also think it's incredibly misguided to suggest that Apple is Microsoft's biggest competitor at this point.

I might be overgeneralizing but Microsoft's core business is software. Apple's core business is building platforms for software. The only major overlap is in the world of operating systems. Microsoft cares very little about hardware and Apple cares a whole lot.

Microsoft's investment in WP7 makes absolute sense but, again, unlike Apple they aren't about to start building smartphones.

I'm not sure but somehow the Microsft vs Apple battle just doesn't seem particularly interesting anymore because they seem to be able to coexist pretty well. Google is the interesting player because they are taking stabs in both directions and stepping on everyone's toes. Somewhat reactively, both companies have tried to push their way into Google's core business. Apple at least seems to have a plan; Microsoft appears to just be throwing money at the problem.

</comment><comment><USER3> The numbers are horrible, and Google is growing revenue almost twice as fast as Bing (27% YoY vs. 14%).

In the last quarter, Google growth in revenue from the same quarter last year was almost 3X Bing total revenues.

<http://investor.google.com/financial/tables.html> [http://www.microsoft.com/investor/EarningsAndFinancials/Earn...](http://www.microsoft.com/investor/EarningsAndFinancials/Earnings/PressReleaseAndWebcast/FY11/Q3/default.aspx)

</comment><comment><USER4> It's such a shame. I think we should Bing more. Their search site is really good on the iphone</comment>


Why Apple Is Right to Challenge an Order to Help the F.B.I - <AUTHOR> http://www.nytimes.com/2016/02/19/opinion/why-apple-is-right-to-challenge-an-order-to-help-the-fbi.html <comment><USER2> From here (4th para from the end): [http://www.nytimes.com/2016/02/19/technology/how-tim-cook- be...](http://www.nytimes.com/2016/02/19/technology/how-tim-cook-became-a- bulwark-for-digital-privacy.html)

"Apple had asked the F.B.I. to issue its application for the tool under seal. But the government made it public, prompting Mr. Cook to go into bunker mode to draft a response, according to people privy to the discussions, who spoke on condition of anonymity."

If this is true, it sort-of implies that Apple would have done it, but secretly, and they were forced to take their very public stance because of the FBI's posturing.

<comment><USER3> I'm actually a little surprised that the FBI would go so public with the request? Anyone have any insights here?

Did they think perhaps there would be public outcry the other direction meaning Apple would look like it was harboring terrorist information if they didn't comply to a public request?

<comment><USER4> > Did they think perhaps there would be public outcry the other direction > meaning Apple would look like it was harboring terrorist information if they > didn't comply to a public request?

This is exactly what is happening. It's a political hail mary to get the easiest-to-see use case of forcing privacy violations on american corporations and users legally protected in court precedent. Of course, under this interpretation, there's the disturbing implication they had to wait this long (after the revelation about PRISM) to find a case that so well matched their political agenda.

It's also a little worrying that they are going public, because normally that's not necessary for court verdicts. Perhaps they're preparing for legislative action if the case fails?

<comment><USER5> Any insight into which presidential candidates have the most privacy-friendly views here?

<comment><USER6> I don't know why you're being down-voted. The US is in the midst of an election cycle that may very well pertain to the "legislative action" of the parent comment (in so far as the executive has an effect on the legislature). From a recent article [0], it states (summarizing):

Pro-Privacy: Cruz (R), Paul (R), Sanders (D)

Pro-Surveillance: Trump (R), Rubio (R), Bush (R)

Moderate: Carson (R), Clinton (D)

[0] [https://nakedsecurity.sophos.com/2016/02/02/where-do-us- pres...](https://nakedsecurity.sophos.com/2016/02/02/where-do-us-presidential- candidates-stand-on-privacy-and-surveillance/)

<comment><USER7> > I don't know why you're being down-voted.

Off topic, but I am going to make a Hacker News bot that looks for this phrase, waits 1 hour and sees if the comment is still downvoted.

Or, I'm going to write a copy and paste paragraph explaining to people why it appears that a comment has been downvoted. This would include all the mechanics, how karma works in HN, voting algorithms, mod flagging, time passed etc, involved as well as human psychology at play. So, the above phrase either is honest or dishonest.

For example, in this case I would posit that yes, you actually do know why they were being downvoted, but that by writing that you were actually saying "I disagree with the others who downvoted you". There is a difference.

It could be similiar to when people say "I don't know why anyone voted for Bush". They are not expressing ignorance about the reasons, they are saying that they disagree with peoples choices. In this case, it would be dishonest. Unless the person was actually ignorant of others (it is possible), in which case it is honest.

Off-topic, as mentioned.

Edits - I do know why I am being downvoted.

<comment><USER8> On topic reply to an off topic comment. :) Could it also be because people use "don't know" and "don't understand" to mean the same thing in many contexts? With "don't understand" being longer to type and speak and also being more "formal" in communication than "don't know", perhaps "don't know" is used as a substitute?

In the Bush example, someone saying "I don't know why anyone voted for Bush" probably means "I don't really understand why (and with what thought process) anyone voted for Bush after everything we know about the matter."

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> The best way to put this for the other side is:

"How about we start with FBI mandated remote control gun disablers given that it's guns that killed these people? Oh, you're concerned that someone will figure out how to bypass it, and it won't just be the FBI disabling your gun?

Congratulations. You now understand my position."

<comment><USER10> Why don't we have remote take-over capability built into airplanes? People have certainly crashed them intentionally.

Why don't we have remote kill switches in cars? Think of the high-speed chases that could be prevented.

Why don't we have surveillance cameras in private homes? Think of all the crimes that could be solved.

Even if these are all off by default, and the law requires a court order to turn them on, Americans would not accept them. Encryption is no different, except that most Americans don't understand it well enough to see the parallels.

But these are just arguments against backdoors.

The even more fundamental argument is about the All Writs Act. Can the FBI require companies to develop new capabilities just with a court order? Shouldn't that require legislation? Why did we bother to pass CALEA, if the government could have just said "All Writs Act" and gotten what they wanted that way?

<comment><USER11> It is easier to understand if the same task is rephrased.

"Apple ordered by Chinese government to disable lock on phone seized from undercover CIA agent."

The act is the same. Being a multinational company, the result is no different for Apple. A government is legally requiring Apple to make decryption possible, but suddenly the people crying for Apple to unlock this phone will take an extremely different stance.

<comment><USER12> Everybody I've seen here saying that Apple should assist the FBI in unlocking the device takes the same stance in both cases. If Apple doesn't like it, they should either secure the device in such a way that it isn't easier for themselves to compromise than it is for a third party or stop doing business in that country if they believe the requests are unreasonable.

</comment></comment></comment></comment><comment><USER13> What bothers me most about this article is the following statement which is accepted without contest.

"Law enforcement agencies have a legitimate need for evidence, which is all the more pressing in terrorism cases."

What makes a terrorism case more pressing? How many domestic terrorist attacks have had related followup attacks? How many domestic terrorist cases have been linked to other domestic terrorist attacks? How many domestic terrorist attacks have been carried out by the same set of individuals or groups?

The reality is that domestic terrorist attacks are not common or frequent, there is no urgency in investigating them because they do not lead to followup attacks. They're coordinated events, not a series of related events so there's no pressing urgency?

<comment><USER14> what? Sure terrorist attacks are not common or frequent but they generally involve murder on a larger scale than your average criminal. There is of course a lot of urgency in investigating them as they could easily lead to follow up attacks. Look at San Bernidino and the Boston bombings. both pairs of terrorists clearly had plans for follow up attacks

<comment><USER15> What terrorists plan, and what happens, are very different. Terrorists often die in their attacks, so followup plans are often moot.

</comment></comment></comment><comment><USER16> I've been explaining this case to others and I've come up with a good way to make them understand.

"Instead of the FBI making this request, how would you feel if the Government of China were asking? or Russia, or Syria? Do you want them to have the ability to read your encrypted data off your iPhone?"

<comment><USER17> If there is a subpoena against that phone, I don't really have an issue with the government gaining full access to it. But there needs to be a subpoena and that backdoor can't be activated without one.

It's a similar, albeit stronger, idea as "probable cause": giving law enforcement a temporary waiver of rights that regular citizens are usually afforded.

<comment><USER18> The thing is, while ever a backdoor exists and can be activated at will the fact a subpeona is require to compel someone to use it doesn't mean that it can't be hacked by someone else to use for more nefarious purposes.

Deliberate backdoors can't exist, Apple needs to put the foot down and make that clear.

<comment><USER19> There is so much misinformation floating around.

The FBI wouldn't get a backdoor to all phones. It would literally only work on this one phone.

Or put another way, the backdoor is already there and Apple is being compelled to open it for this phone.

<comment><USER18> You completely missunderstand. It's not about this phone, or even this singular backdoor.

All backdoors are poison. End of story. If the FBI wanted access to the data on the phone they would have it already. But they don't. Probably because the already concluded they were acting alone and not part of a terrorist cell or network and no longer have need of the rest of the information or they really just don't care enough about it.

However they do want to use this case to get precedent for industry to produce new backdoors for them into previously secure-ish systems in the name of "terrorists". This very idea is cancer, a cancer that will spread to other technological systems they feel aren't easy enough for them to tap into whenever they want. A cancer that will spread across the world as it sets a precedent for nation states to force private companies into deliberately weakening the security in their products to please whatever government finds their citizens having access to encyption to be reprehensible.

So no, it's not mis-information.

You and anyone else that thinks this is ok just don't grasp the gravity of the situation.

<comment><USER19> I don't misunderstand at all. I just have a different opinion than you do. However, a lot of misinformation is being spread.

The FBI isn't asking for Apple to create a backdoor. End of story. They're compelling Apple to open a backdoor that Apple already created. Apple made an insecure system. They can, and I think _should_ fix it, but in this phone at least the back door is there.

So, wait to use a slippery slope argument when it actually becomes applicable. You're so trigger happy to jump on the privacy, precedent setting bandwagon you didn't stop to think what this case actually is.

Basically, as long as you make insecure systems, the government _can_ (by the fourth amendment no less) demand you let them in if they have probable cause and a warrant. If you make something impossible to get into, and the government starts demanding you stop making devices like that, then we have a problem. But this particular case doesn't get us any closer to that outcome. Not even symbolically.

I think you and everyone else overreacting to this case grasps gravity that isn't there. You're tilting at windmills.

</comment></comment></comment></comment></comment></comment><comment><USER20> Doesn't the fact that Apple is capable of unlocking the phone mean that a backdoor already exists ? Then it's just a question of a lone wolf telling the FBI how to do it, maybe along with using some secret keys that could be stolen if Apple is hacked like Sony was. I would like a phone that is unhackable even by its creator. Anything else is just a question of time to get broken into.

<comment><USER21> It all depends on how you define a backdoor. The 5c doesn't have the secure enclave†, so all of it's encryption routines are done in the CPU, as software/firmware.

That software doesn't contain a backdoor, but the fact that a new software load could be created and installed could be viewed as the backdoor itself. But if that software doesn't currently exist, is the mere potential of it a backdoor? Somewhat of a philosophical question.

If Apple prevails and doesn't write the software the FBI is demanding, then the backdoor is not there.

The later iPhones with the Secure Enclave may truly be unbreakable if they protect their secrets with hardware in the chip.

But my understanding of it is that Apple is NOT capable of unlocking the phone right now. The FBI is demanding that they develop that capability. So I guess they're capable of _being capable_...

† At the risk of being an armchair SE expert...

<comment><USER22> They are capable of unlocking the phone. There is no philosophical question about this, as they have the knowledge and the ability and the authority.

That it might take some expertise and effort is not really relevant - some is required in any case even if the firmware already existed, so its just a matter of scale. For example I know several people who could not update a phone firmware without supervision, and probably some who could at a stretch (given massive time and resources) reverse engineer it. Apple firmly occupy the sweet spot in this range, they have the secret knowledge that would otherwise have to be reproduced and it would be a bit of effort to build on this but not huge. Changing a bit of code [to remove the delay] and rebuilding a binary image is not a complicated task for their engineers, it is likely something they do all the time.

Personally, I think they should just do it if they are legally compelled to do so. They have done in the past and this is an older device and in 5 years the issue will be moot, as any firmware they create now would be useless.

<comment><USER23> >Personally, I think they should just do it if they are legally compelled to do so. They have done in the past and this is an older device and in 5 years the issue will be moot, as any firmware they create now would be useless.

If they do it now, they the point will indeed be moot in 5 years, not because of technology, but because it will be required of them to make sure they can do this to ALL iPhones.

</comment></comment></comment></comment><comment><USER24> The fact that Apple has made this issue very public (with [http://www.apple.com/customer-letter/](http://www.apple.com/customer- letter/)) is unprecedented almost (Lavabit and SOPA had some similarities). I applaud them for taking a stand and not just giving in.

If this legal precedent gets set that the FBI can force US tech companies to break into their own customers' encrypted data, you can bet the industry will lose millions if not billions of dollars worldwide in tainted reputation.

Who's going to buy US companies' devices that claim privacy via encryption if they're easily backdoored at the FBI's request?

<comment><USER25> Is that true? Armed with a court order, the FBI can search a U.S. house, compel banks to turn over financial information, compel accountants to turn over records, etc. Yet people worldwide extensively use those American services.

<comment><USER26> That's not a similar example to what's going on here.

Your example would have to include a situation in which the FBI makes copies of the keys to the house, copies of the hard-drives, etc. Then inevitably makes it embarrassingly easy for other parties to get access to those as well, permanently reducing your net security to almost zilch regardless of the outcome of the context and warrant.

And worse, in the process of gaining access to that one house and hard-drive, they simultaneously gain the potential to access millions of homes and hard- drives that have nothing to do with the warrant, and then those millions of houses and hard-drives see their net security reduced to essentially nothing.

<comment><USER25> They're offering to let Apple do the unlock themselves and just hand over the data.

<comment><USER27> And that establishes a precedent. So, in a future case that is less sensational, the court could order to Apple to unlock that phone as well and Apple would have to comply. Apple doesn't get to pick and choose which court orders it complies with. That goes for court orders in the US, China, Canada, etc...

<comment><USER19> Slow down there, you're moving the goal posts way too fast.

If you have an argument, stick with it.

If Apple doesn't want to look bad complying to FBI requests, they shouldn't have put a backdoor in their software.

</comment></comment></comment></comment></comment></comment><comment><USER28> > It is also theoretically possible that hackers could steal the software from > the company's servers.

It's also theoretically possible for hackers to steal Apple's private key from their servers, in the exact same way. As far as I see, there's no change to the threat model by Apple making a new software version, and signing it using the same process they use to sign other versions of iOS. It's useless if not signed, so the real worry is someone having the ability to sign it, and that applies exactly the same if Apple signs iOS or FBiOS.

This suggests the authors don't understand the technology well enough to know this.

edit: this is assuming the software is locked to a specific device. So the signing doesn't matter to any other device. If the software worked on all devices, then a leak of a signed version would be problematic. Although even if they couldn't lock it to device, they could make it only work for a short time, say a week, so if that signed version leaks later it would have no effects (I'm not sure if you can change the clock on a phone without unlocking it though).

<comment><USER29> Once the software exists, due to Apple's specialized knowledge, what's to stop them from issuing a NSL for Apple's signing keys + access to the remote update mechanism... then the FISC rubber stamps warrants en masse and Apple devices are used to spy on tens of millions of Americans. It sets a horrible precedent that the government can redirect the development resources of a private company.

How many millions of dollars in engineering salaries will this take? Project management? They're demanding an entire blackhat division of Apple be spun up, with the goal of circumventing other teams security effort.

<comment><USER28> None of that has to do with Apple creating the software, but rather with their handing over the signing keys etc.

The FBI or NSA could probably create their own software if they had the keys and source code.

I doubt the cost to Apple is over 100 man hours. But if it's too difficult, they can argue that and simply hand over the source code.

<comment><USER29> It would likely take more than 100 man hours just to provision the code sign; Apple probably has that all under controlled hardware that require multiple lead-engineer level crypto tokens across multiple divisions.

This isn't some Node.js box that a junior developer will monkey patch in prod—this is serious cryptography @ a large company w/processes.

"simply hand over the source code" Ohhh, so you're arguing a private company should hand over all of it's private property (it's source code) to a public institution because... terrorists?! Then Samsung starts hiring more FBI agents for some reason... or the source to the iPhone magically shows up online. Also how many hundreds of thousands of hours of engineering time will it take to sanitize that codebase to make sure it's suitable for public dissemination?

<comment><USER28> You think it takes 100 hours every time Apple releases a new iOS version just to sign it?

They used to do something similar with unencrypted devices, according to [https://blog.trailofbits.com/2016/02/17/apple-can-comply- wit...](https://blog.trailofbits.com/2016/02/17/apple-can-comply-with-the-fbi- court-order/)

>Ohhh, so you're arguing a private company should hand over all of it's private property (it's source code) to a public institution because... terrorists?!

I'm not arguing that. I'm arguing that if Apple claims it's too hard to comply, there's a much easier method. It's to Apple's _benefit_ that they're given the option to make the software and sign it themselves.

This isn't my original argument, I took it from [http://bloombergview.com/articles/2016-02-17/the-apple- fight...](http://bloombergview.com/articles/2016-02-17/the-apple-fight-isn-t- about-encryption)

<comment><USER29> Yep, that's what I'm arguing. The SHSH blob servers probably aren't trivial + I'm certain they have a lot of process in place to keep someone from "accidentally" releasing a software update, or the release of iOS 9.3 from taking them all down.

You'd be talking about creating both a special version of the OS and updating the SHSH servers to accept that code signature.

What are they gonna do, just hardcode the device's UDID in a sub-routine and distribute it to the entire cluster? What about testing? If they do it wrong and the SHSH blob/update gets in a bad state, they could end up accidentally wiping the phone... so now QE needs to get involved + build test cases.

I'd just spitball a 20 person team with at least nine months, lots of meetings w/leadership/pm/and VPs, hardware being purchased, and several executives having to get involved.

Hell, it takes more than 100 engineering hours at my company just to update some chef cookbooks; let alone schedule a release and get sign off.

I'm guessing you haven't worked at a large company before?

\----

They probably did something very different than custom firmware before.

<comment><USER28> It's trivial to redirect a network to ask your own server instead of Apple's. That's what tinyumbrella did while it still worked. So they wouldn't need to change those clusters, just set up a single machine signing only that device (which is easy enough that tinyumbrella did it without Apple's help), and give it access to Apple's signing key.

>If they do it wrong and the SHSH blob/update gets in a bad state, they could end up accidentally wiping the phone

How many hours does it take to test on a spare phone? 5?

>I'm guessing you haven't worked at a large company before?

No. But this isn't something that's being rolled out to millions of users. The team doesn't need to do anything that affects other users. They can have their own SHSH server offline, and sign everything offline.

</comment></comment></comment></comment></comment></comment></comment><comment><USER30> The problem is _not_ ability to search the device after it has been cracked, the problem is specifically does the government have the power to force companies to develop backdoors for their own devices?

In this case the cracking capability is for a locked phone in FBI possession. Let's assume the same technique isn't possible on newer phones. So what about the next case where the FBI wants remote access over LTE while the phone is unlocked / in use by the suspect?

If you can use All Writs Act to compel Apple to develop the first backdoor, then surely the same is true for the second.

</comment><comment><USER31> This is also a great product move by Apple, as if they win it shows even the FBI can't access your locked phone.

<comment><USER32> Perhaps, but that would be a strong incentive for government to mandate that devices _have_ to have a backdoor in the future, or that they can't use strong encryption so devices can be read without a backdoor. I doubt the FBI see losing this particular battle as the end of the war.

There's also another possibility, albeit less likely, that the FBI know they'll lose but they don't care because they can already read the device and they want any terrorists to believe they don't have the information on it. That's a pretty full-on "tinfoil hat theory" though.

<comment><USER33> Mandated backdoors are something that law enforcement wants, but something that the national-security complex probably doesn't want (they seem to feel they can get what they want without help, and don't want to make US personnel/corps easier targets for their overseas counterparts). And the national-security complex is likely to win that fight.

</comment></comment></comment><comment><USER34> Does anyone feel this whole incident is a carefully staged by the FBI and Apple?

I'm not into conspiracy theories, but I'm wondering on this one.

Why would the FBI, or Apple make this so public? The Apple letter seemed staged?

The federal government always seems to get what it wants in the end, especially if one has a lot to lose?

I imagine the conversation starts off with an indignant, appalled CEO.

"Hell No--I'm not giving you access to my customers data!"

Federal government counters with, "Do you want us to scrutinize your past, and present life?"

"Do you want us to look at every stock trade you ever made?"

"Do you want us to publicize the personal information we have on you already?

"You know we can make your life misserable? You know we can make your companies life misserable?"

No this isn't Russia, but our law enforcement branch of the federal government scares me, and I'm a nobody. There's been some deaths, especially in tech, that seem suspicious. The drug overdoses--guy in San Francisco that was about to give a talk on ATM hacking comes to mind.

That tech guy who died in that fiery car crash on Los Angeles.

(I don't want to argue with anyone. I have no evidence. Just a weird feeling. And yes, Tim Cook seems like a choir boy. He comes across as someone who doesn't even jay walk.)

</comment><comment><USER35> Let iPhone users opt-in and you'll find far fewer proponents of backdoor encryption than will be reflected in Congress. I wouldn't be surprised if most in the LE and Intel communities didn't opt-in. Why? Perhaps because the USGOV has yet to prove they can keep their own data secure. The Office of Personnel Management hack, Clinton official emails on a private server, and many more instances have shaken the faith in USGOVs ability to be an effective steward. I'm in favor of master keys for the FBI after they prove to the public, in a transparent and accountable manner, that those keys can be kept unassailably secure from misappropriation or abuse.

</comment><comment><USER36> What if Apple's coerced firmware update bricks the phone? That's destruction of evidence they'd need immunity from. What trust and conflicts arise when a company has blanket immunity from such evidence being destroyed?

So many slippery slopes.

</comment><comment><USER37> Off topic, but: _" Apple is doing the right thing in challenging the federal court ruling requiring that it comply"_

I am not a native English speaker. Why "it comply" and not "it complies"?

<comment><USER38> Subjunctive tense. Since it is still not known whether they will comply or not, the verb is unconjugated. Writing "it complies" would be confusing. It's highly proper grammar and not used in everyday spoken speech and not used all the time in most written speech, but since this is more formal and written, it's used. It's one thing the NYT gets right.

<comment><USER37> Thank you! We live to learn.

[https://en.m.wikipedia.org/wiki/English_subjunctive](https://en.m.wikipedia.org/wiki/English_subjunctive)

</comment></comment></comment><comment><USER39> When two nuts with rifles trigger a "National Security" problem I think the problem is with the Nation not the people.

What happens when an entire nation threatens us ?

</comment><comment><USER40> Couple of thoughts:

\- Doesn't an iPhone become completely secure if you prevent if from passively polling for OS updates. If the iPhone would only poll and install updates after user un-locks and allows, then there would be no way change the necessary software configuration without breaking the encryption. And the encryption can't be broken, thus if you could chose OS -level default "don't accept or even check for any updates without user permnission" you really would have an unbreakable device. But if they ever did implement this, it would be terrible for Apple's forced upgrades and their platform would fragment into many incompatible versions. I think everyone knows which option Apple will chose between: CompletelySecurePhoneOS or AbilityToForceUpgradesAndPatches.

\- Correct me if I'm wrong but didn't Tim Cook initially state cracking this phone was impossible according to Apple's experts? And now it seems it's a quite reasonable issue of Apple signing an OS-update specific to this device's unique ID; so quite feasible. So was that a lie?

</comment><comment><USER41> I've got a feeling we're being manipulated by someone with an agenda at play.

<comment><USER42> Are we ever not? It's a political topic, so manipulation goes with the territory.

</comment></comment><comment><USER43> All they need to do is compel companies (by hook or by crook) to install backdoors in their algorithms or hardware.

[https://www.eff.org/deeplinks/2014/01/after-nsa-backdoors- se...](https://www.eff.org/deeplinks/2014/01/after-nsa-backdoors-security- experts-leave-rsa-conference-they-can-trust)

[https://en.wikipedia.org/wiki/Dual_EC_DRBG](https://en.wikipedia.org/wiki/Dual_EC_DRBG)

[http://www.cnet.com/news/spy-fears-lead-nuke-lab-to-dump- gea...](http://www.cnet.com/news/spy-fears-lead-nuke-lab-to-dump-gear-from-hp- unit-not-huawei/)

Who is to say that other state actors haven't done the same to chips produced by their companies? The truth is, the genie is out of the bottle.

A year and a half ago, I wrote a serious article on this: [http://magarshak.com/blog/?p=169](http://magarshak.com/blog/?p=169)

</comment><comment><USER44> The guy who wrote the two most important 4th amendment case opinions over the last thirty years (both in favor of privacy rights, both by 5:4 votes), and who had the longest record of cracking down on laws that were being stretched to cover uses never imagined (which by definition, the Writs law is being abused) just died.

It's not good timing....

<comment><USER45> For those of us not well-versed in these sorts of things, what were the two cases?

<comment><USER44> Jones and Kylo. Kylo held that the Government could not use infrared scanners to track individuals inside of their house without a warrant, while Jones held that the government could not use GPS trackers on cars, even in public, because it had to trespass to install the GPS tracker. He also dissented with the forced DNA testing of anyone charged with a crime, and from warrent-less suspecion-less traffic stops.

[http://reason.com/archives/2016/02/16/antonin-scalia-was- a-g...](http://reason.com/archives/2016/02/16/antonin-scalia-was-a-great- jurist-for-cr)

<comment><USER12> There is no explicit right to privacy in the Constitution. Some of Scalia's rulings happen to favor privacy while others do not. For example, he also said the Miranda ruling is judicial overeach, so in his view, you have rights (privacy or otherwise) only if you know about them ahead of time. _Roe v. Wade_ established precedent for an implicit right to privacy interpretation of the 14th Amendment. Scalia has said that interpretation is wrong.

<comment><USER44> no, but the 4th amendment (which I referenced above) is the usual proxy. Even the most ardent of abortion backers will admit that Roe v Wade is flawed by every measure of judicial practice (which is why the entire line of thought advanced by Roe v Wade has not gotten any traction in any other ruling). Only the fact that it's tied to such a hot-button issue has kept courts from over- turning it.

The 4th amendments and all writs law is being broadly interpreted by this judge to give the government the power to effectively enforce a warrant against the entire population of the United States that uses iPhones. Scalia would have been all over that like white on rice.

</comment></comment></comment></comment></comment><comment><USER46> Apple indeed may have a right to refuse the administration. Does the administration have the right to remove Apple Computer from the GSA government purchasing schedule?

<comment><USER47> Yeah, I'm sure they'd shed a tear over that.

</comment></comment><comment><USER48> Why doesn't the FBI copy the contents of the terrorist Farook's iPhone to a second iPhone (after all, it's only a hard drive). Make ten attempts on the second iPhone, brick it, then copy the contents again, try the next ten digits, and so on until they hit the combination?

<comment><USER49> As I understand it, half of the key that decrypts the phone is stored on the chip itself and cannot be read. When you enter in a correct password on the lock screen, it is added to this hardware key and the combined key is then able to decrypt the phone. If you move the contents of the hard drive to another iPhone, the key on that phone will be different and thus can't decrypt the drive. Its like 2 phase authentication on your Gmail account and you are being sent the wrong codes.

Check out this article for more information. It also explains how the fact that the phone is a 5C is significant to the encryption scheme. [0] [http://blog.trailofbits.com/2016/02/17/apple-can-comply- with...](http://blog.trailofbits.com/2016/02/17/apple-can-comply-with-the-fbi- court-order/)

<comment><USER48> OK, good explanation. What about removing the original hard drive from the iPhone, and installing the copy? You could just keep plugging in copies until you crack the code?

Could the chip also not be cloned?

</comment></comment></comment><comment><USER50> Curious if Apple is breaking any user agreements if they end up doing this. Sharing information on servers is one thing. Sharing a key which enables access to all future communication too is different. Does their EULA cover such scenarios? Can it open them up to possible lawsuits from its users?

<comment><USER51> How, the phone owner, the state agency, granted permission, the actual users died. Who'd have the basis to sue under what claims?

If you thought you had a claim I guess you could sue to block the order, but that's up to the courts to decide and that would take precedence over an eula.

</comment></comment><comment><USER52> One thing I hope can be clarified: Is the FBI asking Apple to patch iOS on this one device, one time only (in a way that can not be reused) ... or are they asking Apple to provide a "reusable" patch / modification that allows future devices to be accessed?

<comment><USER53> "One thing I hope can be clarified: Is the FBI asking Apple to patch iOS on this one device, one time only _(in a way that can not be reused)_ "

This must be weasel-word day. The FBI is asking for patch, hypothetically just for this phone. But only in this post have I seen anyone imagine "a way that can not be reused" since the point raised stated by the parent article is that such a patch could inherently be reused.

<comment><USER54> If all Apple produces is a signed update (with logic that activates it only if it's the right IMEI) then it's not useful to anyone hacking any other phone. The software can't be modified to work on them without Apple's cooperation, since any modification breaks the signature and you don't have Apple's signing keys.

</comment></comment></comment><comment><USER55> Given the powers and size of the national security budget and the NSAs in particular, why do they need Apple? Shouldnt the NSA be able to crack this on their own?

Kinda makes ya wonder what all that moneys spent on...

<comment><USER24> They can get the info they want with more sophisticated techniques from what I've read. Also, Apple already gave them the iCloud backups. The legal precedent of forcing companies to break their own security for the FBI's sake is the prize at hand here it seems.

</comment></comment><comment><USER56> So here is a simple question. How will we know if the US becomes successful in having manufactures put in a backdoor? Can it be done to the current 6 models through a software update?

</comment><comment><USER57> Glad to see this from the editorial board of the NYTimes

</comment><comment><USER58> I may be wrong - but I have a feeling that, technology companies like apple and google are developing software on device to make user data so protected that they will say "I can not technically to crack my software" even ordered by a Judge (presumably for legit reason), thus the DOJ is using this case trying to prevent it from happening. And, if this is the case, then personally I am at the DOJ side, because I recognize this is a less ideal world (actually I think it is even worse), and this country is technically in a war.

</comment><comment><USER59> Has there been any precedent of (the|a) government forcing someone to sign a piece of code against their will?

</comment><comment><USER60> Wonder why can FBI just hand the phone to Apple keep the phone just get the data we don't needed specifics.

<comment><USER61> Do you really want that to be the model for American justice? Law enforcement hands your digital electronic records over to a private company who has the power to put anything on that phone? Do you want to entrust your personal legal future to a private entity? I think I'd want a solid chain of custody on anything that may prove my innocence.

<comment><USER46> The phone was the property of San Bernardino County.

The county has longstanding email and Internet use policies that state, "NO USER SHOULD HAVE AN EXPECTATION OF PRIVACY" \- [http://ktla.com/2016/02/18/why-didnt-san-bernardino- county-o...](http://ktla.com/2016/02/18/why-didnt-san-bernardino-county- officials-have-access-to-the-terrorist-iphone/)

<comment><USER62> I bet even I, not a lawyer, could reasonably defend that, no matter who "owns it", a device as personal and as much an extension of the brain as a smartphone could be considered private.

</comment></comment></comment></comment><comment><USER63> I wonder why the head of FBI didn't ask Tim Cook first in private. or I missed something?

</comment><comment><USER64> TLDR for what follows: Mandated backdoors must be a red line, but this is not a request for a backdoor and actually seems pretty reasonable. Trying to argue that the tech industry shouldn't help, even in this case, is not only the wrong position in my book, but a sure way to lose the bigger debate.

My views on the general encryption controversy are:

1\. Everyone must be free to make their technology as secure as they possibly can. There can be no mandated weakening of security, back-doors, or other requirements to make the information more easily accessible by law enforcement. On newer iPhones, Apple has patched up the flaw that the FBI wants their help with exploiting. They must continue to be allowed to do that.

2\. The government must be able to demand, with a court order predicated on probable cause, that companies provide any and all information that they have that could be useful in circumventing their security features. This can be everything from technical specifications and threat-model analyses, to lists of unpatched vulnerabilities and code-signing keys.

3\. It seems to me that American companies have a moral obligation that goes beyond the legal obligations in point #2. They should be actively assisting the government in recovering information, especially when concerning issues of national security. In extreme circumstances, like total war, this should definitely be legally mandated. I'm undecided as to what the policy should be generally. On a practical level, it's probably not feasible for the government to, e.g. start hacking around the iOS codebase themselves, so just information might not be enough.

I'm not too troubled by this court order, especially given the particular circumstances. The right to make products as secure as you can, even from yourself and the government, is what's really important to defend. Trying to argue that the tech industry shouldn't help, even in this case, is not only the wrong position in my book, but a sure way to lose the bigger debate.

Apple's definition of "backdoor" is highly suspect. A backdoor is if I ship my product with an intentional vulnerability, so that I can hack into it later. Apple's not being forced to add a backdoor, it already exists because the security features break down against an adversary that has Apple's private key, at least for the default 4-digit PIN configuration. Now the government is asking them to use their own capabilities to help hack this phone. Of course, Apple didn't create this backdoor for malicious reasons, they just didn't include themselves in the threat-model, greatly simplifying updates and other security features, and allowing the walled-gardenness of iOS. It's also central to the walled-garden. Curiously, this is in direct contradiction to their claim for some time now, that they were designing iPhones such that they themselves can't break into them.

Now put yourself in a Congressman's shoes. The FBI has been telling you for years that tech companies are being purposefully antagonistic to their legitimate search and seizure authority. That the tech companies are purposefully designing features with the sole intention of shutting the government out. Now here's a case where there was no mandated backdoor, the government was able to devise an exploit method, and they got a court order from a judge to make Apple use it on a dead terrorist's phone. "Mandatory backdoors would hurt everyone's security", one of the arguments that _we 've been winning with_, now sounds like a bullshit cover for "we are against any government surveillance". Can you smell the legislation coming yet?

Disclaimer: These are obviously my own personal views and nothing else. They do not necessarily reflect the opinions, policies, or practices of anyone but myself.

(Reposted from [https://news.ycombinator.com/item?id=11131456](https://news.ycombinator.com/item?id=11131456) with additional)

<comment><USER65> I am only going to reply to 3.

Why would any company have a moral obligation? In fact, what if they are saying this is their moral obligation? To not bypass the security they told customers they had put in place?

I think they by using the term moral obligation, people are trying to negate the meeds for laws or rulings.

In my opinion: There are no moral obligations for companies, just laws they have to follow.

After it is made law, it is the companies choice to do business there or not.

</comment></comment><comment><USER20> I wouldn't be surprised at all if Apple already gave a version of the OS to the FBI that enabled them to brute force the password for that one phone with the condition that they publicly put up this show as if they were not cooperating.

<comment><USER66> That would involve lying to a court. Intelligence folks might do that. Law enforcement? Not a chance; it would be career-ending even to discuss it.

<comment><USER67> If you truly believe that, I think perhaps you place too much trust in the wrong sort of people.

The reason why I consider the hypothesis unlikely is not because those involved are unwilling to deceive, but because they are unlikely to have sufficient skill to make the attempt and avoid detection. I believe that, considering the number of people that would be necessary, at least one Apple insider with ethical concerns would leak evidence that would expose the true story.

<comment><USER20> I believe that much more than "law enforcement never lies", but IMO it's hard to leak evidence in this case. A whistle-blower could say that he worked on this project, but there isn't the hard evidence of documents that for example Snowden could leak. The FBI or Apple could just deny it or say no comment.</comment></comment></comment></comment>


Renting a Dog - <AUTHOR> https://www.bloomberg.com/news/features/2017-03-01/i-m-renting-a-dog <comment><USER2> Would this not have been avoided if companies were mandated by law to advertise the full cost of their installment plans in their ads? In Denmark (and presumably in many other countries), this is the case for anything from cell phone plans to dish washers. I.e., you can't just say how little you have to pay each month and over how many months and hope that people don't multiply the numbers.

<comment><USER3> It's an issue of state law. I believe every loan I've signed included a section saying how much I was borrowing, and how much it would cost to pay it back following the payment schedule.

(EDIT):

I don't know if similar laws apply to leases, although car lease commercials usually have a similar section in the fine print. Usually that means at least one state requires the disclosure.

<comment><USER4> There are federal laws covering that.

Which is ALSO why they're very clear this is a lease and they seem to be trying to ensure it is seen that way. They don't want to fall under those laws.

</comment></comment></comment><comment><USER5> This particular problem can be solved by going to a pound or a rescue. You get a nice dog for free. There is no need for ever going to a breeder.

<comment><USER6> For me, the most startling part of the article wasn't the insane lease financing, it was the up front "sticker price". $2,400 for a dog, $1,700 for a cat. I've generally known that some people pay a lot of money to buy a certain type of dog from a breeder, but I was thinking it was more in the mid 3-figure ranges (I think I've seen ads for dogs around $400 - $600). I have considered that a ridiculously expensive price. I'm speaking someone who makes pretty good money, owns two houses, three vehicles (for two adults). But seeing that people pay thousands for a pet. It's like this whole other world of exorbitance. They're not paying for a pet, they're paying for something to brag about.

> A good breeder will also want to keep track of the pup and will also offer > you a contract to protect you both and make sure your dog is healthy or will > explain its conditions. Bulldogs are very special dogs and people who own > them are just as special. [1]

Generally, if you go to a pound/rescue, your costs will be around $100, most of which are to pay for things like de-worming and stuff you would incur in a visit to the veterinarian.

1: [https://www.suburbanbullies.com/whydobulldogscostsomuch.html](https://www.suburbanbullies.com/whydobulldogscostsomuch.html)

<comment><USER7> It depends on the breed and what you're looking for. My parents have always been huge dog people, and they've had a number of dogs over the year. Some were from registered breeders; others were rescue dogs, including two that they rescued. One was a wonderful dog whose bastard owners tossed him out of car going 30 miles an hour on a highway where one of their employees saw it and brought him to their workplace. At the other end of the scale, they paid something like $1500 and $1000, respectively, for mother and son Cavalier King Charles Spaniels from a licensed breeder a good ~18 years ago. The price would be higher nowadays. An Alaskan Klee Kai (think small dog resembling a Siberian Husky, but responsibly bred and without the ethical and health problems of a so-called 'Pomsky') will run a good $2-3000.

Is it worth it? Again, it depends on what you're looking for and whether you're able to afford the dog in question. People purchase particular purebred dogs for a lot of reasons; there's a far greater degree of predictability when it comes to genetic risks, life span, size, temperament, etc. due to a _lot_ of collective knowledge. Reputable breeders socialize their dogs from the beginning, provide care, and they usually have already started the training process well before it's time for placement. With rescues or mixes in general, there are more unknowns though good shelters do their best to isolate those unknowns and help find the right home based on what they do know about the dog's background and have observed regarding its temperament. The unknowns might be scary at times, but it doesn't make the dog lesser. I'm typing this with a rescued mixed-breed terrier sitting beside me.

What really pisses me off about this story is the cruelty of the threat of repossessing an animal for both the animal and the family. No dog deserves to be ripped from a loving home and tossed into a shelter (even a good one); or worse, a pet store. Especially the kind that would suggest a freaking _lease_ to a potential pet owner. It fits right in with the worst excesses of puppy mills. Plus, I have my doubts about the quality of care a company like this would provide to repossessed animals. It seems more like a disgusting effort to cash in on spur of the moment purchases, taking advantage of a lack of knowledge about both the finance agreement and owning a pet in general. Wunderlich even admits as much in the article: "We like niches where we're dealing with emotional borrowers."

If you can't afford to pay cash to adopt the pet, or use a credit card you can pay off quickly without negatively affecting your overall finances, you shouldn't jump on long-term financing or this lease BS as an alternative. It isn't a smart option, financially or emotionally. There are a ton of wonderful rescues of all sorts who can be adopted at very minimal cost. You have the added benefit of supporting some very respectable organizations that often struggle to fund their operations. And if you're looking for a particular breed of dog, there are often purebred rescue organizations that focus on specific breeds and often work closely with their respective breed clubs.

</comment></comment></comment><comment> fake-name > "We like niches where we're dealing with emotional borrowers," Wunderlich > said.

Jesus Christ, what an exploitative asshole.

This is the canonical definition of a predatory scumbag. He's _deliberately_ targeting people at a highly emotional point, to rope them into a exploitative contract. Plus, who has even _heard_ of "renting" a dog?

I'd bet the great majority of the people involved assumed the paperwork was just for vet bills and such relating to the dog. By targeting a niche where such a loan practice is rare/nonexistant, they probably expect much less scrutiny of the underlying contracts.

I bet his buisness would vanish if they forced him to put "Dog Lease Contract" or something similar in 70 point text on the paperwork people have to sign.

> He's drawn to the rugged individualism expressed in the novels of Ayn Rand > and the blog Cowboy Ethics

Surprise level: zero.

> He is, he writes in a mission statement on his personal website, "living in > a Postmodern culture while maintaining my old American West roots and > Christian values."

"Christian", but apparently having never read the bible at any point ([https://en.wikipedia.org/wiki/Cleansing_of_the_Temple](https://en.wikipedia.org/wiki/Cleansing_of_the_Temple)).

What a thoroughly unpleasant person.

<comment><USER8> > He's deliberately targeting people at a highly emotional point, to rope them > into a exploitative contract.

I assume you mean it's exploitative on the customer? If two parties voluntarily enter an exchange, who are you to say that it's exploitative? I'm genuinely curious.

<comment><USER9> If one party leaves the store not realizing they'd signed a lease agreement, then two parties have not voluntarily entered an exchange.

<comment><USER10> If one party has to make monthly payments, then what else do they think it is? And how can adults in this world not understand how interest rates work.

<comment><USER4> A loan. That's that standard way you'd get a loan. And a loan would make more sense too since it's (theoretically) a good you keep forever.

<comment><USER10> Sorry, my bad. For some reason I thought these were loans and not _actually_ renting.

</comment></comment></comment></comment></comment></comment><comment><USER11> The worst part of this is the implied threat that failure to make payments will result in your beloved dog being taken away from you. They didn't say it in the article, but I would bet almost anything that the company that gave them a $75 million credit line believed, probably correctly, that default rates will be lower than average because of this threat.

The repossession of a car might result in some inconvenience. The reposession of a dog will almost certainly result in severe emotional distress, especially since many people consider their pets to be their children. Not cool.

<comment><USER12> Even people that just rent them? I'm thinking that's a self-selecting demographic, that operates a little differently. They lack commitment for instance. Probably not terribly uncool after all.

<comment><USER13> People do get attached with time though. Especially when the emotions are high, which seems something the company selects customers for.

I remember when I was a teenager and my mother bought us a cat. Until she came home with it, my reaction was "why don't we spend cat food money on a better Internet connection instead?". After it started living with us, I attached to it very quickly and couldn't imagine it not being there.

(In fact, that cat died recently. It was a hard emotional moment for myself and my whole immediate family.)

<comment><USER12> I'm so not surprised about the internet part. Just from what I can learn from posts on HN.

We also have had cats. The boys are long grown and off, and there is a row of stones in the orchard representing valued family members Frekls, Salm and Francis.

</comment></comment></comment></comment><comment><USER14> >In another idea that never reached the market, he explored lease financing for funerals.

>"We like niches where we're dealing with emotional borrowers," Wunderlich said.

Well, fuck this guy. There is a clear difference in power and knowledge in the people offering, and the people taking, these loans.

<comment><USER15> Yeah, I read that and immediately said "yuck." to myself. What a way to prey on people. Yish.

</comment></comment><comment><USER13> Dog _leases_ , targeting "emotional borrowers", lease financing for _funerals_? What the hell did I just read?

That is literally the weirdest thing I found on HN this year...

</comment><comment><USER16> Man. On one hand, I like the idea of loans and leases, to help people who can't currently buy something get something they want. It gives greater access to products, which seems like a good thing.

On the otherhand, it seems like people just aren't responsible enough to deal with it. They're no the rational actors that my free-market economic paradise needs. :-/

<comment><USER13> Your free-market economic paradise could work without perfectly rational consumers if there weren't so many "entrepreneurs" out to exploit them :/.

</comment></comment><comment><USER17> tldr; read and understand what you're signing before you sign it.

 _Then, too, they would swindle you with the contract--and how was a poor man to understand anything about a contract? It was all nothing but robbery, and there was no safety but in keeping out of it. And pay rent? ...

So long as they paid, however, they had nothing to fear ..._ \-- Upton Sinclair, _The Jungle_ , 1906

</comment><comment><USER18> I'm not at all surprised that the person behind this is a fan of Ayn Rand.

This sort of predatory behaviour should be illegal.

</comment><comment><USER3> Every state I've lived in has laws requiring certain disclosures for leases and other disclosures for loans. Those disclosures include things like "you're entering into a lease" or "you're borrowing money."

</comment><comment><USER19> What a scumbag business.

<comment><USER20> On the scale of scumbag such as payday loans and auto title pawn and buy here pay here car sales and check cashing services, not really. There are dogs at the pound up for adoption as a market place alternative to pure bread puppies. There are not alternatives to food and potable water and heat and prescription drugs.

<comment><USER21> This is a very different kind of scumbag. This one is preying on customers in emotional distress (he actually says so himself!), and of course the threat of having your dog taken away if you don't pay up is a lot more emotional than most other forms of repossession.

</comment></comment></comment><comment><USER22> _"Also this cat is ruining my credit score."_

As all cats do one way or another :)

</comment><comment><USER23> I don't want to say it but I really want to slap Wunderlich's smug face.

This is disgusting.

</comment><comment><USER24> Wow, I think this is super crazy</comment>


Along the River During the Qingming Festival (painting, circa A.D. 1120) - <AUTHOR> https://en.wikipedia.org/wiki/Along_the_River_During_the_Qingming_Festival <comment><AUTHOR> This is featured (with scenes from the digital full-motion exhibit) in the "Golden Age" episode of Michael Wood's _The Story of China_ [0].

[0] [http://www.pbs.org/show/story-china/](http://www.pbs.org/show/story- china/)</comment>


Ask HN: Rate our startup - myHeatmap - <AUTHOR>

http://www.myHeatmap.com
Please let us know what you think of myHeatmap.  We are big boys, we can take it.
Also, please suggest any potential customer segments that could use myHeatmap. <comment><USER2> Why is it using Flash, despite seeming to be based on Google maps?

The square overlay on hovering over the map is rather impractical, since it seems to be fixed on an invisible grid that has a much lower resolution than the blobs on the heatmap. Worse yet, often the gridlines are cutting an important blob (e.g. Seattle) into half, making the data shown in the hover square rather useless. From a usability perspective, the obvious thing a user would want to do here is hover their mouse over a heatmap blob and see information specific to that blob, visually related to it (not a square that is halfway off).

</comment><comment><USER3> That is a really cool idea. I could easily see how it could be helpful to daily deals websites (groupon, livingsocial etc.) as it would allow them to see where they are getting traffic from and perhaps focus more on deals in those areas.

Also any sort of online marketplace would benefit from your services. They could use myHeatmap to see where most of their users are coming from and therefore figure out where they need to boost advertising.

<comment><AUTHOR> Thats partially how the site came about, we were looking for an easier way to make heatmaps that could: 1\. Be made without some large enterprise software solution 2\. Could easily be shared on Facebook or a blog with embedding 3\. Loaded fast & maintained integrity with zooming

<comment><USER3> It's a very good idea and I think with the right marketing and some good contacts it could easily take off and become a very valuable resource to many companies

<comment><AUTHOR> What companies came to mind when you saw the site?

<comment><USER3> well like i said earlier the first thing that came to my mind was websites like groupon and living social. Also, I think websites like Zappos or Newegg that are well known in certain circles but perhaps not as ubiquitously as they would like could really benefit from your services. For example, I know that in the Newark, NJ airport there are zappos ads in every security bin. I'm sure they would love to see a heatmap of how traffic from that area has changed since they implemented that ad. The heatmaps provide a simple and easy to understand visual aid that can really help explain whether changes have come about.

</comment></comment></comment></comment></comment><comment><AUTHOR> Clickable link: <http://www.myheatmap.com>

</comment><comment><USER4> How can I zoom in/out my heatmap?

<comment><AUTHOR> You should be able to use the normal Google Map zoom in/out slider on the left side of the map. It should work just like a normal map.

</comment></comment><comment><USER5> Prize Madness?

<comment><USER5> Suggest changing your twitter authentication first.... looks like it has potential should I have some geospatial data to use at some point.</comment></comment>


Losing a credit card due to automatic user behavior - <AUTHOR> https://jenny.berlin/2015/09/24/how-to-lose-your-credit-card-due-to-automatic-user-behavior/ <comment><USER2> As far as I can tell France universally uses "Flow A" (get your card back first, then your cash). When I started using ATMs, in the late 80s, I remember that "Flow A" and "Flow B" were about equally common, then in a relatively short span of time all the banks switched to A.

It surprises me, reading about it now, that it could be different in any other part of the world. That Flow A is the correct solution is not obvious, but it should be obvious to anyone who's studied human behavior and human error, which should be anyone involved in the design of ATMs. The form of "goal fixation" Jenny mentions is a very common pattern in human errors.

<comment><USER3> It surprises me that a flattened out workflow like [http://i.ytimg.com/vi/luu3_y2MWGQ/maxresdefault.jpg](http://i.ytimg.com/vi/luu3_y2MWGQ/maxresdefault.jpg) isn't widely used. There's a very strong 'default' use of an ATM, and the conventional workflow does not optimize for it at all.

<comment><AUTHOR> I guess a machine like an ATM has be usable by 100% of the population, including people who get easily confused by more than two options/buttons, so usability has to be sacrificed for simplicity to a certain degree.

<comment><USER4> My mother is like this. She is used to card-then-cash flow. Once she was using ATM abroad with me helping her (because it's in english). The moment card came out she turned to me with frantic face asking "where's the money?!?". She generally distrusts ATMs.

I once lost my card due to cash-then-card flow. And once left cash in card- then-cash machine. Bank did returned it though.

</comment></comment></comment></comment><comment><USER5> Bank of America switched years ago to "Insert card, remove card, enter PIN, take money, take receipt." Capturing invalid cards, while often done with early ATMs, turns out not to be all that useful as a fraud prevention measure. It's not required by the current PCI standard for ATMs.[1]

There's also an attack on ATMs called the "Lebanese Loop"[2] which requires that the ATM try to retain a card. So there's a security problem with retaining cards.

[1] [https://www.pcisecuritystandards.org/pdfs/PCI_ATM_Security_G...](https://www.pcisecuritystandards.org/pdfs/PCI_ATM_Security_Guidelines_Info_Supplement.pdf) [2] [https://en.wikipedia.org/wiki/Lebanese_loop](https://en.wikipedia.org/wiki/Lebanese_loop)

<comment><USER6> How would that work with modern chip-based cards? As far as I know, you cannot complete the payment at all if the chip is not available.

<comment><USER7> When using a Chip+PIN card in the US recently, I had to insert, remove, insert again, enter PIN, take card, take cash.

It took two of us two ATMs and about 15mins to figure it out ;)

<comment><USER8> Mostly off topic, but I can't seem to find the answer online:

Does anyone happen to know what the difference is between 6 contact and 8 contact chips? I have an older travel card that has 6 pads, and a recently issued card that has 8 contact pads. Are they inter-operable? I've only used the chip and sign twice so far, both with the newer card.

</comment></comment></comment></comment><comment><USER9> The author is mistaken about people always waiting for their money from an ATM. I've seen people take their card and leave the machine before the money comes out. I'm pretty sure I've done it myself at least once, when I was thinking about something else.

<comment><USER10> But generally the negative effect will be lower: You'll lose your money if there are people coming after you that are dishonest enough to take the money only. Otherwise it'll get pulled back in. You'll still have your card.

<comment><USER11> I'm not sure I agree. I'd much rather lose a card than money.

</comment></comment></comment><comment><USER12> In terms of ATM struggles for foreign visitors, Brazil really holds the record. The workflow requires you to insert your card twice (at least for Banco do Brasil). It goes like this:

Insert card -> Take card (no PIN entered yet) -> Choose account & amount -> Enter PIN -> Insert card _again_ -> Take card -> Take cash

Also, most banks in Brazil have ATMs that DON'T give cash right beside ATMs that DO give cash. The ones that don't give cash are meant for deposits, balances, payments, and transfers, but the GUI is otherwise identical, i.e., they display a cash withdrawal button even though they aren't equipped for cash! "If you then proceed with a cash withdrawal, the machine will hold onto your card for several minutes while making dispensing noises and finally return your card without giving any cash or receipt."[1]

[1] [http://brazilsense.com/index.php?title=Bank_cards_and_ATMs#L...](http://brazilsense.com/index.php?title=Bank_cards_and_ATMs#Look_for_the_word_Saques)

<comment><USER13> Wow, that sounds like a complete UX disaster!!! In Germany we also have machines where you can't get cash, but each machine usually has a sign that tells you what you can do with it and they also have different keyboards.

</comment></comment><comment><USER14> Unfortunately I can't provide a reference, but I distinctly remember reading that the user flow at German ATMs is specifically designed to minimize forgotten card incidents.

<comment><AUTHOR> Interesting, if you (or someone else) has any source for this, I'd love to read it! I'd say that _ALL_ ATMs should be designed to minimize those incidents though... :)

<comment><USER15> I actually had this exact thought. There's some good discussion on my UX StackExchange question about it: [http://ux.stackexchange.com/questions/23462/why-dont-atms- gi...](http://ux.stackexchange.com/questions/23462/why-dont-atms-give-you- cash-before-your-card)

<comment><USER13> Thanks for the link - there are some really interesting comments!

</comment></comment></comment></comment><comment><USER16> Some ATMs in Canada do make you take your card first before dispensing the money if it's not your last transaction. Others display a "Remember to take your card" message. Others have a beep and flashing light near the card slot.

There really is no standard.

<comment><USER17> For what it's worth, every ATM I've ever used here (a major city in the US) has made you take the card back before continuing the transaction.

That said, they've all used a "insert card -> remove card -> enter PIN -> perform transaction" flow rather than the "insert card -> enter PIN -> remove card -> perform transaction" flow mentioned in the article.

<comment><AUTHOR> Interesting! We've noticed the behaviour described in the article at several ATMs in Montreal. Maybe a Québécois thing?

<comment><USER18> That would make sense, as I have noticed the same thing in Québec City and was rather confused about it. For me, returning the card first makes so much sense that I wondered how people could implement this differently. A lot of people will grab the cash, their brains will subconsciously tell them "I have what I came here for" and they will leave - without their card.

I see really only one potential advantage for doing it this way: you can provide other transactions after dispensing cash. So you could get some cash and then _afterwards_ check your balance, for example, without having to re- enter card and PIN code. With the "international model", cash withdrawals are always the last transaction in the series as the card will always be withdrawn as part of the transaction. Nevertheless, I would judge this "convenience factor" as far less important as the protection against forgotten cards.

But maybe someone here works in the Canadian banking industry and has some clues? Maybe the recording of the withdrawal transactions works differently and the ATM needs the card for a short period after the money has been dispensed? I don't know...

<comment><AUTHOR> Yes, multiple (trans)actions in one session are a use case where it would make sense to keep the card until the end. I'd say it would still make sense to return the card before the cash and have the user insert it again - a small inconvenience for the few users that want to do multiple actions but probably a big decline in forgotten cards.

</comment></comment></comment></comment></comment><comment><USER19> Interesting, in the Netherlands almost all ATMs work in the same way as Germany, take the card first before it gives you the money.

However the other part about paying a lot in cash seems strange to me? And a fee on card payments while cash withdrawal is free if the exact opposite of my Dutch card. Paying in shops is free, cash withdrawal within the country is also free (not sure if all banks do this), but taking cash from an ATM abroad costs a small transaction fee.

<comment><USER20> The debit card of Berliner Sparkasse works that way (paying in shops and domestic, Sparkasse-owned ATM is free, taking out money abroad isn't). However, you can't pay too much with that debit card outside Germany, so they have this "travel pack credit card" – taking out money with it abroad is free (if the ATM allows it), but using it otherwise still incurs a transaction fee.

<comment><USER21> Don't forget the fee they take if your account and the money you withdraw are different currencies. ;)

<comment><USER22> Usually such German cards use the Visa/Mastercard foreign exchange rate for ATM transactions (no extra fee) and POS transactions (plus currency conversion fee, but no additional fee for using abroad).

<comment><AUTHOR> In Sweden (and possible in other countries) the ATMs let you choose whether you want to let the ATM (or bank that the ATM belongs to) do the conversion from Euro to Swedish Kronor or your own bank. If you pick the latter option, your bank might charge you for the conversion, I never had the case that the Swedish bank charged for it.

<comment><USER22> This is known as "dynamic currency conversion" and gives you a much worse deal than letting them charge you in a foreign currency (even when your bank has high fees). The way they do it is by offering a really bad exchange rate. In fact, the Swedish bank charges you for that, it's just hidden in the exchange rate.

<comment><AUTHOR> Oh really? I never bothered to check the exchange rate. Good to know, I'll let my German bank do the conversion from now on!

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> One solution to the problem of user flow A vs user flow B is to dispense the cash and return the card _simultaneously_ and _together_. The "together" part is admittedly difficult to engineer but perhaps the card slot could be placed just above the cash dispenser, so both are in your line of sight.

<comment><AUTHOR> Good idea! If both the money and the card could be taken in the same movement, that would make it very convenient.

</comment></comment><comment><USER23> I went to Japan a couple of years ago and one of the ATMs we used had an internal conveyor system of some kind, which resulted in it ejecting the card with the cash and receipt simultaneously from the same slot. I've always wondered why those weren't more standard, it seemed much more efficient.

<comment><USER24> Most Japanese machines I've encountered would also throw a fit and beep and yell at you if you left something in a slot for more than a second. I don't recall any German ATMs audibly remining my of my inefficiency.

</comment></comment><comment><USER25> I lost my (German) credit card exactly the same way in Bangkok. Unlike the author, I never received my card back and had to order a replacement card, which takes ages to ship to the other side of the world. Never travel without a second credit card.

</comment><comment><USER26> Hey, could you share some information on how do you make those awesome graphics? :)

<comment><AUTHOR> My girlfriend (the author) is out hiking right now. :) She uses Illustrator and Sketch AFAIK. You can see more of her work on her profile: [https://www.jennylettow.com/](https://www.jennylettow.com/) Feel free to contact her via email to ask for details!

</comment></comment><comment><USER27>
        Website is offline
        No cached version of
        this page is available.

        Error 522
        Connection timed out

I'm commenting because I want to come back and find this later, but I don't want to upvote without reading, and I don't have a unified bookmark list, so bookmarking won't help if I subsequently use a different machine.

 _Edit: Now read it - thanks for the cache reference_

<comment><AUTHOR> Sorry for that... working on getting it back up right now!

<comment><AUTHOR> And we're back!

<comment><USER11> Not for long it seems.

<comment><AUTHOR> I had to take down the server for a minute to install a WP caching plugin, it should be back up soon!

</comment></comment></comment></comment></comment><comment><AUTHOR> I had to take the server down for a minute to install a caching plugin... check back soon!</comment>