Credit card fraud warning signs - <AUTHOR> http://www.candyjapan.com/fraudulent-transaction-warning-signs <comment><USER2> CC fraud is such a big problem, it must be a huge advantage for Amazon. Most of their purchases come from repeat customers that they can be confident exist. Smaller shops have to figure that out nearly every purchase.

I never thought of that before. Maybe there should be a central shared central repository of who are known good customers/address/cc combinations, or maybe that is what stripe etc do already.

<comment><USER3> Services such as Stripe and PayPal indeed serve as central repositories for fraud intelligence. I imagine that other payment gateways also provide a similar function, though those two are the ones I'm personally familiar with. We've operated a small ecommerce business for almost 8 years and although PayPal fees are probably on the high side, fraud has been a non-issue for us.

<comment><USER4> > PayPal fees are probably on the high side, fraud has been a non-issue for > us.

It should he an issue for you. That is because PayPal is stopping a lot of payments with false positives. I live outside US and using PayPal is generally a pain in the ass.

<comment><USER3> Hmmm... that does sound interesting. Might you have any hard data to back this up?

If it's true I'd expect that we'd get alot more complaints from customers that their cards are being rejected.

<comment><USER5> Would a customer complain to you because of a paypal doesn't cater to them ?

In particular, credit card setings are multi-step and all done on the paypal site, I wouldn't imagine going back to some merchant site to complain about that process.

<comment><USER3> I would imagine that at least some would, given that they're interested enough in the product to initiate the checkout process.

In the absence of any hard data on this, I'm writing it off as nectodal.

<comment><USER4> > In the absence of any hard data on this, I'm writing it off as nectodal.

The Internet is full of this stories from people with good karma. Just look for it on Internet. Probably you are from one of the few countries where the experience is different.

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> I periodically deal with recurring fraud from what seems to be a pretty organized network.

\- Orders are placed with stolen credentials with correct billing info that matches AVS.

\- Shipto address are located near billing info, typically in the same state/metro area.

\- They are often rural addresses, trailer parks, what appear to be rent houses that may be empty.

\- Phone number provided has correct area code and rings a call center that has stolen billing info available and will confirm billing address order details verbally.

\- Ip is geolocated at/near the billing info area via a proxy.

\- Email addresses are often setup on custom domains.

We catch them, but only because they don't vary the pattern much and we know what to look for. I don't know how fraud tools would be able to effectively filter in these cases without a lot of false positives.

<comment> move-on-by As someone who uses a custom domain email address, this makes me sad

<comment><USER6> I didn't mean that a custom domain is an indicator. Just that they go to the trouble to register throwaways for this use and it isn't limited to just free email services.

<comment><USER7> >I didn't mean that a custom domain is an indicator. Just that they go to the trouble to register throwaways for this use and it isn't limited to just free email services.

Yeah, I'd assume someone with a email@example.com email and a web presence is probably an indicator it's legit rather than fraud :)

</comment></comment></comment></comment><comment><USER8> Fraud prevention can also be extremely annoying to customers when not done correctly. I've yet to be able to buy something from newegg without them cancelling the order saying its fraudulent. I'm not sure why they still continue to flag my orders considering I've contacted them every time and they've ended up authorizing it. At least now they don't immediately blame my credit card...

If it was a smaller company and more of an impulse buy I could see a bad system definitely hurting sales. I'd probably not order from newegg again if they weren't one of the few places that ship harddrives correctly and have reasonable prices.

<comment><USER9> Years ago I used up my free digital ocean credits, wanted to start paying. They asked for more details which I provided, then asked for my facebook profile. A pretty unusual request, but I complied. They told me the names don't match up and just won't deal with me anymore. Literally gave me no obvious way to proceed. Felt pretty violating to give up personal info just to get brushed off.

Happily used AWS ever since.

<comment><USER10> Why didn't your names match?

<comment><USER9> Had it in the diminutive form. As in Deb instead of Deborah, pretty common in my home language.

Wish I could remember what the first step was, think it was pretty informal too, but can't be sure. Just remember feeling dumbfounded they wouldn't simply come back with another option.

</comment></comment></comment></comment><comment><USER11> In Germany we have a system called 'giropay', which is basically instant wire transfer via your online banking. With this system the merchant gets a guarantee from the consumer's bank (as it seems, but I am not sure who in the pipeline eats the cost, as the contracts are ask-only), so that even if there was fraud, he will not loose the money. This does limit it to 10k EUR per transaction, which should be enough. The merchant receives the money within 2 bank days in his account, and the max fees for the merchant are 0.89% with a minimum of 33ct, but volume discounts seem likely.

What I don't understand, is why the US was not able to set such a system up, but I assume it's related to the general distaste for chip+pin, as well as any sensible security mechanisms for online banking. Yes, pushTan and mobileTan are usable, but they only work if you have a phone you trust with the deductible applicable in case of pishing, or, if you have actual reason to not trust it, the daily online banking limit.

<comment><USER12> Banks and credit card companies in the US have a vested interest in ensuring that credit cards are used to purchase goods and services on credit. In 2017 total credit card debt in the US was ~$941 billion.[1] At an average rate of 15%[2] that's $141 billion per year that banks make on credit card debt interest (not counting interest on interest and fees).

[1] [https://www.nerdwallet.com/blog/average-credit-card-debt- hou...](https://www.nerdwallet.com/blog/average-credit-card-debt-household/)

[2] [https://www.creditcards.com/credit-card-news/interest- rate-r...](https://www.creditcards.com/credit-card-news/interest-rate- report-081413-unchanged-2121.php)

<comment><USER13> How much of the credit card debt has been paid off within a month?

</comment></comment></comment><comment><USER14> I love the artwork behind the article: [https://www.candyjapan.com/static/credit-card- fraud_s.png](https://www.candyjapan.com/static/credit-card-fraud_s.png)

</comment><comment><USER15> I like how the author doesn't immediately reject orders if they have just one sign (IP address country different from shipping country, shipping to a reshipping center, etc.) but looks at all the indicators as a whole to make a decision.

Edit: isn't this how Stripe Radar[1] works?

[1]: [https://stripe.com/us/radar](https://stripe.com/us/radar)

<comment><USER16> From my experience, nothing drives users away faster than a false positive on a fraud check. You immediately lose all trust in the eyes of the users.

<comment><USER17> Yeah, but that's something you have to accept for the positive benefits. In a lot of online businesses, credit card fraud is just insanely rampant. You lose a lot more money by not doing checks with the occasional false positive than you do by not having it.

The cost of fraud is chargeback fee (usually ~15 bucks) + merchandise. It gets expensive fast. Every modern e-commerce business has to be fighting it now to stay alive. For certain SaaS / Software products the cost of failing to fight it is a tad lower, but for physical products it's killer.

<comment><USER16> Sure, you can't ignore fraud.

We have _a lot_ of those each months.

What is more important is to have a smart way to detect the frauds. Most clients that had received false positives never came back even with discount codes and apologies. Nobody likes getting stuck on a checkout page with an error message telling them they are in the wrong.

<comment><USER18> One way to optimize is to maximize expected revenue - expected cost of false positives or fraud.

A savvy business will know (or can estimate): customer lifetime value, false/true positive/negative rates of their fraud detection system, rate of charge-backs, expected rate of fraudulent purchases, revenue from given suspected transaction.

If average discounted customer lifetime value is $10k, charge-back rate is 2%, your fraud detection false positive rate is 0.1% and true negative rate is 99.9%, fraud detection true positive rate is 95% and false negative is 5%, customer is purchasing a $20 item. Then

* expected revenue if purchase is fraudulent: $0 * (true positive rate) - $20 * (false negative rate) = -$1

* expected revenue if purchase is non-fraudulent: $20 * (true negative rate) - $10k * (false positive rate) = $9.98

* total expected revenue value (with fraud detection enabled): (expected revenue if purchase is fraudulent) * (rate of fraudulent purchases) + (expected revenue if purchase is non-fraudulent) * (1 - rate of fraudulent purchases) = $9.7604

Without fraud detection, your expected revenue is: $20 * 0.98 = $19.6

Simplifying assumptions: false positive results in complete loss of customer value (realistically, replace this with big drop in customer lifetime value). Fraud rate is constant (realistically, should be modeled). Fraud rate is charge-back rate.

In this case, it's easy to see that seemingly low 0.1% false positive rate is still too high for this small of a purchase and these customer lifetime values. The 'smart' decision would be to ignore fraudulent purchases of this size in this case. (for this scenario, you need FPR below 0.004% with all else same)

Better model still would be a fraud detector that outputs a confidence score rather than "yes/no", and use the formula above to determine if the predicted false-positive-rate at this confidence level is sufficiently high to expect a revenue uplift from enabling the detector.

</comment></comment></comment></comment></comment><comment><USER19> My old employer, a phone retailer, would check how long the user had been browsing the site and what they looked at.

We noticed that legit customers tended to take their time on our site. They would look at several pages and not immediately add something to the basket and checkout.

Of course, some legit customers would demonstrate the same pattern particularly when a new phone was launched - but that wasn't too common.

So if the user spent less than five mins on the site before checking out, or if they only looked at one product page then that order would automatically be flagged for manual review. 60% percent of those orders were rejected.

</comment><comment><USER20> Overagressive fraud protection can lose customers as well.

I placed an order to be shipped to my new address from a merchant I'd ordered a dozen times before for home and work. 2 days after the day the order was supposed to ship, they suddenly canceled it due to "security reasons".

I've stopped using that merchant.

<comment><USER21> Reminds me a lot of massive email validation regex: [http://www.ex- parrot.com/~pdw/Mail-RFC822-Address.html](http://www.ex-parrot.com/~pdw/Mail- RFC822-Address.html)

<comment><USER22> Can you explain the relationship?

Also, the regex is longer than the (reasonably clear) code[0] which generates it…

0: [https://metacpan.org/source/PDWARREN/Mail- RFC822-Address-0.3...](https://metacpan.org/source/PDWARREN/Mail- RFC822-Address-0.3/Address.pm)

</comment></comment></comment><comment><USER23> Reshipping centers, I don't want to sound weird, are basically hives of scum and villainy in my opinion.

I was selling something Ebay (a phone) and I got a really weird address, it was a shipping center.

I googled around because I got a strange vibe, apparently, this shipping center had this issue all the time and didn't really care to stop it. I got a horrendous review from the person because I canceled the order and refused to ship it.

I am wondering if fraud is honestly the business model of shipping centers. I can't really think of a good use for them nowadays, especially in a consumer context.

<comment><USER24> I use reshipping centers a lot, even if the store ships internationally. There are two main reasons:

1 - I may buy a lot of things from Amazon. It's cheaper to pay US shipping for X times (sometimes they are free) and only one international shipping to my country.

2 - Customs taxes, etc. The company I use for reshipping takes care of everything. I pay them and they deliver the items to my house at the time I ask them to do it. If not, due to the policies of my country customs, I would have to attend a custom office for every item I purchased, which is a pain in the ass.

Don't discriminate us, please.

<comment><USER25> Do the reshippers actually pay the duties to the countries or do they just pretend like you don't need to?

<comment><USER24> They pay but it is included in the price I pay to them.

</comment></comment></comment></comment><comment><USER26> > Using an inconsistent and unlikely email address [...] By "unlikely" I mean > one that no reasonable person would want to have, usually containing a big > batch of numbers in it.

This is awful.

I create random e-mail addresses for every online merchant I have to interact with. It's by far the best way to avoid both real spam and "promotional message" spam.

I don't even use my "real" domains, because anybody who knows my name and the domains I use can construct my personal e-mail addresses. I have special domains dedicated to online commerce, and they look pretty random.

<comment><USER27> If you go out of your way to appear fraudulent, you can't be angry when you get flagged as fraudulent.

What do you want merchants to do? It appears you have gone out of your way to make sure all your information is completely unconnected to you, which is exactly the case for someone committing fraud.

<comment><USER28> "All of your information" is a bit over the top don't you think? It's just an e-mail address. It's not relevant to anything. The important info is address and name.

I have the same system. It achieves 100% reliable spam protection with zero false positives and zero false negatives. It's a perfect system, if I follow some basic rules. It also eliminates phishing, except in case of unannounced data leaks. I mark e-mails received from random e-mail addresses I generated in the past with green color, so it's immediately obvious what is legitimate and what is not.

It'd be a bit ironic if someone would think that I'm a fraud, because of this system that is designed to protect me from fraud. :D

Never had an issue with businesses accepting my addresses, except one person looking at me strangely, when I was opening a bank account with a random email address, when I told him that no, I'll not repeat the address to him. :)

All the person on the receiving end has to do, is open the email address domain in the browser, and there's an explanation what's up right there.

If I were a fraudster I'd make an address that looks perfectly ordinary. It's so weird for someone to assume that weird looking address indicates fraud.

<comment><USER27> > It's so weird for someone to assume that weird looking address indicates > fraud.

I mean, they aren't assuming that... they are basing it on data. They have lots of data on fraudulent purchases, and apparently that is one of the indicators.

</comment></comment></comment></comment><comment><USER29> Some companies today offer a fraud prevention solution which is covered, meaning they will pay the merchant for whatever fraud transaction that slipps through their systems. These companies employ pretty sophisticated methods as this is their core buisiness. I work at one such company, Forter. We take pride at the fact that we approve more than the others would, and we take complete financial responsibility for our mistakes so merchants just don't have to deal with it...

<comment><USER30> Paying for fraud that slips through should be the easier part.

Do they compensate for lost business because of false positives? The problem is that even the wannabe seller cannot quantify it.

At several occasions I have not been able to order something online, because they would not accept my card.

</comment></comment><comment> a-dub Now that everyone has smartphones, I wonder if you could do something with the camera... like require a photo or video of the physical card in front of some visual token on the screen for orders that don't ship to the billing address on file...

</comment><comment><USER31> You would think with the amount of value / fraud at stake, Visa/MC/AMEX themselves would invest in fraud detection technology and offer that as a service to their participating banks and merchants.

They have so much more volume and cost absorption capability that they could spin up a much more talented / sophisticated detection group than any individual bank or merchant could, you would think? And charge for it accordingly?

<comment><USER32> Visa/MC/AMEX make a MASSIVE amount of money on Fraud - it's in their interest to perpetuate it. I've experienced this myself with > 6 figures in CC fraud in a month. Here is the financial break down:

Every time a customer gets a charge due to Fraud, they file a chargeback. If we are able to contest it, all is well, other wise they hit you with a $25-$35 fee PLUS the charge is reversed so depending on margins you are out you're costs on the transaction as well.

If the # of fraud transactions gets bad enough (even if you are working with them diligently to get things under control) and not able to stop it, they will charge you a chargeback penalty fee.

This essentially says you are high risk and so now give us 50,000 or 100,000 dollars or you can't accept credit cards AND you have X days to resolve this and get you're charge back rate to a reasonable level or we will hit you with another charge bigger charge in 30/60/90 days or whatever the risk management department wants.

They may also come back and say now we've told your processor (stripe, braintree, etc) that THEY need to charge you more because we are charging them more to deal with you. So instead of 2.5% of each transaction they are getting 3% for example.

It all adds up to billions across the world economy, it costs them only to deal with it administratively and they are collecting many many times that in fees from the merchants. It is very much a scam and the average customer doesn't realize the massive hit companies can take for the convenience of Credit Cards.

<comment><USER33> as far as I know, chargeback is always at least $35, even if merchant wins. Big retailers might be able to negotiate this.

</comment></comment></comment><comment><USER34> I've had a case of someone walking into a Verizon store and buy 4 new iphones and charge it to my account. The amazing thing is that between phones, tablets and hot spots, my family has 7 mobile devices. The perpetrator did not upgrade any of the existing phones, but created 4 new phone numbers. This should have been a huge warning sign. I'm 100% convinced that the person at Verizon was in on this. In addition, over the next few days, they've made thousands of dollars in international calls. To Verizon's credit, they were great at resolving the mess for me as an individual customer, but in the end they ate the cost, which means that it got diluted to all the customers.

</comment><comment><USER35> I find it strange that the de-facto thing to do for fraud is to simply not accept the order. Why not report the fraud to authorities instead?

<comment><USER36> Fraud falls into a weird category of crime where:

\- happens globally (far outside of local police jurisdiction)

\- per event small monetary value

\- widespread but difficult to tell how connected (is it tens of thousand of fraudulent events from a single actor or tens of thousands of different actors?)

All of which adds up to there not being a clear cut law enforcement agency to handle these types of things (aka you can't reasonably ask the local police to help you track down a scammer in singapore).

<comment><USER37> Yeah, essentially no local law enforcement is going to care about some guy successfully scamming you for a $100 chargeback. We were basically told not to bother for anything under $25k from a single actor, and even for amounts over that I think we only managed to get law enforcement action through personal contacts.

I think the one case that law enforcement did act on was a group that was using a newly built neighborhood as a drop point for stolen goods. It was complete enough that there were addresses to ship to, but nobody was living there yet, so it was easy to just pick up packages off the front steps. From what I heard, the police ended up picking up some guy with a truck full of iPods who was just going house to house picking up the deliveries.

</comment></comment></comment><comment><USER38> The bad part of credit card fraud is that the card network, issuing bank & gateways pass on the liability to the small merchant. There is always a looming risk of losing your account & business due to excessive fraud, something over which you have no control at times. If you become over aggressive with fraud protection, you risk not only losing revenue but pissing off genuine customers.

Your gateway would tell you that as a merchant, it's your job & responsibility to accept a charge & related risk of fraud. Well, if big guys handling billions of payments can't catch fraud, it's quite easy for a small guy to miss it as well.

When you are selling a digital product, it's very difficult to win a chargeback. Some low level bank employee hardly cares about your meticulous documentation & proof that you delivered the product.

3D secure is one way to shift liability to issuing bank but it only works for the first charge (not recurring subscription). There are lots of reasons for getting hit by incorrect chargebacks e.g. mistake on part of a customer because they didn't recognize, customer's card getting stolen midway during a subscription, unhappy customer who wants a refund after using your service for months etc.

I wish the industry would side with the merchant as well at times i.e. maybe a rating system to see how easy is the merchant's cancellation / refund policy etc.

</comment><comment><USER39> You know... there is one entity that is reasonably well funded, has incredibly strong capabilities for card fraud detection, and is well motivated to identify the fraud: the credit card companies.

(I work for one, which makes me especially interested in this topic. But I don't work in that particular area, nor do I speak for my employer.)

It makes me wonder whether some sort of collaborative fraud detection might be possible. As the merchant, you have access to additional information that the credit card company lacks -- things like the customer's name and the delivery address are (as this article explains) very helpful in detecting fraud, and these are data that the credit card company does not have access to. And of course the credit card company has access to information like the customer's purchase history and their recent transactions, which are useful for identifying fraud from a different direction. If both sources of data were available, it might be possible to detect a higher percentage of fraudulent purchases, and merchants who ship goods could be provided with the information so they could delay or cancel the shipment.

Do you think merchants would be interested in such a program?

<comment><USER40> Would merchants be interested in my purchase history? Yes.

Would I want/trust merchants to have this information? No.

<comment><USER39> Oh, I'm fairly certain that the information sharing would only go one direction: the merchants would share the data to the credit card companies, who would run fraud models on it and provide near-real-time feedback to the merchants.

In terms of user privacy, this gives the credit card information more information than they already have access to. It is reasonable to worry about the privacy implications of that sharing. But to be honest, the credit card company already knows a great deal just from processing the customer's purchases. Adding in the delivery address (when it differs from the card's billing address) is a leak of personal data, but not a huge one. Additionally, we might be able to put in place contractual controls limiting the data to certain uses. I can assure you (from my own experience), credit card companies are well experienced at compartmentalizing data and limiting data sharing.

</comment></comment></comment><comment><USER41> If you really care about your customer you should be worried about false positive. I hope as a business you do not cancel customer orders because your fraud detection system has flagged them.

Depending on your scale you may using 3rd parties like Sift science, Stripe Radar or Roll your own fraud detection system.

Flagging orders as potential fraud is the easier part these days. The difficult part is how to come up with a process to verify these flagged orders. This process need to be simple and quick. Because essentially you are saying to your customer we think you are a fraud and can you prove that your not.

Banks merchant checks to verify flagged orders is extremely cumbersome. They require you to call a special phone number (which is different for each bank) provide customer Name, Billing Address, Billing Phone and Credit Information. Then they can only give you a response whether it is a match or not. They can't tell you whether it has been reported stolen or anything else for privacy reason. At scale this is a very time consuming process. It becomes even more cumbersome if you are security conscious business and do not store customer credit card information. In that case you have to communicate with the customer asking them to call you to provide your credit card information again.

There are solutions like 3D Secure but they are not widely supported and adds its own problems. It is high time credit card companies start providing merchant with a 2nd factor check for transaction. For example maybe once a transaction is placed with a merchant. They can trigger a 2nd factor check where by the bank automatically send a code to their email/phone number on file. If the customer is able to provide a correct code merchant can proceed with the order.

Fraud detection will always remain a point of contention between customer and businesses. I just hope business make sensible decision based on their situation. For example I have seen legitimate customer with all the above cases mentioned in the article.

<comment><USER42> Reading all of these issues I'm really flabbergasted that you have such issues. Like, my bank offers me temporary non-physical credit cards with small limits for 1€/month/piece and that's what I use to do all my online purchases with, do US banks really not have that option? Second thing that I often use (where possible) wire transfer, it requires my ID-card and the payment is done in seconds.

This thread has honestly made me really appreciate what I have available to me compared to some countries.

<comment><USER43> Very few banks have that option, and the ones that do are bordering on user hostile, and the temporary cards don't have usable/tolerable features for this.

A wire costs $50-100 (or more for international) per transaction, no matter what the amount.

A bank transfer (ACH) can take several weeks or more depending on how much both banks trust each other and the type of account you have. Here's a fun read: [https://engineering.gusto.com/how-ach-works-a-developer- pers...](https://engineering.gusto.com/how-ach-works-a-developer-perspective- part-1/)

</comment></comment></comment><comment><USER44> Today my bank detected a fraudulent transaction on my CC. They blocked the transaction right away and cancelled my card after confirming it with me... so they probably can prevent a lot of these cases. Very interesting article nonetheless...

</comment><comment><USER45> My wife had to learn just about every one of these lessons the hard way in the first few years of running her own (small retail) business. In retrospect, we should have posted the hard-learned lessons online. I'm glad this person did.

</comment><comment><USER46> > Later on when the post attempts to deliver it, they will at some point > realize that the country is wrong and reroute it to the correct country

Will they? Or will they return it to sender with a bad address note? Would the rates be different by country?

<comment><USER47> I recall we once sent something from the Netherlands to Canada, but didn't include the country. We later got a surprised email by the recipient that they received the mail despite it not including the country.

I suppose the post office decided to do some digging and managed to deliver correctly.

<comment><USER48> I'm pretty sure my domestic package to Newfoundland ended up in your country, and then back.

My buyer reports it isn't the first time that's happened to him.

</comment></comment></comment><comment><USER49> If fraud is such a problem for stores would it make sense to offer a discount for payment methods like bitcoin that don't allow chargebacks? This could reduce the cost of doing business by gaurenteeing payment.

<comment><USER50> This is an excellent idea to prevent revenue loss caused by false positives, which are rampant IMHO.

It's beyond me why so many merchants opt for the revenue-losing and customer- hostile choice to silently cancel flagged orders and let their competitors run away with the money, while they could easily get a safe sale by making a non- negotiable offer to use an irreversible payment method when a credit card gets flagged.

This reverses the trust issue, it's then up to the customer to determine if he trusts the merchant enough and is willing to give up the additional protection that a purchase on a credit card may offer - some of which the merchant may offer instead - to get the item he wants.

</comment></comment><comment><USER51> > Two bonus signs for the end. You can use a Geo IP database to check if the > shipping address country differs from the IP address country. That's a weak > sign (people do place orders while traveling, or to friends in other > countries), but can break the tie if there is another suspicion.

You can add to that using the first few digits of the credit card to look up the card issuer. If the card is from a bank that does not have a presence in either the region the order is coming from or the region it is being shipped to, that order probably merits a closer look.

<comment><USER52> I kept getting flagged for that kind of thing, had to start using a proxy to make my actually legitimate purposes.

Though looking at it from the other side, using a proxy should probably count against you a little.

</comment></comment><comment><USER53> So if you see one of these warning signs, what should you do?

What if it is a legitimate order? You don't want to turn down a real customer?

I presume if you try contacting the person and asking them if it is a fraudulent order, they will deny it. (I suppose if you can't reach them, that is good enough indication to cancel the order as fraudulent.)

Can you call the credit card companies or payment processors and ask them to do their own fraud checks to see if it is okay, or are they going to leave you on the hook if it still goes bad? (I suspect the latter.)

</comment><comment><USER54> I cannot imagine running a bunsiness where I ship things ot people for money without doing address verification. In the mid 90s one of my first database related jobs was parsing the complete US address list we purchased from the USPS and comparing it to our internal mailng list - the process has gotten much simpler over the years.

This would have prevented 3 of the problems on this list, and would also result in a much lower rate of failed deliveries (expensive)...

</comment><comment><USER55> When you accept credit cards, how long do you have to wait until you know the payment went through? Could you simply wait that amount of time for every order?

<comment><USER56> Typically chargebacks can happen for 90 days. No one is going to wait that long for you to ship.

<comment><USER57> I guess that's exactly why the period is so long: they force the merchant to ship before and take that risk.

</comment></comment></comment><comment><USER58> Run an e-commerce business that sells tires.

It seems that a common pattern that's arising is for a bad actor to use a foreclosed property or rental to ship to, within spitting distance of the billing address, then have the carrier redirect to a pickup store, such as the Fedex store.

They have absolutely no problem walking into the store and signing off, all on camera. Troubling times.

</comment><comment><USER59> I work with Signifyd. We are expanding and hiring more Data Scientists and Fraud Analytics ninjas. Apply through the website. We do care about approving good orders while stopping fraudulent ones. In case of a chargeback, we guarantee it.

</comment><comment><USER60> Doesn't Stripe cover some / most of this?

There are some settings, or at least an overview in the dashboard where you can see if the address was verified and it matched the one on the card. Using billing / shipping address in your order form is obviously for this reason.

</comment><comment><USER61> I'm fine with fraud detection like this, but probably 90% of my ordering is a credit card, through a VPN, or sometimes from a foreign country, shipped to a freight forwarder, with a VOIP PSTN number. There have to be ways to get around this for false positives.

<comment><USER62> There are. Mail you government ID to small business owner that will probably leave it on some vulnerable windows xp machine.

</comment></comment><comment><USER63> The payment service I use (Pin Payments) can include a random value in the payment card narrative, allowing you to hold delivery until the cardholder authorises dispatch with the correct code.

</comment><comment><USER64> A velocity report is the only real way of pro-actively catching fraudsters. something like ip address by alias or something similar.

</comment><comment><USER65> > One time when I tried googling for an address, I found that the person was > also active on a forum for trading stolen credit card details. That was a > bad sign

Ha. You don't say!

</comment><comment><USER66> I have a genuine question that is kind of unrelated to this discussion:-

What is special about Japanese candy? Is it the packaging? The ingredients?

</comment><comment><USER67> naive question: Why should merchant be worried about this? Isn't it responsibility of CC company to back up the promised credit? If someone unauthorized used someone elses CC then shouldn't CC company swallow that loss?

<comment><USER68> No. CC companies protect the customer from fraud, not the vendor, unless you have really good proof the customer isn't right a chargeback means you loose the money and often pay a fee on top. + if you are the source of to many chargebacks, they'll drop you entirely.

</comment></comment><comment><USER55> Another Problem that goes away with crypto currencies.

<comment><USER69> This seems like a variation on the Zawinski Quote -

Some people, when confronted with a problem, think "I know, I'll use crypto currencies." Now they have two problems.

</comment></comment><comment><USER70> Don't roll your own crypto, don't roll your own fraud prevention.

Stripe include very sophisticated fraud prevention in their standard pricing and charge pennies per transaction if you're on custom pricing. Numerous third-party providers offer excellent fraud detection and prevention tools for CNP transactions. Unless you're big enough to have a dedicated fraud prevention team, just leave it to the professionals.

<comment><USER71> Stripe fraud prevention is not sophistocated at all. I have been trying different fraud prevention providers and all of them are lame. They check if the ip of the buyer matches the billing location of the card and if not they will not accept the order. So far, the best method I have diwcovered is to verify the order by phone. The phone number provides me with extra knowledge about my customer. I can match their buying ip address with it. I can talk to the customer in their language to verify they are who they say they are. It is not bulletproof but I have yet to see fraudster go to that extend.

When you learn enough about your customers, you should be able to roll out your own fraud prevention solition because generic ones are broken. Here is a recent report about what works and what does not in the generic fraud prevention tools: [https://www.braintreepayments.com/resources/kounts-mobile- pa...](https://www.braintreepayments.com/resources/kounts-mobile-payments-and- fraud-2017-report)

<comment><USER17> Those graphs are entirely survey-based subjective, there's no metrics at all, and it's also an advertisement for Braintree's fraud service

<comment><USER71> Look at the original report that the graphs are based on. I think that's where the useful data is.

Braintree's fraud prevention is poor and based on generic metrics. One of my businesses had 32% chargebacks with their service.

<comment><USER72> Curious what kind of products do you sell?

<comment><USER71> Software for backing up sites.

</comment></comment></comment></comment></comment></comment><comment><USER73> A better approach to writing this article would be to gather a wide array of customer features, fit a model using training data from actual fraudulent/non- fraudulent orders, and then interpret the model to explain the features actually connected to fraud.

My guess would be that given there's no reason to believe a particular functional form or additivity of effects, a random forest would likely be the most effective classifier, but ultimately I'd just go with whatever empirically does best on the test set.

As-is the article is basically a pretty naive approach to feature engineering a few features that may or may not ultimately be useful in the real data. It's a cute anecdote, but hire a data scientist.

</comment><comment><USER74> Slightly off-topic, but last time CandyJapan made it onto HN, I decided to sign up and give it a try, and was very underwhelmed. I canceled after two boxes. Hey each contained 3-4 candies, and over half of them were very basic candies such as chocolate. In total I think only a single one was the "cool" kind of candies you associate with Japan. Honestly in the ~8 candies I tried, not a single one was even really edible or interesting.

Also, I'm not sure how much of this is their, but a lot of the candies had also melted and re-solidified into a single chunk.</comment>


Tapefailure closing for lack of funding - <AUTHOR> http://mashable.com/2007/12/19/tapefailure-shut-down/

<comment><USER2> Lesson learned: never have the word FAILURE as part of your business name!</comment>


[Challenge] Sorting algorithm with constraints - <AUTHOR> Sort a (linked) list of integers, min to max.
1. You're only allowed to compare the first and second elements.
2. You can swap the first and second elements.
3. You can move the first element to the end of the list.
This was an interview question and supposedly isn't on the internet anywhere. Here was my attempt: https://play.golang.org/p/_hsRXFFkNl and the line-by-line output: http://pastebin.com/raw/c2wZSEpR <comment><USER2> You cannot define an algorithm given this specification. (ie. you cannot determine when to stop).

Take for example the list (1 2 3 1 2 3 1 2 3) with min=1 and max=3. Notice that there is no operation giving you the number of element of the list, and no operation giving you access to the elements of the list: you cannot copy elements to a temporary storage, or replace one element for example with a guard value such as min-1.

Therefore you can only call compare, which tells you whether the first and second elements are in order or not, and from that you can only swap or not. Then to make progress, you have to rotate. You can count the number of rotate and the number of swaps, and if you knew the total number N of elements in the list, you could say that after N-1 negative compare your list is sorted.

But since you don't know N, you cannot stop. Since you cannot read the elements of the list, you cannot even know that you've reach one of the min (if you knew N you could know that even without reading, by noticing that you always had to swap to keep it, but you don't).

Your code cheats, since it's use the length of the list (it's not one of the three operations allowed).

<comment><AUTHOR> Yeah, I'm aware of the cheating by calling the length. I couldn't figure out a different way.

I agree with you. This actually was not from my interview. A friend said he was interviewed over the phone with this question and posed it to me. After he first told me it, I assumed he misinterpreted it; I sent a bubble sort. Then he got defensive and insisted on the interpretation I re-wrote in the OP. I wasted a lot of time brute forcing it on paper before I could find a pattern, and still couldn't figure it out without knowing the length (and therefore traversing the list past the second node).</comment></comment>


Why the GNU Affero GPL - <AUTHOR> http://www.gnu.org/licenses/why-affero-gpl.html <comment><USER2> The AGPL makes straightforward commercial sense (we use it for our open source product, Flint).

It keeps your code bona fide open source, so people who want to use and extend it noncommercially can do so without worrying about you at all; the code is genuinely free.

At the same time, it means that people who would attempt to commercialize your code must at least do so on a level playing field with you. They can't take your code, improve it, and withhold those improvements.

AGPL is much better than a "noncommercial" license, because code that can't be used commercially isn't open. "Noncommercial" licenses are deceptive; they suggest that you have an incentive to improve other people's code, but really you can only benefit the owners. And it's better than the BSD license, which fails in exactly the opposite direction.

People who are reflexively anti-GPL tend not to know much about the security software industry, where intense VC funding and rafts of "me-too" products have plagued the major open source projects (Snort, Nessus, etc). If your code is ever going to really be worth something, and you MIT/BSD it, expect someone else to make a lot more money off it than you do.

<comment><USER3> "People who are reflexively anti-GPL tend not to know much about the security software industry, where intense VC funding and rafts of "me-too" products have plagued the major open source projects (Snort, Nessus, etc). If your code is ever going to really be worth something, and you MIT/BSD it, expect someone else to make a lot more money off it than you do."

..and here I thought the GNU was about freedom and helping your fellow man. Instead, it's about preventing someone from "making a lot more money off of it than you do".

<comment><USER4> Ironic how commercially useful a tool for freedom can be, huh?

<comment><USER3> "Ironic how commercially useful a tool for freedom can be, huh?"

I find it ironic that people would associate the GNU with freedom, when it's anything but. The AGPL and GPL is about giving out your source code and telling people exactly how you can (and most importantly cannot) use it.

How is this any different than a proprietary license?

I'm fine with people being against commercialization of their work, but I just wish they would stop trying to pass it off as freedom.

This is why I only support the BSD license. Yes, people may make "more money than me" on my own work, but if that's the case, they obviously have better ideas than I do..and deserve the success.

It seems like the FSF and Stallman want companies to get confused and use GNU software in their proprietary application. By calling it "free", some people do get confused and use it..and it usually ends up on lawsuits that require the company to open up the source of their app and/or the hiring of a "GNU compliance officer".

<comment><USER5> "How is this any different than a proprietary license?"

With GPL software, you get the right to modify and distribute under certain conditions. With proprietary software you do not have those rights at all.

<comment><USER6> It's not true that you don't get those rights with proprietary software. It depends on the license, as always.

The disconnect the GP has is that the GNU GPL is based on freedom, yet it places significant restrictions on what you do with the software under the GPL. It's a fine license, but calling it "more free" is nonsense.

<comment> loup-vaillant Define "significant". Because in a sense I agree: these restriction have profound implications. In the other sense, however, I disagree: the restrictions you speak of don't unreasonably limit your freedom.

Remember the four freedom free software gives you: (0) running it for any purpose, (1) modifying it, (2) re-distributing it as is, and (3) re- distributing it modified.

With GPL, freedoms (2) and (3) can only be enjoyed at one condition: giving to those who receive the software the exact same freedoms you enjoyed. In other words, you shall not make your users less free than you are already. This is a long standing principle: one's freedom shall stop at others'.

I argue that the GPL merely forces you to respect that principle (it will be very hard to convince me otherwise). If you don't like that, I will be forced to question your morality.

<comment><USER6> Compared to the BSD-family of licences, the GNU GPL is less free, as it restricts what one entity can do with code granted by another. I'm not saying this is a _bad_ thing; this is exactly what the GNU GPL is written to do: enforcing a share-and-share-alike ethos for a given set of code.

I do think that the rhetoric (including the "four freedoms") is nonsense that could be left by the wayside with no harm, and possibly even improve it. That's the part about the GNU GPL and the FSF that I can't stand: don't try to tell me that this is about freedom. Tell me that this is about building a base of code that requires share-and-share-alike behaviour and that you're doing it because you think it will produce a richer environment. I may not agree with you, but at least I'll respect your stance.

If I want to restrict others use of my software in a way that they have to grant others the exact same rights that I granted them in the first place, then I will happily pick the GNU GPL or some other license that achieves the same thing, because that's what I _want_ in that case. If I don't want to restrict others use of my software in any way, I will pick something much less restrictive (such as the MIT or BSD licences). If I want something in-between, I will choose an in-between license like the MPL or the LGPL. But in no way will I pretend that my application of restrictions is increasing freedom. It's the restrictions I'm choosing for the software I'm writing. No more, no less.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> A key aspect of GPL is that you trigger its source distribution requirement by doing something that requires permission of the copyright holder. This is key because it makes GPL _fundamentally_ different from a EULA. As the FSF notes, licenses for proprietary software try to take away your freedoms, whereas GPL adds to them. This works because GPL only imposes requirements on you when you do something that the law otherwise disallows. The typical EULA tries to stop you from doing things the law otherwise allows.

If you obtain a legitimate copy of a GPL program and completely ignore the license, but only do things that copyright law allows you to do without needing the permission of the copyright holder, such as running the program, or making modifications to adapt it to run on your specific machine, you will not be in violation of the license--because the license only expands your copyright rights.

Affero GPL's requirement to distribute source is triggered by letting someone communicate with your running copy of the program. That's something that does NOT require the copyright owner's permission in copyright law. That's taking away a freedom we have under copyright law--and puts Affero GPL squarely in the EULA category.

The FSF seriously compromised their principles when they accepted Affero GPL.

<comment> loup-vaillant This is precisely because they compromised their principles with the AGPL that they didn't make it their main licence. They felt they had to let people make such a compromise, for some software.

The problem with software which have significant influence over the network is that it's "users" might not be the owners. Effectively, freedom 0 and the other three are in conflict. (My freedom to run the software is in conflict with your right to study it).

If I recall correctly, the FSF itself says AGPL software is not really free software.

</comment></comment><comment><USER8> The AGPL breaks with what's IMO is a central tenet in free software: The input and output to and of the software is not covered in any way by the license. The license covers distribution, _not_ usage. The AGPL introduces such language as "interacting with it remotely through a computer network".

If my database software is AGPL (and I've for some reason modified it) and my webserver is regular GPL, does accessing my blog-webapp (that talks to the DB) constitute "interacting" with the database?

What if my blog is generated statically from the DB, triggered by uploading a new post through the web-interface? What if the trigger is cron?

If a dataset can be uploaded directly into a software program using HTTP PUT, sure, that's covered. But what if the protocol requires e-mailing the dataset to a clerk who then feeds it in?

Server software is _used_ by letting people access it over networks. If you don't want people to _use_ your software freely, for whatever purpose, commercial or not, free software is not for you.

<comment><USER2> This is a whole lot of what-iffing about a really straightforward idea. If you're going to incorporate my code into yours, and you're going to sell access to the resulting product as a web site, you need to make your code available. You can't host my code and your extensions on a website to evade the GPL.

Agree with this or disagree with it, but it clearly isn't a plot to get the GPL to infect program outputs.

</comment></comment><comment><USER9> The AGPL was released in 2002. So this isn't a new development.

It adds a requirement (section 2.d) that if the software contains a source download feature that feature has to be retained.

</comment><comment><USER10> It's interesting that rms objects to SaaS on software freedom grounds. I'd never really considered this before.

<comment><USER11> That has been going on for a while now. I don't agree with him at all on this but...that isn't anything new.

<comment> loup-vaillant May I ask you to be more specific? I would like to know what you disagree with, and why.

</comment></comment></comment><comment><USER12> I predict this won't be nearly as successful as the GPL has been. The incentives don't line up the same way as they did for desktop software.

<comment><USER13> The point of the AGPL is to have companies like Google (who use heavily modified GPL'd codebases such as the Linux kernel or Mysql, but don't redistribute it, hence do not have to share back under the GPL) start sharing back as [if] projects switch to AGPL'd codebases.

</comment></comment><comment><USER14> A shot across Google's bow?

</comment><comment><USER15> So if I write a program that web scrapes a server that contains code with the GNU Affero GPL, do I have to open source my web scraper as well?

<comment><USER2> No.

<comment><USER15> Did you read the article?

"The GNU Affero General Public License is a modified version of the ordinary GNU GPL version 3. It has one added requirement: if you run the program on a server and let other users communicate with it there, your server must also allow them to download the source code corresponding to the program that it's running. If what's running there is your modified version of the program, the server's users must get the source code as you modified it."

So if I write a program that is a front-end to a server that uses software with this license then my front-end program would also be affected by the license and will need to be open sourced. That seems like a straightforward implication.</comment></comment></comment>


Why is Silicon Valley hiring bird experts? - <AUTHOR> https://www.bloomberg.com/news/audio/2019-06-18/why-silicon-valley-is-hiring-bird-experts-podcast <comment><USER2> Birds aren't real

([https://birdsarentreal.com](https://birdsarentreal.com))</comment>


Ask HN: Private and easily searchable tool to export email archives to? - <AUTHOR> Is there a private, secure and easily searchable tool to export all of my emails from services like Outlook and Gmail into, where they're still really easily searchable?<p>I'm reminded that gmail isn't end to end encrypted which is kind of lame. <comment><USER2> I know many people want something like this, but few seem to want to pay for it, which seems to leave the problem languishing. Would you be willing to pay for such software? If so how much?

</comment><comment><USER3> I wrote a script that inserts emails into Elasticsearch. It works pretty well.</comment>


China's Huge 3D Printers, Soon Able to Print Automobile-Sized Metal Objects - <AUTHOR> http://3dprint.com/chinas-huge-3d-printers-soon-able-to-print-automobile-sized-metal-objects/ <comment><USER2> An interesting article, but I take issue with the the opinion that "3D printing and robotics promises to change some of this, as companies can utilize industrial scale 3D printers and automation to manufacture parts for their products, cheaper than even the labor force in China can produce them. That's if, of course China lags behind in their adoption of these technologies."

Even if China doesn't "lag behind" in the adoption of 3D printing, it will only be an advantage to them if they are significantly ahead. If you have similar-capacity 3D printers with similar operational costs in China and the US, US companies producing for the domestic market will still prefer to use the US ones to take advantage of the shorter supply chain. Chinese companies will prefer to use Chinese printers for the same reason.

<comment><USER3> I thought about this a couple of years back and as far as I can make out, we are approaching the situation where you could just about fit a digitised general engineering factory and materials store into a high street shop unit. At that point you could robotically fabricate a car to order and just drive it out the front onto the street when it is finished.

<comment><USER4> Cars have ridiculously much electronics in them and you cannot "print" those just like that in a small shop. Have you seen how big wnd expensive a wafer fab is?

<comment><USER3> I have seen what people are developing. Besides, cars do not need to have micro electronics.

[http://reprap.org/wiki/MetalicaRap](http://reprap.org/wiki/MetalicaRap)

[http://medtechinsider.com/archives/24967](http://medtechinsider.com/archives/24967)

[http://www.nthdegreetech.com/printed- semiconductors.php](http://www.nthdegreetech.com/printed-semiconductors.php)

That said, there will always be some things for which economies of scale win out against customisation, and I suspect that many electronics components are in that bracket. Luckily we have things like FPGAs, so you don't need to keep a huge stock of specialised chips to make a wide variety of devices.

<comment><USER4> I don't think there is a market for cars without micro electronics. Especially not with the rise of electric cars.

FPGA's are several orders of magnitude more expensive than mass-produced electronics.

Modern cars contain more than just controller electronics. What about image sensors, for instance, for automated parking systems? You can't 3D-print an image sensor. Not without a clean room at least.

</comment></comment></comment></comment></comment><comment><USER5> What's interesting, but kind of glossed over in the article, is it's not just your typical plastic 3D printer. This thing prints metal objects, which could conceivably be used for car parts.

<comment><USER6> The article mentions that they use them for aerospace components, including landing gear. I wonder what the strength of these parts are compared to traditional manufacturing techniques. Can these parts be used for actual structural elements?

<comment><USER7> Even if you could handle the end product strength (and they can ... sort of), there are a lot more problems dealing with metal than plastic.

First, metal is a _LOT_ heavier to throw around than plastic. So, your control systems have to be dramatically bigger.

Second, the melting points of metals are _way_ higher than plastic, so the energy required to be right at a critical point of flow/melt is a lot bigger. Not to mention the percentage difference between melted and not melted is a lot smaller.

Third, a lot of the metal techniques are about melting metal in place. That means that the part is buried in a block of powdered metal. That block of powdered metal is a significant fraction of the weight and cost of a plain old hunk of whatever the metal is. Try imagining fabricating even a small gold part out of a powdered block of 6"x6"x6" of gold--now think about how many metals are _WAY_ more expensive than that.

Finally, powdered metal is explosive. Most machines working with powdered metal require nitrogen atmosphere pump down and if there is a leak ... KABOOM.

</comment></comment></comment><comment><USER8> Yes, but here in the US we invested hundreds of billions in a housing bubble, rather than productive capital investment. Consuming all the seed corn will keep us competitive, right?

<comment><USER9> Oh, please: [https://www.google.com/search?client=ubuntu&channel=fs&q=emp...](https://www.google.com/search?client=ubuntu&channel=fs&q=empty+chinese+cities&ie=utf-8&oe=utf-8)

<comment><USER10> oh, please: [http://www.skepticblog.org/2011/02/10/chinas-ghost- cities/](http://www.skepticblog.org/2011/02/10/chinas-ghost-cities/)

Edit: Note people said the EXACT same thing about china "building roads no body needs" in the early nineties. Now china are running license plate lotteries in order to keep traffic bearable. Just have a sense of scale, when you are trying to migrate 350 million people into urban centres, you need to build a lot of houses.

<comment><USER11> This is too simplistic. There are still roads in china that aren't used much, while inner city infrastructure is insufficient. Also, many houses that are built are villas that farmers from the country side can't afford; Beijing has a lot of empty apartments and a housing shortage at the same time.

<comment><USER10> Okay, show me a google maps image of a 'ghost city' and I'll zoom it out 2 notches and show you it's (barely) a 'suburb' of a bigger city.

Show me the a google maps image of a road that is a under used, and I'll find a bigger road in the US that is used less.

People buying houses and not living in them isn't "china building ghost cities" that's "people buying houses and not living in them".

By all means believe western propaganda all you like, but given you live/work in china I'm surprised you don't see it for what it is.

<comment><USER11> A "ghost city" is not a ghost city because there is no one to live in it, but there is no one that can afford to live in it. A lot of property is also bought for speculation given that China lacks a property tax.

As for highways, truckers avoid the ones that are heavily tolled, leading to heavily congested non-tolled roads (so called 7 day traffic jams...). And have you ever seen a road as empty as Beijing's 6th ring road?

<comment><USER10> So your issue is with poverty, and culture not with infrastructure?

GDP/capita is pretty shitty in china, I agree. Because time/money ratio is so crap, people are prepared to spend time, to save/earn more money, hence toll roads being an issue, and house speculation being an issue.

But no other country has increased GDP/capita faster than china (and on the scale china has) in the history of GDP/capita records.[0]

So exactly what are we criticising?

[0] [http://www.gapminder.org/world/#$majorMode=chart$is;shi=t;ly...](http://www.gapminder.org/world/#$majorMode=chart$is;shi=t;ly=2003;lb=f;il=t;fs=11;al=30;stl=t;st=t;nsl=t;se=t$wst;tts=C$ts;sp=5.59290322580644;ti=2012$zpv;v=0$inc_x;mmid=XCOORDS;iid=ti;by=ind$inc_y;mmid=YCOORDS;iid=phAwcNAVuyj1jiMAkmq1iMg;by=ind$inc_s;uniValue=8.21;iid=phAwcNAVuyj0XOoBL_n5tAQ;by=ind$inc_c;uniValue=255;gid=CATID0;by=grp$map_x;scale=lin;dataMin=1800;dataMax=2012$map_y;scale=log;dataMin=282;dataMax=119849$map_s;sma=1;smi=1$cd;bd=0$inds=i101_t001800,,,,;i44_t001800,,,,;i239_t001800,,,),

<comment><USER11> > Because time/money ratio is so crap, people are prepared to spend time, to > save/earn more money, hence toll roads being an issue, and house speculation > being an issue.

The point is that infrastructure investments are often misdirected, poorly thought out, or plain corrupt. China needs "affordable" housing, not property as "speculation opportunities" (and given that there are so few ways to invest money, this is what happens anyways). China needs low logistic costs, but has some of the highest in the world even with their "great" infrastructure; toll roads represent great skimming opportunities for officials and their families. Truck drivers are stuck in a crappy situation where they are forced to overload their trucks just to make ends meet, and hope the fines on the way (justified or not) don't bankrupt them.

> So exactly what are we criticising?

We were arguing about whether China's infrastructure investments were wise or not.

<comment><USER10> > toll roads represent great skimming opportunities for officials and their > families

Okay, provide some evidence government officials are 'skimming' from (all) toll roads. That's a pretty big claim, and as far as I can tell, the tolls are either private companies or government run tolls, that isn't corruption, that's taxation and enterprise.

So they don't have affordable housing because they don't allow enough things to invest in?

All truck drivers have to overload their trucks, and hope they don't get fined?

China's a big place, are you sure your statements apply across the whole nation. Or are you pretty much referring to domestic problems in a particular city?

Housing is not affordable in the Bay Area (SF)... is that also because they don't have enough to invest in?

Truck drivers the world over, are over worked, under paid, and have to resort to drugs, over loading, and sleep avoidance to make it... Is that because of corrupt toll road owners?

China has (some) the highest logistic costs in the world? Are you sure about that? Can I see a chart of 'world logistic costs'?

<comment><USER11> > the tolls are either private companies or government run tolls, that isn't > corruption, that's taxation and enterprise.

How do you think business works in China? All of these infrastructure projects are deeply guangxi based, and there is no better guangxi than family (e.g. how all the taxi companies in Beijing are run by official relatives).

> So they don't have affordable housing because they don't allow enough things > to invest in?

Most housing is not built for people to live in, its built as investment vehicles for rich people. This is true even in 2nd tier cities, not just the first tier ones. Its a country wide problem that the government is trying to tackle.

> China has (some) the highest logistic costs in the world? Are you sure about > that? Can I see a chart of 'world logistic costs'?

About 5X of developed country logistic rates. Sure, India might be higher, but China's "great" infrastructure should have lowered logistic costs to developed country levels, and it it hasn't yet (mainly due to corruption).

[1] [http://www.chinadaily.com.cn/business/2012-04/25/content_151...](http://www.chinadaily.com.cn/business/2012-04/25/content_15137417.htm)

<comment><USER11> 2stop, you've been hell banned for some reason, not sure why.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER12> I was wondering, are 3D-printed objects more fragile compared to similar objects being created with classical methods? For example, some metallic parts, or say, the foundations of a house.

<comment><USER13> The answer is 'it depends'. There are a variety of processes and materials that are called 3D printing. For plastic fused deposition modeling (like the Makerbot), objects can be comparable to say, injection molded parts, which is a more common plastic production method. For metal, selective laser sintering is the most common method, and the parts it produces have different (and probably inferior in most cases) properties than cast/forged/machined parts. There's way too much variety on either side of the coin to say which is more fragile.

<comment><USER12> I know that reinforced concrete is often used in construction, so I figured that printing a huge house would make it more fragile, say, during an earthquake.

</comment></comment></comment><comment><USER14> Not one person has mentioned in the comments the fact that 3D printing something takes a LONG time. Not exactly the kind of machine that you are going to put on an assembly line. Probably much more effective for printing large prototypes. Just like 3D printing is used for today.

</comment><comment><USER15> If the United States and other countries can produce their own goods with 3D printing, wouldn't that hurt China's export business? What good is a mass of 3D printers and hundreds of millions of people without work?

<comment><USER16>
        > wouldn't that hurt China's export business?

People in China build cool stuff like people in other places.

        > What good is a mass of 3D printers and hundreds of
        > millions of people without work?

We could build self-replicating drone factories, use them to terraform Mars, and some people could colonise it. That'd be cool.

</comment></comment><comment><USER17> I was wondering if someone that knows much about 3D printing on a larger scale could chime in here: [http://ideas.techendo.co/ideas/2](http://ideas.techendo.co/ideas/2)

</comment><comment><USER18> ...the future is bright.

</comment><comment><USER19> you wouldn't...

<comment><USER20> You wouldn't, but the Chinese definitely would:)

</comment></comment><comment><USER21> prelude to the industrial replicator!</comment>


Is your connected car spying on you? - <AUTHOR> http://www.bbc.co.uk/news/business-29566764 <comment><USER2> _" All the data we collect is anonymous and we only sell anonymised data."_

But there have been numerous violations of such "anonymised" data that caused the identities of the people ostensibly protected by this anonymization to be revealed.

There is ongoing research in to how to make more robust, mathematical guarantees of anonymity in such datasets. Until this research comes to fruition and becomes widely deployed in industry (something that's probably decades away), I would not take much comfort in assurances from industry reps that the data the companies they represent collect or release are "anonymised".

<comment><USER3> > Until this research comes to fruition and becomes widely deployed in > industry (something that's probably decades away), I would not take much > comfort in assurances from industry reps that the data the companies they > represent collect or release are "anonymised".

Even if the technology existed I would not rely on it being deployed and used correctly: 1) There is no incentive to do it because there is little penalty if they fail; and 2) IT security in general is completely unreliable; why would this be any different?

The only secure data is data that doesn't exist. Already there are government agencies that automatically delete internal communication (e.g., emails) within 30 days. If that's important for the security of their government data, which arguably should be open, why isn't it done with my data, which should be private?

<comment><USER2> _" Already there are government agencies that automatically delete internal communication (e.g., emails) within 30 days."_

Or they claim to have deleted it. And maybe, technically speaking, it has been deleted from _their_ servers. But by then, who knows where it's been copied to. By then it might be on systems completely out of their control.

I think you hit the nail on the head: _" The only secure data is data that doesn't exist."_

No guarantees or assurances from the corporations or the government can change that.

</comment></comment></comment><comment><USER4> The fun part is, in a couple of years it basically won't be possible to drive a car (on a public road, anyway) that _isn 't_ "connected." If the legislators don't bring this bold new tomorrow down on us, the insurance companies will do so on their own.

</comment><comment><USER5> About six months ago I bought a VW with their "CarNet" integration. I am concerned about my car relaying information about where I go and how I drive - at a minimum, I know that it notifies the dealership when I cross over a 10,000 mile boundary because I've received an email reminding me to take it in for service. I've tried to find a way to disable it, but I can't find anything online or in the user manual.

I suspect that this story will become more and more common - ordinary people buying cars equipped with such systems that are unaware of the privacy implications.

<comment><USER6> Are you 100% sure it wasn't coincidence?

I don't have a connected system [e.g. it doesn't report anything because its a certified used car I got for $11k where damn near everything is manual :P] but the dealer was able to guestimate within a few months of when I would hit the mileage amount I'd need to take it in for service.

<comment><USER5> 100% sure? No. However, I got the email a day or two after I crossed 10,000, about 5 months after I bought the car, which is a bit sooner than average I would imagine. It's also one of the advertised features of CarNet ([http://www.vw.com/features/vw-car-net/](http://www.vw.com/features/vw-car- net/))

<comment><USER6> Ah, well if its an advertised feature it isn't like you weren't informed. I was thinking you thought it was something shady they snuck in w/o your knowledge.

</comment></comment></comment></comment><comment><USER7> I am really worried that insurance companies will push for those tracker devices for everyone. If they simply make insurance policies without the trackers twice as expensive as ones with them, they will quickly become widespread, and this surveillance will become the norm. I hate this and I dread the day when it happens.

<comment> at-fates-hands You should hold out hope for every company which does this, there will be one acting with your privacy in mind and offer lower rates without the possibility of collecting your data.

I think the Snowden revelations have had a huge impact on how people view their privacy now.

</comment></comment><comment><USER8> And your car leaks information that can be used to create GUID: [http://www.reddit.com/2kj10q/](http://www.reddit.com/2kj10q/)

</comment><comment> at-fates-hands _" At the time, chief executive Harold Goddijn promised his company would prevent the data being used in that way again."_

This is the crux of the issue. Companies will continue to reap the financial benefits of selling the information and then back off if they get caught.

This is a very dangerous game of, "It's easier to ask for forgiveness than for permission"

<comment><USER9> A "promise" by a CEO about what his company will or won't do in the future is completely worthless.

</comment></comment><comment><USER10> That reminds me of a Ford exec that said: 'We Know Everyone Who Breaks The Law' Thanks To Our GPS In Your Car

Read more: [http://www.businessinsider.com/ford-exec- gps-2014-1](http://www.businessinsider.com/ford-exec-gps-2014-1)

</comment><comment><USER11> Sometimes when I rent a car I'll poke around in the navi and sync menus. I often can see where people went in the car before from the nav history and you'd be surprised how many people sync their address book with a rental car!

</comment><comment><USER12> There will be an interesting battle in the future for the Car Data. Will be the manufacturer or the services available in the car which will own the data ?

<comment><USER13> The owner of the car is and should stay the owner of the data. He should also be able to decide what and where to put his data, at any time.

<comment><USER14> Indeed.

One of the more dangerous potential outcomes of all this data recording and telemetry is that everyone winds up with a black box monitoring their driving full-time, which becomes _de facto_ obligatory because you can't get something mandatory such as insurance without it.

Then, because there are exactly zero perfect drivers in the world, every driver becomes subject to effectively arbitrary fines and/or increases in their insurance premiums, providing a convenient revenue stream with a captive market for both big businesses and governments.

In an ideal world, such monitoring could instead lead to official recognition that no-one is perfect but interventions should be aimed at people with a sustained pattern of risky behaviour or deteriorating driving standards rather than immediately penalising a driver who made a small mistake and was unlucky to be in front of a camera at the time. But sadly I have little faith that anything so constructive would ever actually happen, given the track record of the government, the police, and the insurance industry in my country when it comes to abusing new technologies and outright lying about what they are doing/going to do. :-(

<comment><USER15> No, you should immediately punish bad driving but the punishments can be much lower.

<comment><USER14> The trouble with that argument is that _every_ driver is guilty of "bad driving" at least momentarily from time to time. What good does it do to punish someone who is reasonably skilful, reasonably responsible, but only human?

The inconsistency and selective enforcement is part of the problem here. If our driving laws were routinely and universally enforced to the letter, with every infraction punished as the law provides, then there would be no-one left entitled to drive within a few weeks and the absurdity of the system would be clear for all to see.

As it stands, there seems to be an element of lottery: I know plenty of people who are basically responsible drivers but have picked up the odd ticket for doing 35 past a camera at the bottom of a hill or something, and I also know plenty of people who I literally won't ride with any more on account of their crazy driving yet who have completely clean licences. Evidently the system is not currently effective at promoting safer, more considerate driving, which in the end is what it should be doing.

<comment><USER15> I assume that you're a software guy so I would hope that you would naturally understand the benefit of simplicity. Let's assume that a speeding ticket currently costs $200. What percentage of speeding instances do you think are currently fined? I'm going to guess far less than 1%. That means you can lower the fine to $2 per instance or probably much less and still be meting out the same expected punishment for speeding.

The goal of this fine is not to partition drivers into good and bad drivers. It's to incentivize good driving. Yes, good drivers are going to get fined occasionally but it will be a very small fine. Why try to make a more complicated rule that never fines "good" drivers? That will sometimes lead to drivers who decide to speed this once because it's free.

<comment><USER14> > Yes, good drivers are going to get fined occasionally but it will be a very > small fine. Why try to make a more complicated rule that never fines "good" > drivers?

For one thing, any law that inherently penalises innocent people for a crime they did not commit is abhorrent to me. The scale does not matter. This is simply a basic principle of justice and fundamental to the state having any moral authority to enforce any law at all.

Even were that not the case, you have to deal with the practical problems of overheads. What are you going to do when someone inevitably disputes their $2 charge? Either you have a punishment without any due process at all, or you incur vastly disproportionate expenses prosecuting a case in court, or you cause the innocent person vastly disproportionate damage contesting their guilt. None of these is an attractive option.

You also have to deal with the practical problem that any such system _will_ be cracked very quickly, and the worst drivers will be the ones most likely to get away with it.

My views have somewhat softened on technical driving offences over the years, in that I accept as a practical matter that having a black and white definition of what is permitted removes wriggle room for bad drivers who might otherwise tie the system up contending that their actions were not in fact dangerous or otherwise inappropriate. Nevertheless, the goal of road traffic laws should be to take the dangerous or inconsiderate off the road, and it is not always the case that things like exceeding a speed limit or driving through a red light necessarily have (or have any significant potential to have) actual negative consequences.

So while the laws prohibiting these actions are a pragmatic choice, it is not one that has any inherent moral basis to me and already one that sometimes prohibits perfectly reasonable actions that a responsible driver might otherwise perform. Abusing such laws so that even those who try to comply with them, while also driving safely and considerately, are still victimised is a big step too far in my book. And of course the systems we're talking about might not only be used to enforce technical laws to the letter, but could also be used to provide wriggle room for insurance companies after an incident.

<comment><USER15> The innocent until proven guilty approach to traffic violations is already a farce. If you have a job, it costs more to dispute a ticket than to pay it. I'm in favor of changes to the legal system that would allow rapid turn around in low stakes cases. Start with something very informal and quick and have an appeals process where the loser pays.

Cracking the local monitoring device can be disincentived just like speeding. If an officer sees you speeding and you're not self reporting it, bam. Bigger offense.

The thing about more effective enforcement in any setting is that it can increase justice (lower the lottery effects) but it makes it that much more important that you got the laws right to begin with.

<comment><USER14> _The innocent until proven guilty approach to traffic violations is already a farce. If you have a job, it costs more to dispute a ticket than to pay it._

Yes, it is, and that situation is a real problem for some people, such as someone whose car registration has been cloned, resulting in a whole series of tickets about something like the London Congestion Charge even though they live in the north and haven't been as far south as London in years.

That is why I am personally in favour of courts defaulting to awarding realistic compensation to successful defendants in all prosecutions, combined with the abolition of automated fixed penalty notices generated by any sort of machine.

Basically, if something is serious enough to merit a criminal prosecution, I think the authorities should show up with real evidence and if necessary real police officers as witnesses, make a proper case in court, and suck it up if they bring too many cases that fail and it costs them a lot in compensation. I think there is considerable merit in the argument that anything where you don't feel such a comprehensive response is justified and instead resort to some sort of automated penalty regime and mass punishments shouldn't be dealt with through criminal proceedings at all. (Edit: The flip side of this is that if a police officer pulls you over and in court you really are then found guilty of, say, driving at dangerous speeds, don't expect to get away with 3 points on your licence and a token fine. Only prosecuting serious offences cuts both ways.)

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER16> Tl;dr version: Yes we caan, but we "promise" not to.

</comment><comment><USER17> Huh. From the title I would have guessed this was a Wired article.</comment>


Show HN: Markpad Editor for Windows Phone 8 - <AUTHOR> http://www.windowsphone.com/en-us/store/app/markpad-editor/c452dd19-6a36-45ae-8cfc-6721e5c886c0 Markpad Editor for Windows Phone 8 just passed certification and is now available in the Windows Phone Marketplace. It's designed to be a simple Markdown Editor and Previewer for Windows Phone 8.
You can see it here: http://www.windowsphone.com/en-us/store/app/markpad-editor/c452dd19-6a36-45ae-8cfc-6721e5c886c0
I'd love to get some feedback and know what you guys think of it. <comment><USER2> Is this is anyway related to MarkPad for Windows?

<http://code52.org/DownmarkerWPF/>

<comment><AUTHOR> No, not in any way. It's meant to be the WP8 equivalent to an app by the same name I wrote for iOS last year.</comment></comment>


Ask HN: Why should we upvote or downvote a comment? - <AUTHOR>

With submission I suppose you up vote them because you like them? I do not understand how can you not up vote a comment you agree with though, or down vote one you disagree with.
Say someone comments about the liberal arts education being a good thing and old people are just deluding themselves in thinking that their education was much better and that our education is obsolete.
This comment I would up vote because I agree with it. If someone said Education is a complete failure I would down vote it because I disagree with it.
Apparently this is infuriating to some? Does that mean that we should not up vote comments we agree with?
In short, why do you think a comment should be up voted or down voted? <comment><USER2> Speaking personally (and I know a few people have said the same in the past) I upvote comments that are constructive or that make a good argument and downvote trollish, rude or "lol" style comments.

Irrespective of if I agree with their message or not.

Examples. Take these to comments _I_ made the other day:

<http://news.ycombinator.com/item?id=675136>

<http://news.ycombinator.com/item?id=675230>

The first was rightfully downvoted because it all but amounted to a rant. In the second I made a much more reasoned point (but with basically the same conclusion as the first) and it got an upvote.

In my eyes that is the HN effect working :)

Although all of that said I have noticed a tendency for upvotes to snowball sometimes - and for some comments to obviously be voted on based on agreement/disagreement *(not that there is a specific rule against that of course!).

<comment><USER3> I agree that this is the right way to think about it: I upvote comments I think others should read (for benefit, enjoyment, or a well-reasoned counter- argument to my view). Sometimes, however, due to the discussion at hand I simply use the vote to indicate "me, too" -- especially when it's a discussion that seems to be coming to (or trying to) come to a consensus. I certainly don't want to submit an "I agree" comment; I just up-vote. It often seems like I'm up-voting agreement more than the well-reasonedness or interest of the comment, often due to the nature of the topic.

For example, on a "rate my web site" thread where somebody makes a suggestion, and I simply agree, I'll up-vote without adding to the thread.

</comment></comment><comment><USER4> Upvote if you want the comment to appear higher up in the page of comments; Downvote if you want the comment to appear lower down in the page of comments and be a lighter shade of grey.

With the added warning that your actions will have an effect on the voting and commenting behaviours of other hacker news readers in the long term, but this will mostly align well with the above affects.

Edit: I should add that most people upvote differently on Hacker News than they do on Reddit, because of the second effect whereby they might not necessarily think a comment is rude, but if it doesn't add anything to discussion they will downvote in the hope that the comments in the long run will be more helpful.

</comment><comment><USER5> The two extremes are:

1) everyone upvotes to agree (and only to agree), and downvotes to disagree (and only to disagree). Then the score on a contribution measures its proximity to the average opinion.

2) everyone upvotes signal and downvotes noise. Then the score on a contribution measures its relevance to HN readers.

Since I don't care about average opinions but much about relevance, I upvote and downvote by rule 2).

</comment><comment><USER6> I upvote comments that make me think, tell me something I didn't know, or have an interesting perspective. There is, of course, a personal bias towards comments that I agree with. I try hard to vote objectively regardless of my own views. But I'm only human.

</comment><comment><USER7> You can't tell people how/when to upvote/downvote/do nothing. It will not work and people will try to game the system. People will vote based on instinct.

For example I upvote what I like/agree with. I downvote stupid or wrong stuff.

That being said, I think the HN community has regulated itself remarkably well so that truth/content gets sufficient votes and falsehood/noise gets downvoted, and heavily so if needed.

</comment><comment><USER8> I see it less as agreeing or disagreeing, and more as is it a new idea, new perspective, new spin, something worth thinking about. I would not learn anything from a comment about liberal arts education being crap. If there was an interesting reasoning behind the comment, it might be another matter.

Sometimes I vote up things I disagree with, because I am interested in the opinion of the HN community on the issue.

</comment><comment><USER9> I upvote comments: that provide useful information; that I agree with, and writing my own comment would only be clutter; that I disagree with, but think is well-presented.

I downvote comments: that fairly strongly don't add anything to the conversation; that contain a high percentage of profanity without saying anything useful; that I disagree with _and_ are not well-presented (e.g., trolls).

But not always. Most comments I don't do anything with. If I see a moderately insightful comment with 1 point, I'll probably upvote it. If I see a similarly moderately insightful comment with 4 points, I may think that's high enough and leave it alone. If I see a moderately trollish comment that's at -3, and I didn't think it was _that_ bad, I might upvote it, not because I like it, but because I think -2 is sufficiently low.

On the whole, I try to vote such that the more I want to see similar comments, the higher the score; and the less I want to see similar comments, the lower the score.

</comment><comment><USER10> Understand that the point of the moderation system here is to promote civil discussion. The protocol most people (try) to follow here is a natural result from that.

I have a policy of only downmodding posts that are not a part of legitimate discussion. This includes obvious trolls, but also any post where I don't think the post contributes anything, such as an ad-hominem attack.

I do not downmod a post just because I disagree with it. If I disagree with the post, but it's not an obvious troll or incendiary in any way, I leave it alone. I see downmodding as a means to keep discussions civil, not to show disapproval with a point of view.

In contrast, I upmod posts I agree with. This means that a single control - voting up or down - has an asymmetric meaning for me.

</comment><comment><USER11> _I'll mod something up if it's on-topic, well thought-out, and I agree with it. I'll only mod something down if it's blatantly off topic and rude/trollish. If I simply don't agree with what they said, but they said it in useful way, I'll just leave it be.

I'm all about modding the people who post goatse links down into negative oblivion, but I think it kind of stifles discussion if you downmod simply because you don't happen to agree. Instead of dog-piling someone for a dissenting opinion, take the extra 30 seconds to write a response. It'll enrich the discussion._

Discussed before: <http://news.ycombinator.com/item?id=147098>

</comment><comment><USER12> The up & down arrows on your page are yours, and yours alone. Do whatever you want with 'em, whatever feels right.

</comment><comment><USER13> I generally upvote comments that make an interesting point in an intelligent way. I tend to favor concision, since I don't upmod (or downmod) something if I'm not compelled to read the whole thing.

I generally upvote anything I respond to, even in disagreement, unless it's obnoxious (in which case, I downvote).</comment>


The Domain Discontinuity - <AUTHOR> http://blog.8thlight.com/uncle-bob/2014/01/27/TheChickenOrTheRoad.html

<comment><USER2> The blogosphere really needs a lot more discussion on how to do TDD, because in my experience, working in a team that valued TDD and wanted to do it, most people did not do TDD most of the time. The reason is simple. Most people don't know how to do TDD and therefore are not comfortable with it under a real workload. There likely is no simple solution to this. We just need to talk about it more, share ideas, tutorials, etc.

Also, I think that part of the reason TDD is not used more, is that TDD is intimately intertwined with design and in today's "churning out code" culture, taking time to design things is no longer valued as much as it was.</comment>