TXT Record XSS - <AUTHOR> http://who.is/dns/jamiehankins.co.uk <comment><USER2> I am half serious, but how about making HTML served in TXT records a standard trick for serving small web pages very quickly? There are way fewer network round trips:

      1. DNS query for TXT record for example.com
      2. DNS reply with HTML content

Compared with the traditional 7 steps:

      1. DNS query for A record for example.com
      2. DNS reply with x.x.x.x
      3. TCP SYN to port 80
      4. TCP SYN/ACK
      5. TCP ACK
      6. HTTP GET
      7. HTTP reply with HTML content

It would also make the content super-distributed, super-reliable, as DNS servers cache it worldwide (and for free so it would reduce hosting costs :D). Also TXT records can contain more than 255 bytes as long as they are split on multiple strings of 255 bytes in a DNS reply.

Again, I am only half serious, but this is an interesting thought experiment...

Edit: oddtarball: DNSSEC would solve spoofing. And updates should take no longer than the DNS TTL to propagate: the TTL is under your control; you could set it to 60 seconds if you wanted. It is a common, false misconception that _many_ DNS resolvers ignore the TTL. Some large web provider (was it Amazon? I forget) ran an experiment and demonstrated that across tens or hundreds of thousands of clients wordlwide, 99% of them saw DNS updates propagated within X seconds if the TTL was set to X seconds. Only <1% of DNS resolvers were ignoring it.

<comment><USER3> > _I am half serious_

Good. Still, it needs to be pointed out. This idea is an awesome hack to show how can you piggyback on existing infrastructure to make it work as something it was not intended to.

But it absolutely, terribly sucks at anything practical. Actually, it's a _non-solution_. Here's why.

> _There are way fewer network round trips:_

> _1\. DNS query for TXT record for example.com_

> _2\. DNS reply with HTML content_

Let me show an exactly equivalent alternative implementation of the above concept.

        1. HTTP GET x.x.x.x/example
        2. HTTP reply with HTML content

Both of them require you to do exactly the same steps - that is, connect to a _hardcoded port_ of a server at a _hardcoded IP address_ , request a _user- defined_ resource, receive and display reply. DNS is not magic, IP addresses of DNS servers are hardcoded in your network configuration and/or in your router configuration and/or in your ISP configuration.

I know you're half-serious with this idea, but I'm going to play along. So to continue with the interesting thought experiment... if people were to start actually using DNS records to smuggle websites, they'd quickly overwhelm the capabilities of the DNS network, so the reliability and free hosting would quicky go out of window, along with all hope of ever having anything even resembling consistency in the Internet.

So yeah; a nice hack, but kids, don't try to deploy it at scale ;).

<comment><USER4> > _Both of them require you to do exactly the same steps - that is, connect to > a hardcoded port of a server at a hardcoded IP address, request a user- > defined resource, receive and display reply. DNS is not magic, IP addresses > of DNS servers are hardcoded in your network configuration and /or in your > router configuration and/or in your ISP configuration._

The steps are not _exactly_ the same. Any sensible ISP give you at least two redundant DNS servers with your DHCP response and most public DNS providers also give you multiple redundant servers. When you do a DNS lookup, your OS or browser handles failover between the DNS servers automatically, client side. When accessed by IP address, as you've demonstrated, HTTP offers no client- side failover mechanism built into web browsers to fall back to a different IP.

It's additionally important to note that architecturally, DNS servers are far more scaleable than most HTTP servers. They don't run anywhere near as much code per request and don't require the overhead of TCP or HTTP.

Note that I'm also not encouraging using DNS instead of HTTP for serving websites, I'm just pointing out that DNS is a more reliable technology and has client-side failover mechanisms so the pros which mrb listed are very real.

</comment></comment></comment><comment><USER5> So uh. This works on a few websites. A couple I've found

[http://dig.whois.com.au/dig.php?dom=jamiehankins.co.uk&type=...](http://dig.whois.com.au/dig.php?dom=jamiehankins.co.uk&type=ALL&submit=Dig+Lookup)

[http://mxtoolbox.com/SuperTool.aspx?action=txt:jamiehankins....](http://mxtoolbox.com/SuperTool.aspx?action=txt:jamiehankins.co.uk&run=toolpage)

<comment><USER6> I'm guessing nobody else noticed the Rick Roll in there too?

<comment><USER7> As the script was just bouncing the search box at the start I a) assumed it was deliberate and b) expected them to start trying to sell me domains.

The rickroll was the first bit I noticed o_0

</comment></comment></comment><comment><USER8> Since there is very little discussion in the link, pardon me for stating what may be obvious to some, but not necessarily everyone.

The point here is that:

1\. DNS TXT records can contain HTML, including scripts and whatever.

2\. Domain registrants can publish arbitrary TXT records.

3\. TXT records can appear in pages generated by web sites which serve, for instance, as portals for viewing domain registration information, including DNS records such as TXT records.

4\. Thus, such sites are vulnerable to perpetrating cross-site-script attacks (XSS) on their visitors if they naively paste the TXT record contents into the surrounding HTML.

5\. The victim is the user who executes a query which finds the malicious domain which serves up the malicious TXT record that is interpolated into the displayed results. The user's browser executes the malicious code.

Thus, when you are generating UI markup from pieces, do not trust any data that is pulled from any third-party untrusted sources, including seemingly harmless TXT records.

<comment><USER9> Thanks for explaining. I know HN is traditionally programmer/programming focused, but some of us come from other areas and only have limited experience with such topics. It's very common for me to enter a thread about a security vulnerability, for example, and think "wait, how big of a deal is this?"

</comment></comment><comment> ryan-c I enumerated all IPv4 PTR records a few years back, and I saw a couple XSS things there as well. If anyone wants to host that data set somewhere, let me know, would be interesting to see what others do with it.

Edit: I found my data and have a grep running on it, will share what turns up.

Edit2: Somewhat less exciting than I remember:

$ fgrep -- '>' *

x.x.101.130.csv:1298607746,22.214.171.124,<hostname>.nebula.msoe.edu.

x.x.110.35.csv:1298587462,126.96.36.199,www.ahnigeria.org\032<[http://www.ahnigeria.org/>](http://www.ahnigeria.org/>).

x.x.126.67.csv:1298594206,188.8.131.52,\032>.

x.x.229.74.csv:1298608599,220.127.116.11,<hostname>.suites.osuit.edu.

x.x.39.239.csv:1298594005,184.108.40.206,<hostname>.uits.uwm.edu.

x.x.49.198.csv:1298613894,18.104.22.168,test.str!\@#\$%^&*\\(\\)}{\":]['><.,end.domain.test.pl.

x.x.49.199.csv:1298613720,126.96.36.199,test.str

end.domain.test.pl.

x.x.49.206.csv:1298603066,184.108.40.206,test.str

omain.test.pl.

x.x.88.109.csv:1298606801,18.104.22.168,ilo.>.88.211.95.in-addr.arpa.

<comment><USER10> How big is it? If you put up a torrent I'll seed it...

<comment><USER11> Likewise, I have a gigabit internet connection and plenty of extra space.

</comment></comment></comment><comment><USER12> I added FartScroll.js from the Onion to my text records:

[http://dig.whois.com.au/dig.php?dom=philipithomas.com&type=A...](http://dig.whois.com.au/dig.php?dom=philipithomas.com&type=ALL&submit=Dig+Lookup)

<comment><USER13> Wow, I think they fixed that escaping problem a few minutes ago.

<comment><USER12> I think some of the sites escape semicolons only. Pure script loading isn't broken, but trying to code in the txt may break.

<comment><USER13> But I tried your link recently and it no longer works.

<comment><USER12> Oh you're correct - they did update it. It still works on a few other sites.

</comment></comment></comment></comment></comment><comment><USER14> From any Linux (or probably OS X) workstation / server, you can run the command "host -t TXT jaimehankins.co.uk" ie:

$ host -t TXT jamiehankins.co.uk

;; Truncated, retrying in TCP mode.

jamiehankins.co.uk descriptive text ""

jamiehankins.co.uk descriptive text "v=spf1 include:spf.mandrillapp.com ?all"

jamiehankins.co.uk descriptive text ""

jamiehankins.co.uk descriptive text "google-site- verification=nZUP4BagJAjQZO6AImXyzJZBXBf9s1FbDZr8pzNLTCI"

<comment><USER15> This is hilarious, but what's up with this line? >jamiehankins.co.uk descriptive text "v=spf1 include:spf.mandrillapp.com ?all"

Why is mandrillapp.com (tranactional email startup) included?

<comment><USER5> It's my personal domain, I use mandrill for some stuff.

<comment><USER14> Hell of a good prank dude, well played sir!

</comment></comment></comment></comment><comment><USER16> This is hilariousy, but could this potentially be a real threat to anything ?

<comment><USER17> idk why youre getting downvoted because it's a good question and people need to ask more security questions.

Any website I can inject malicious javascript into, I can steal your cookies from (assuming the httponly flag isn't set on the cookie).

If you were logged into one of these whois sites and they didnt have the httponly flag set on your auth cookie, an attacker could send you to a page on the site that contains malicious javascript that could phone home with your auth cookie, letting the attacker hijack your session.

You can defend your own websites from these kinds of attacks by setting up a Content Security Policy and using the 'httponly' flag on auth cookies.

[http://en.wikipedia.org/wiki/Content_Security_Policy](http://en.wikipedia.org/wiki/Content_Security_Policy)

<comment><USER18> Another attack is to rewrite the webpage to show the official login screen for that site, and record their password when they enter it.

</comment></comment></comment><comment><USER19> Wasn't expecting that at all! Had several tabs opened and was really confused for a few seconds while I tried to find the tab with 'youtube on autoplay'.

Firefox needs to show the 'play' icon for the audio tag.

<comment><USER20> For what it's worth, Chrome tells you which tab audio is playing from, it's nice.

<comment><USER21> I think Chrome is able to do this because it separates tabs into processes, but I don't think there's a good way for Firefox to do it since everything is in a single process.

[https://bugzilla.mozilla.org/show_bug.cgi?id=486262](https://bugzilla.mozilla.org/show_bug.cgi?id=486262)

<comment><USER22> I don't think this has to do with multiprocess. The instance of HTML engine (geckk?) just needs to track who used the audio API.

<comment><USER23> I think the problem with that is it doesn't work with Flash audio. With multiprocess browsers, the Flash audio can be associated with a tab, but that's awkward/not possible if everything is in the same process.

<comment><USER24> Chrome didn't have this feature for a very long time, and if anything sounded like it was actually harder because of how Chrome handles their processes.

</comment></comment></comment></comment></comment></comment><comment><AUTHOR> Who.is have fixed it now, but you can still see it in action over at archive.org

[https://web.archive.org/web/20140918191824/http://who.is/dns...](https://web.archive.org/web/20140918191824/http://who.is/dns/jamiehankins.co.uk)

<comment><USER25> oh my god, it's even more entertaining with the wayback machine's page header.

</comment></comment><comment><USER26> I've found about 80 TXT records with "

       jamiehankins.co.uk.	33	IN	TXT	""

</comment></comment><comment><USER60> FYI it looks like who.is fixed the XSS bug.

</comment><comment><USER61> good hack but really stupid of me to click it directly :\

</comment><comment><USER62> I wonder how this got so much points.. Reflected XSS in 2014, yeah..

</comment><comment><USER63> What's up with the search box?

<comment><USER64> That is from topkek.js. Pretty clever! It plays the harlem shake song. One element shakes by itself until the second phase of the song, then lots of other elements start shaking.

Cleverness aside, it is practical when looking for XSS vulnerabilities because it's _very obvious_ when you've succeeded in injecting your code.

</comment></comment><comment><USER65> That made me laugh, good one :)

</comment><comment><USER66> man...I woke up and got a dose of surprise....love this song.

</comment><comment><USER67> isn't this technically illegal to demonstrate haha?

<comment><USER68> Why on earth would it be illegal?

<comment><USER67> dam, that got downvoted into oblivion haha. honest question...

although i dont believe it should be, a third party injecting javascript to demonstrate an exploit might be...

<comment><USER69> He hasn't injected anything. It's just his public DNS record that this page has chosen to display without sanitizing.

<comment><USER70> I imagine the UK Computer Misuse Act (eg at Section 3, [http://www.legislation.gov.uk/ukpga/1990/18](http://www.legislation.gov.uk/ukpga/1990/18)) probably covers it if the person who altered the TXT field does so to cause websites to load code on purpose, that purpose being for example to impair (Section 3(2)(a)) the running of the computer [causing Rick Astley to play, defo counts!] - but it can be read to cover pretty much anything.

Similarly I imagine something like the CFAA (18 USC 1030) probably has broad enough clauses to make this sort of action technically illegal, at least in some cases? But I'm out of my depth on that one.

<comment><USER67> at least the UK has something somewhat specific (and actually fits XSS quite well).

CA 502c just says: "(3) Knowingly and without permission uses or causes to be used computer services" amongst other very broad subsections

[http://support.piercecollege.edu/1521a/References/California...](http://support.piercecollege.edu/1521a/References/California%20Penal%20Code%20Computer%20Crimes%20Section%20502.aspx)

</comment></comment></comment></comment></comment></comment><comment><USER71> Wonderful!

</comment><comment><USER72> Luckily it does not work on my normal browser: [https://www.whitehatsec.com/aviator/](https://www.whitehatsec.com/aviator/)</comment>


Satellite images expose China's network of secret re-education camps in Xinjiang - <AUTHOR> https://www.abc.net.au/news/2018-11-01/satellite-images-expose-chinas-network-of-re-education-camps/10432924 <comment><USER2> A previous report on this outrage [https://www.bbc.co.uk/news/resources/idt- sh/China_hidden_cam...](https://www.bbc.co.uk/news/resources/idt- sh/China_hidden_camps?fbclid=IwAR18LUvgdxBW8i1FU3Wh6mclx4VcIyUKU-d0zVLUHt1eGpLwM58MGMDFrVw)

<comment><USER3> You can't read that in China. DNS is intercepted and overwitten - *.bbc.co.uk is directed to a random IP address that is typically in an AS that should be somewhere in the US, at one point it was a netblock owned by facebook, although with a 20ms response in Beijing.

Same applies to many other sites. To westerners, the Internet is effectively unusable until you establish a vpn.

HN works though.

<comment><USER4> Can someone explain why a netblock owned by Facebook would have a 20ms response time in China? Does Facebook have Chinese servers?

<comment><USER5> I assume the inference is that the Government is hijacking the address within China and routing it to a state-controlled server.

So they could make it plausibly look like it's coming from a foreign IP while locally censoring the content on the site.

If you have control over the network, hijacking the whole site is easier to do than trying to MITM traffic between users and the site, since HTTPS would hinder your efforts. As long as you don't start to do it too late that people have HSTS information saved in their browsers.

<comment><USER6> And for that there is HSTS Preload.

[https://hstspreload.com/](https://hstspreload.com/)

</comment></comment></comment></comment></comment><comment><USER7> Was this article flagged in some non-visible way? I don't see it anywhere in the first 7 pages, despite having 123 points and a post time of just 16 hours ago. (Only noticed when I came back to it hoping for a reply to an earlier comment.)

<comment><USER8> Because not everyone is interested in constant China bashing news on homepage, especially from abc.net.au.

[https://news.ycombinator.com/from?site=abc.net.au](https://news.ycombinator.com/from?site=abc.net.au)

</comment></comment><comment><USER9> And will we abandon China's next Davos in the X conference as fast as we did Saudi?

<comment><USER10> I mentioned this in another thread recently but I heard many companies whose CEOs abandoned the Saudi conference still sent representatives in their stead. For PR reasons they distanced themselves but they don't really want to abandon the Saudis.

<comment><USER11> Money rules and the CEOs have shareholders to answer to. Making it look good in public is more important than actually taking a stance.

</comment></comment></comment><comment><USER12> It's not secret anymore. The government has explained what they are. And so called re-education camps are not uncommon in other parts of China at all

<comment><USER13> In 1944 they were called 'work camps'. re-education does sound a bit more friendly so there is progress in propaganda.

<comment><USER14> And ATM in the US they're called detention camps for enemy combatants.

<comment><USER15> There are 40 enemy combatants held at Guantanamo. They have public legal representation and visitation rights.

China has removed all human rights for over ten million Uyghur Muslims. Including freedom of movement, freedom of religion, tight restrictions on behavior, tracking of all communication and movement, restrictions on who you can meet or talk to, tracking of all Urghar family members in China or abroad, non-existent freedoms around speech and expression, total lockdown on press investigation or discussion, forced re-education.

And then for at least a million Uyghur Muslims, they're outright physically and mentally torturing them in camps through forced programs to destroy their culture and beliefs.

Please enlighten me as to how that compares to what the US is currently doing with Guantanamo. I believe the detainment facility at Guantanamo should not exist and should have never existed. There's an important on-going debate there. There's no reasonable comparison to be had between Guantanamo and Xinjiang, whether in scale, intent, or context.

<comment><USER16> My high school physics teacher escaped from the region fearing for her children's safety and future. I have to disappoint you that the story is not about a Uygur woman escaping from the horrible CCP re-education camp, it is the complete opposite - my high school physics teacher is a talented Han Chinese woman who escaped from endless Uygur terrorist bombings on Han Chinese civilians.

She told me that a full bus of students from her school were killed in a Uygur terrorist attack. Sadly, they didn't have access to any guns to defend for themselves. There was no government intervention under the banner of autonomy. For people like my physics teacher, the only viable choice was to leave the region and reallocate the whole family to Han majority places.

To be frankly honest with you, CCP has probably 95% support from we Han Chinese on those re-education camps - the other 5% are probably asking for even tougher policies. You can paint Muslim as a peaceful religion or whatever you want, Han Chinese don't buy political correctness. Your attack on the Chinese government on matters like those re-education camps are being considered as the proof that CCP is working its ass off protecting the interests of all those non-Muslim Chinese citizens.

<comment><USER17> Thank you for honestly sharing your perspective. Unfortunately a fear-based approach reliably creates what it fears. If the proponents of a culture want others to do adopt their culture, they may do so by inspiring others through their compassion, generosity and self-sacrifice. This is the trust-based approach. Unfortunately it is rarely done because it is counter-intuitive and requires systematically setting aside all anger, forgiving when forgiveness is not deserved and making oneself vulnerable. Both approaches often result in casualties, but while one results in people dying attempting to enforce their will on others, the other involves people dying in an attempt to show compassion. The latter is profoundly persuasive in favour of the giver of compassion while the former incites profound hatred.

<comment><USER12> Except it's not a fear based approach. The re-education camp are - like it's name - for re-education. The Chinese government want these Muslim extremists to learn enough skills to live a normal life. If they can make a living like everyone else, they'll be much likely to become a terrorist. It's a better outcome for everyone

</comment></comment></comment></comment></comment></comment></comment><comment><USER18> related: [https://www.aspistrategist.org.au/mapping-chinas-re- educatio...](https://www.aspistrategist.org.au/mapping-chinas-re-education- camps-the-power-of-open-source-intelligence/)

</comment><comment><USER19> It's strange to see this thread full of outrage over China's acts and demanding they give the Uyghur their sovereignty when Xinjiang borders Afghanistan. Nothing they are doing is worse than the seventeen years that the US has held sovereignty of Afghanistan, resulting in hundreds of thousands of dead.

<comment><USER15> What would make you think there's a lack of outrage related to the US and Iraq + Afghanistan? Did you miss the massive global marches against the Iraq invasion? It's routinely brought up in discussion threads here and everywhere, and has been for 15 years now. If you want to criticize the US on human rights, the #1 go to point in every discussion is either the Iraq/Afghanistan wars (or incarceration policies in the US). It's immediately brought up, without exception. There has never been a lack of outrage about the US involvement in those countries.

<comment><USER19> >There has never been a lack of outrage about the US involvement in those countries.

Yet the sovereignty of those countries is still in US control, thee were 10,000 civilian casualties last year just in Afghanistan, and an ever increasing amount of countries face the same fate.

We should address our own atrocities if we want to shame the Chinese for theirs.

</comment></comment></comment><comment><USER20> It's hard to defend China here but it's also hard to see how they are supposed to handle the Uyghur question, and articles like this certainly don't give useful suggestions. What do you do with a region full of separatist agitators who frequently resort to violence and refuse to even teach their children Mandarin? Leave them to it and tolerate the bombings? Allow them to secede?

There's a long history here and after decades of failure, China is beginning to turn the screws, in typical heavy handed style. But I'd genuinely like to know what people think the alternative is with a near-rebel province.

One quote from the article which I think sums things up:

> "I cannot bear keeping silent [any more] because I think there's a genocide > taking place in East Turkestan," he said, using the name many Uighurs use to > refer to their homeland.

This chap has unwittingly hit the nail on the head. China cannot, and will not, allow the separatist movement in the Xinjiang region to proceed further.

<comment><USER14> > Allow them to secede?

Is that a serious question? If a people no longer wants to be part of a country they should be allowed to secede. The Scottish tried it via a democratic route - which would have succeeded with a wide margin post-Brexit. Actually, the British voted to secede from the EU. The Catalans want to secede from Spain.

But that's besides the point - you're almost implying that it's OK to put people in concentration camps.

<comment><USER21> The EU is not a nation state

Scotland has a very unique history in this

Catalunya is not gaining independence and the central Madrid government has declared their referendum illegitimate and illegal.

People cannot vote their way to secession, even in democracies.

<comment><USER22> That depends on the democracy. You mentioned Scotland already (and there's nothing particularly unique about it). Then there's Canada, where the Supreme Court has specifically outlined the rules for Quebec (or any other province) to secede - but acknowledged that there is a basic right to do so. One could argue that ability to handle peaceful secession is simply the next stage in evolution of liberal democracy, and those that allow for it are more advanced than those that do not.

</comment></comment></comment></comment><comment><USER23> This is just another try to demonize that country. Do these people (especially those from CNN and BBC) really care about the fate of the prisoners?

<comment><USER24> You make it as if it would require some creative work do paint China in a bad light when the facts are more then enough and that's what is happening here. Facts. Reality.

It's interesting though that you simultaneously know that this makes China look bad but instead of blaming those who cause it (Chinese government) you chose to blame those who report it. Why is that?</comment></comment>


Relocatable virtualenv - <AUTHOR> http://www.soasme.com/2016/03/26/relocatable-virtualenv <comment><AUTHOR> I was wondering what you guys deploy python project dependencies. I made a small tool to package project&wheels and create virtualenv at server. Does anyone have better ways to do it?</comment>


Twitter like Search with jQuery and Ajax. - <AUTHOR> http://9lessons.blogspot.com/2009/08/twitter-like-search-with-jquery-ajax.html

<comment><USER2> Sinu9i, take the time to learn how to program before you start teaching it to others:

      if(search_word=='')
      {
      }
      else
      { ..

<comment><AUTHOR> What is your problem ?</comment></comment>


Twitter 'in early talks with potential buyers Facebook and Google' - <AUTHOR> http://www.guardian.co.uk/technology/2011/feb/10/twitter-talks-buyers-facebook-google

<comment><USER2> Dup: <http://news.ycombinator.com/item?id=2201616></comment>


How GitHub and LinkedIn Will Help Microsoft Drive the Cloud Revolution - rising-sky https://www-forbes-com.cdn.ampproject.org/c/s/www.forbes.com/sites/bobevans1/2018/06/11/how-github-and-linkedin-will-help-microsoft-drive-the-cloud-revolution/amp/ <comment><AUTHOR> LinkedIn may be looking like a decent acquisition right now, but my god it feel awfully old to use, and I'm not sure how long the first-mover advantage will mitigate these shortcomings. Performance-wise, LinkedIn seems a step slower than not just Facebook or Twitter but even products from younger companies. The website is not very responsive, especially when displaying more than a few screenfuls of content, and the mobile apps are equally bad and lack any kind of smoothness.

</comment><comment><USER2> The transformation of Microsoft into an opensource champion almost makes me feel old when I remember those days :) way to go, Microsoft and respects to Satya Nadella who managed this transformation.

<comment> rising-sky Pretty remarkable, and seems very genuine which is quite astonishing given their history

<comment><USER3> It seems genuine because they have great PR people and also people seem a bit dumber today. They forget things, and they trust bad actors at their word if it seems they want to change.

Google also appears like a force for good in people's minds. Microsoft just decided to use the same tactics.</comment></comment></comment>


Houston man charged with child porn possession after Google cyber-tip - <AUTHOR> http://www.khou.com/story/news/crime/2014/07/30/houston-man-charged-with-child-porn-possession-after-google-cyber-tip/13378459/

<comment><USER2> Wait, what? Gmail is reading the content of email messages, and giving them to law enforcement? There are a bevy of constitutional issues with this.

Now, I will preface this by saying that child molesters are despicable, no one will argue that. But because they are so vile, they make great test cases for pushing the boundaries of search and seizure law.

But the problem is that once the courts create a legal rationale to justify Google reading the child molester's email, that rationale can be applied to anyone.

So there's a whole host of defenses that could be raised:

1\. The Wiretap Act - prohibits interception of electronic communications by private entity. Even Google's automated scanners, if applied to Gmail, could fall afoul of this law.

2\. The Stored Communications Act - The Fourth Amendment creates very limited protections for stored electronic communications like email under the "third party doctrine." The third party doctrine essentially states that you have no privacy rights under the Fourth for any information you voluntarily send to another company or individual. The rationale being that, since you knowingly transmitted it, there is no reasonable expectation of privacy.

However, The Stored Communications Act, part of ECPA, creates several statutory quasi-Fourth Amendment rights for stored electronic communications, especially email.

3\. Agent of the State

This is the weakest argument, but essentially the defendant could argue that Google was acting at the behest of the government, and thus full constitutional protections would attach. The rationale here is that Google and law enforcement were working so hand-in-glove that Google was a de facto state agent. This would make it very messy, as more powerful Constitutional protections would attach.

Now, the bottom line here is that Google is reading content and transmitting it to law enforcement. I'm sure the right to read your email is in their ToS, but that could be successfully challenged if the language is either too narrow or overly broad as to be vague and thus void (two mistakes highly-paid attorneys make quite often.)

EDIT, in response: Yes, that's true. You'd need to show sufficient public- private nexus to have a chance in the criminal prosecution. But if you can brush Google back off the plate a bit using the private causes of action in #1 and #2, you may be able to get the discovery you need to prove the state-agent argument. For example, I guarantee Google has government Powerpoints floating around about activities certain agencies would like reported.

<comment><USER3> Actually, #3 is the only thing like a "defense" that can be raised. #1 and #2 might provide legal causes of action _against Google_ , but unless Google is acting as an agent of the state, the exclusionary rule doesn't apply, because the exclusionary rule only applies to information that results from an illegal search and seizure by the state (including private parties acting as state agents), not to evidence illegally obtained by a private party acting independently of the state which is then transferred to the state. So, _even if_ the information was illegally obtained by the arguments that fall in categories #1 and #2, that's not something that's useful to the defense in a criminal prosecution without #3.

</comment></comment><comment><USER4> [https://news.ycombinator.com/item?id=8125039](https://news.ycombinator.com/item?id=8125039)

</comment><comment><USER5> This is where the ethics around privacy get really difficult. On the one hand Google should respect everyone's privacy, but on the other the man is a child pornagrapher.

<comment><USER6> The universal disdain for child pornography allows society and law enforcement to push the boundaries of law enforcement in a way that will be universally agreed with.

What worries me is that once these boundaries are crossed for one very important reason, the precedent can become justification for crossing them for other less universally-acknowledged reasons.

If Google knows the content of this guy's email account based on hashes of attachments, that means they have hashes for ALL of the images in his account, and only flagged the ones that were on the list for child porn content. But I'm pretty sure the ability to identify all other content in his account by hash is laughably easy. In order to know what content isn't kosher, you have to be able to tell what content IS.

Say someone has pirated digital content in their account - an archived movie or mp3 or something. What would stop Google from coughing up the email addresses of everyone that had that particular attachment in their account in response to some zillion-dollar lawsuit by the entertainment industry?

And if your immediate response would be "but they wouldn't do that", why would you think not? Short of the morals or ethics of the human beings at the switch, what would stop them? The technology is there, and obviously working, why not use it to further advantage?</comment></comment>


FAST Goals Beat SMART Goals - <AUTHOR> https://sloanreview.mit.edu/article/with-goals-fast-beats-smart/ <comment><AUTHOR> According to conventional wisdom, goals should be specific, measurable, achievable, realistic, and time-bound. But SMART goals undervalue ambition, focus narrowly on individual performance, and ignore the importance of discussing goals throughout the year. To drive strategy execution, leaders should instead set goals that are FAST — frequently discussed, ambitious, specific, and transparent.</comment>


IBM: Like the Web, virtual worlds will be become business friendly - <AUTHOR> http://news.com.com/8301-10784_3-9730042-7.html?tag=bl <comment><USER2> It's hard to say exactly why, but the picture in this article looks like one from The Onion.</comment>


Pixar's use of Harmonic Functions - <AUTHOR> http://www1.ams.org/samplings/feature-column/fcarc-harmonic

<comment><USER2> The article is about a vertex weighting system Pixar came up with to deform complex polygonal meshes to track simple skeleton meshes, like you need for character animation. The main problem they wanted to solve was limiting the sphere of influence of skeleton vertices in the presence of concavities in the skeleton. An alternate approach was presented here ( [http://blog.wolfire.com/2009/11/volumetric-heat-diffusion- sk...](http://blog.wolfire.com/2009/11/volumetric-heat-diffusion-skinning/) ) and discussed on HN some months back. I'm not sure which method produces a better result (heat diffusion certainly is more computationally intensive), but heat diffusion seems like a very natural way to solve the problem. Essentially, to determine a skeleton vertex's influence on a model vertex, you don't want the distance between the two "as the crow flies," but rather the shortest path _within the skeleton_ between the two points. Perhaps a pathfinding algorithm could do the job more efficiently than heat diffusion?

<comment><USER3> Actually these two methods are basically the same. As the AMS article states "the steady-state temperature distribution of some region in space is described by a harmonic function." If you look at the method of relaxation described in the ams article, "move across the grid and replace the value of the function at a point by the average of adjacent points," it's the same as the method described in the Wolfire article, "set each voxel's heat to a weighted average of its neighbors' heat."

<comment><USER2> You're right, though I think the implementations differ in that Wolfire uses skeletons made of bones (line segments) and Pixar uses a polygonal cage mesh as the skeleton. It is quite possible that if you view the cage mesh as the 3D extrusion of a Wolfire-style skeleton, the results are exactly equivalent, but I'd have to think about it more.

OT: what are the pros/cons of the two character modeling approaches (cage vs. skeleton)?

<comment><USER4> Perhaps its easier for animators to see the influence of a cage on a vertex, rather than a bone? I was wondering about this.

The cage is a nice wire-frame around the object of interest, and you can easily see how close the skin is to the cage, for some kind of intuition about influence.

With bones and vertex to bone weighting, you'd need some other visualization (like false-colour on the vertices) to show how much each vert is influenced. Also, the cage seems to remove the conceptual problem of a vertex being driven by multiple bones.

Hmmm. This is timely. Thanks!</comment></comment></comment></comment>


New YC Database, Much More Info Than Others - <AUTHOR> https://www.producthunt.com/posts/ycdb-the-y-combinator-database <comment><USER2> Direct link: [https://www.snappr.co/ycdb](https://www.snappr.co/ycdb)

Looks relevant since [http://yclist.com/](http://yclist.com/) lacks the three latest batches. YCList has fellowships though.

</comment><comment><USER3> If it is a public dataset how can it be downloaded?</comment>


Mod Notebooks' Launch - <AUTHOR> http://needwant.com/p/mod-notebooks-91470-launch/

<comment><USER2> The page loads fast but the images are crawling, they really need to get these things on to a CDN or scale them down to the size they are displayed at (the file size of one of these things that I checked is 2 megabytes, and the server is transferring at 50KB/s or less)

<comment><USER3> Because their images are: 3264×2448 and they are using the browser to scale.

<comment><AUTHOR> whoops, need to fix that.

</comment></comment></comment><comment><USER4> Here's their website: [http://modnotebooks.com/](http://modnotebooks.com/)

The secret is that you mail the notebooks back to them and they digitize the contents for you.

<comment><USER5> I don't understand the attraction to this service. For me, scanning the notebooks would be good if there is some way of intelligently cataloging it, and make it searchable.

I avoid writing stuff in my notebook that I know I need to find in the future. I put into in an email and search it via Google search. Drawings and sketches are different categories. I would scan then and attached it to an email. The message of the email would provide context.

I think what Mod is providing is only half of the solution. At the moment, it is the same as "only to forget them forever when I leave it in a dusty box somewhere", only digitally. For me at least.

<comment><USER6> Definitely agree with this - but this service combined with handwriting recognition to make notebooks searchable (a la Evernote) would be perfect!

<comment><USER5> That is almost the final mile problem for this - doing OCR on handwritten notes.

</comment></comment></comment></comment><comment><USER7> Congrats to the team for a successful launch. I will be interested to see how this scales.

PS: Please make your images smaller - I only saw the first 50% of your images by the time I was done reading

</comment><comment><USER8> Has the Snapscan scanner or equivalent become uncool for generation Y ?

<comment><USER9> Why do people use K-Cups? Why do people use tea bags instead of tea leaves? Why are microwave/takeout meals so popular? Why are washing machines and dishwashers more popular than doing it by hand? Why are battery powered watches more popular than wind-ups?

One word: Convenience.

It is easy to believe that people will pay for it, just look at the history of the last one hundred or more years. Convenience has trumped almost all other considerations (including enjoyment in a lot of cases).

So the only question that needs to be asked is: is this more convenient than the alternatives (e.g. tablets) or is the lower convenience worth the lower cost relatively speaking? I don't know, but that is the question to be asking.

</comment></comment><comment><USER9> Love the concept. Too bad their web-site is buggy. When I visit i get a pop- over which reads:

> Not ready to order yet?

> Get 15% off by entering your email address below

Blocking out the web-site and not allowing me to do anything on it (until presumably I give them an email address). In order to view the site at all I had to set display: none from the development bar on div class="modal- background--light js-exitintent-modal-background is-top is-shown" which isn't the best user experience ever.

Not sure why you'd do that? Fortunately it doesn't appear when I visit the site on mobile (or emulated mobile) just PC.

<comment><USER10> not intuitive, but you can just press escape.

<comment><USER9> Escape does nothing. I tried changing the focus (background, pop-over, email box, etc) and escaping, still does nothing. Cannot clear it.

Even hitting the "join" button just opens a new tab without closing it.

</comment></comment></comment><comment><USER11> Title made more sense before changed, as now it seems like it is just launching. Previous title was "Mod Notebooks $91,470 Launch"

</comment><comment><USER10> why do you have to buy their notebook to get it scanned in? I feel like since the differentiator is the ability to get things digitized, why not just sell the scanning service instead of having to deal with inventory?

<comment><USER9> I'm not them, but I'd imagine that scanning different form-factors would be more expensive and complex. For example, users now have to measure your books (length, width, and depth) in order to check they're conformant.

Also as the binds have to be cut off to scan, third party books with things like metal ring and plastic binds might be a pain to disassemble.

</comment></comment><comment><USER12> I love these guys</comment>


Gnome Foundation Budget Troubles FAQ - <AUTHOR> https://wiki.gnome.org/FoundationBoard/CurrentBudgetFAQ <comment><USER2> Perhaps this is an opportunity for Gnome users to bribe the foundation to revert some of Gnome's insane UI decisions. Example: A series of kickstarters such as "Bribe Gnome to remove pop ups that say 'Your window is ready'" or "Bribe Gnome to let me Hibernate my computer again".

<comment><AUTHOR> I never understood people's attachment to GNOME. When GNOME 3 came out I didn't like it so I permanently switched to XFCE. What is it that GNOME devs do that is so valuable and unique? Why are distributions committed to waiting for years for it to improve despite the users' ire?

<comment><USER3> I run GNOME 3 because it underpins Debian and Debian is the least fragmented developer-friendly Linux desktop. It's got the reliability I need for a work environment and the shininess that makes me happy and is as usable out-of-the- box as OSX, Windows 7, or Ubuntu. Also I appreciate Abiword and Gnumeric, GNOME's word processor and spreadsheet respectively, for sucking the least among their FOSS alternatives. I donate.

<comment><USER4> Debian shipped Xfce for a while as the default (I'm not sure what the latest default is).

[http://www.omgubuntu.co.uk/2013/11/debian-8-0-switches- xfce-...](http://www.omgubuntu.co.uk/2013/11/debian-8-0-switches-xfce-default)

In general, most of the GNOME devs work for Red Hat. Debian is not really that closely associated with GNOME, and a lot of the Debian devs have gotten annoyed by GNOME decisions in the past. I think the latest example was when GNOME started to depend on systemd, some Debian developers were annoyed.

<comment><USER3> Thanks for the info. I trust Debian to make good decisions about the new init system and the default desktop environment. If they go with Xfce I will not complain (and it'll be a nice boon for Xfce development; potentially a win- win).

<comment><USER4> I like Debian as well. I wish they were more popular than "that other distro" that copies their work without contributing much back. I think the move to systemd is a good idea.

</comment></comment></comment></comment></comment></comment><comment><USER5> TL;DR version: Invoice/accounts receivable managment was subpar and there have been large expenses. Now there's a liquidity problem.

Not an uncommon problem in non-profits/voluntary organizations.

</comment><comment><USER6> I really feel all the haters here are emotionally attached to GNOME deep down their hearts. Also, I feel that they want GNOME 3 to prove them wrong, to succeed, but not on their desktops ... maybe on their tablets. I felt the alienation too buddies, but maybe GNOME hasn't forgotten us after all, by introducing GNOME Classic ([http://www.networkworld.com/community/blog/new- classic-mode-...](http://www.networkworld.com/community/blog/new-classic-mode- forking-gnome-3-waste-time)). I urge everyone of you to donate, not just because of this crunch. Donate to fulfil your expectations from GNOME, to see GNOME 3 succeed, maybe on your tablet. We, the open source hackers build such foundations. Foundations that aren't like hoarders Samsung & Apple who burn their money away on destructive litigations. Support GNOME at [http://www.gnome.org/friends](http://www.gnome.org/friends) A friend in need is a friend indeed :-)

</comment><comment><USER7> > If anyone is familiar with Guile/Scheme, the Foundation would benefit from a > custom printable invoice stylesheet for GnuCash. Contact the board for a PDF > of what it needs to look like.

This is almost too good to be true. :)

</comment><comment><USER8> Idea: spend money on development, not "outreach foundations". The director took donations intended for one purpose and used them to fund political pet projects in another. She resigned before the 2013 financial reports came to light.

</comment><comment><USER9> "we made assumptions based on previous years' incomes and expenditures [...]. Those assumptions proved to be more optimistic than reality."

The foundation overspent on the OPW program. But I can't help wondering ... isn't the budget problem a direct result of Gnome getting less ans less popular over the years ?

When the user base is shrinking, so will the donations, hence the budget problems, right ? People make donations to projects they supports. As developer are not willing to listen to its user base, why would they donate ?

<comment><USER10> Instead of just baseless thinking out loud, let's turn to some actual facts:

[http://www.gnome.org/foundation/reports/](http://www.gnome.org/foundation/reports/)

Their 2012 annual report in particular says:

"Corporate sponsorship ... up 41.6% from the previous year."

"Personal donations rose by 45.4% ... this appears to be the highest amount of personal donations that the GNOME Foundation has ever received."

If you've got some real reason to believe 2013's finances are different, and believe the foundation is lying about their reasons for the shortfall, then do let us know.

<comment><USER9> I've never said they were lying. And as stated, I was "wonderind" or "thinking out loud" as you put it. Should have checked the facts, you're right, I stand corrected.

But still, there are reasons to think 2013's finances are different. They said they've overspent based on projection on previous years income. Maybe it still growing but not as much as expected. We'll see in the 2013's report.</comment></comment></comment>


Hacking back, the worst idea in cybersecurity, rises again - <AUTHOR> http://www.slate.com/articles/technology/future_tense/2017/10/hacking_back_the_worst_idea_in_cybersecurity_rises_again.html <comment><USER2> Cutting out all the condescension, the core argument appears to be that this is a bad idea, because of the uncertainty involved. While this isn't a bad argument, I don't find it fully convincing. Are there any other concerns?</comment>


Ask HN: Is e-commerce the easiest way to make money online?  - <AUTHOR>

Hi,
I have been reading a lot about setting up an estore & drop shipping since coming across this thread. https://news.ycombinator.com/item?id=5377821
Just wondering, is ecommerce and drop shipping one of the surest and most direct ways to make money online? I understand that it is unlikely that it will make you a billionaire, but it seems like with a bit of tech/SEO work and the right niche you could make a nice living for yourself.
Is this a fair assumption? I would be very interested in hearing from anyone who is running an ecommerce site or has tried and failed.
Thanks <comment><USER2> Bad assumption. Plenty of ways (too many to name) that can make money online. Some harder than others and ecommerce, drop shipping, and the like comes with its own set of challenges (big or small). It's more on how you execute something than it is thinking something will be a sure or more sure way of working

<comment><AUTHOR> Thanks for your reply. I understand that building a business is never going to be easy and that there will always be challenges. However, I guess the question I am asking is whether or not e-commerce is a faster route to sure profitability? For example, if I was to devote my time to building a social network it could potentially be very very lucrative. However, the likelihood of it being lucrative or ever even making money for that matter is a lot smaller than if I devote my time to ecommerce. This makes me think ecommmerce is a "surer" way of working(less risk).

<comment><USER3> The only way I know of speeding up the process is to get into a shady industry or take advantage of a loophole. Years ago there were websites making a lot of money simply by providing links to streaming movies & TV shows hosted on other websites.

I know a guy who made a million dollars from it. A year after he got out, all his competitors were getting sued and shutdown. But he was off the radar, got to keep everything and never got in trouble. He found the niche, created the website in a few days, made money for a year or two, and shut it down with precision timing to maximize profits and minimize risk.

<comment><AUTHOR> Thanks for your comment. That is an interesting story and something to think about. What is the loophole at the moment? Not that I want to get involved in anything shady. A lot of the time with start-ups there is a lot of risk with the possibility of massive rewards, however there has to be safer options(medium risk) without getting a corporate job or being a contractor.

<comment><USER3> Bittorent and Bitcoin make a millionaire every week, it's high risk though. You could start a tracker like Demonoid and your only job would be to move the servers around and cover your tracks (ie: pay with visa gift cards, use chained proxies)

Another high risk option is becoming a vendor on Silk Road. Those guys are getting more orders than they can handle. Even the guys who just resell/repackage are making a killing.

You could even open your own Silk Road, which is lower risk than being a vendor. Just collect your small fee off every transaction, while staying completely anonymous.

Most of this stuff probably seems pretty shady to most people. But anyone with 10-20k, some balls and smarts can become a millionaire from it, very quickly.

</comment></comment></comment></comment></comment><comment><USER4> Speaking from experience, there is very little margin in drop-shipping so you need to do a lot of volume. To do a lot of volume you really need to be spending on ppc ads. If you pour your heart into this and do about 1mm in sales a year you can expect to clear 80-120K. Just to warn you, to get to this level it might take 3 or 4 people working fulltime.

Making something and then selling it would be a better bet, but therein lies the rub. Once you buy product you need to house it and eventually ship it.

<comment><AUTHOR> Thank you very much for this.

I have been reading ecommercefuel.com and Andrew(webmaster) says you can get around the low margin by choosing a niche that requires a lot of additional information,e.g something technical and then pricing yourself higher than competitors. He argues customers will pay for the additional information and good customer service. E.g. help installing etc.

As someone who has been there and done that, would you agree with this?

</comment></comment><comment><USER5> Information marketing is easier than e-commerce. No physical products to ship

<comment><AUTHOR> Is the web not saturated with ebooks about how to train your dog etc. Are there other information products to sell?

<comment><USER6> Yes, I always think of information products as scams.Who really buys ebooks about niche X or Y?

<comment><USER5> lots of people</comment></comment></comment></comment>


Open-source macOS app I built that automatically refreshes your wallpaper - <AUTHOR> Hey guys, I thought I'd share the open-source app that I've been busy building this week! Wallpaper is a simple macOS app built with AngularJS/Electron that sits in your menubar and automatically refreshes your wallpaper with beautiful high-resolution photos from unsplash.com. Enjoy!<p>https://github.com/andypotts/macos-wallpaper-app <comment><USER2> Looks good from my brief overview, my only concern with these types of things are.

What happens when you are offline, does it resort to the last download? Are the downloads stored or fetched each time? Currently I store all my wallpapers in my iCloud Preview folder (helps with syncing multiple Macs and 1,250 wallpapers) and then just manually download daily from whichever sites, I'm sure I could automate that easil...

However I'd rather grab them myself than a script just for overall security, just in case, type situation.

Could be helpful if you allowed multiple sites to grab from either have a built in list or provide your own link. Keep it up.</comment>


Netflix promoted its new Charlize Theron movie with a girls-only esports tourney - <AUTHOR> https://urscrubb.substack.com/p/to-promote-their-cheesy-action-flick <comment><USER2> > In many ways it functioned as a testing ground for some underused concepts > that could substantially improve the health of the Apex scene.

> The possiblilty of bringing corporate sponsorship to broader competitive > Apex is interesting on its own. As bigger games like League of Legends get > in-game ad banners, I've been wondering about the giant banners that cover > Kings Canyon and World's Edge. This is fruitful virtual space for > advertisers to use, as ESPN's Arda Öcal pointed out on Twitter the other > day, making the comparison to hockey's use of board space for ads. I > wouldn't be surprised if we see both more sponsored tournaments in the > future, as well as creative use of in-game space to promote products.

Is this what 'health' means? Ads, product promotion, commercialization?

<comment><AUTHOR> Good question. Competitive Apex has struggled to maintain a stable roster of pros who can make a living from it, so for now, financial health and its associated evils (I guess in your view, product promotion, commercialization) are important. As a viewer, I believe that pro players should make a living wage, and I'm willing to tolerate ads or sponsored content to make that happen.

But you're right in a sense--scenes like Smash have thrived without money, but the pros in it aren't fairly compensated for their incredible skill and dedication.</comment></comment>


LulzSec takes Eve Online and Minecraft offline - <AUTHOR> http://www.geek.com/articles/games/lulzsec-takes-eve-online-and-minecraft-offline-20110614/

<comment><USER2> They may be non-malicious, but they show that someone with an intent to harm could do far worse and that most are completely unprotected.

Its better to expose problems than live with the false security that none exist. The false security leads to much worse breaches when they happen (see Sony) would be nice if Lulz hacked Sony 3 yrs ago and went public.

<comment><USER3> It sounds like a reverse lottery of pain to me. If LulzSec looks at you, you get to spend millions beefing up security while your competitors do nothing.

<comment><USER4> >If LulzSec looks at you, you get to spend millions beefing up security

...or, you know, be competent in the first place.

<comment><USER3> They can choose when and where to attack, but you have to defend everywhere all the time. I suspect we're in a situation where cost of being competent > probability of lulz * cost of remediation.

<comment><USER4> >I suspect we're in a situation where cost of being competent > probability of lulz * cost of remediation.

Yup, unfortunately this is true, and half-assing it because of this is what gets us onerous new internet legislation.

</comment></comment></comment></comment></comment><comment><USER5> Wait, is LulzSec actually doing anything interesting here or are they just DDOSing everyone? The EVE Online comment makes it sound like it's just a bunch of guys with LOIC...

<comment><AUTHOR> That's what it's sounding like. Minecraft seems to have restored services; EVE Online has confirmed it was a DDoS[1] and is still investigating. Escapist Magazine still seems to be down.

I think the only thing they're really proving is what we already know: nearly everyone is vulnerable in one way or another; robust security is tough.

[1] <http://twitter.com/#!/EveOnline/status/80732212898697217>

</comment></comment><comment><USER6> LulzSec is starting to sound like a false-flag operation to me...</comment>


Ask HN: What are some new growing industries? - <AUTHOR>

What are some new growing industries with low start-up costs?
I've been reading 'How To Get Rich' and it brought up something I hadn't thought of before: "As a general rule of thumb, then growing industries with relatively low start-up costs offer more opportunities for those who want to get rich than declining industries, or those that require huge start-up investment."
EDIT: How does one go about finding out what the growing industries/sectors are, and knowing which source to trust? <comment><USER2> I'm tempted to believe there might be a bright future for data startups[1].

[1] [http://radar.oreilly.com/2010/10/strata-week-building- data-s...](http://radar.oreilly.com/2010/10/strata-week-building-data- star.html)

</comment><comment><USER3> Industry reports are normally fairly good indicator, a market that's got double-digit growth normally has a stack of evidence behind it. For example the smartphone market, it has clear huge quarter-on-quarter growth with no sign of stopping.</comment>


Google releases the first new site hosted on the .Google top-level domain - <AUTHOR> https://com.google

<comment><USER2> Comments moved to [https://news.ycombinator.com/item?id=9301485](https://news.ycombinator.com/item?id=9301485).

</comment><comment><USER3> April Fools is the worst day of the year in the techsphere

<comment><USER4> I completely agree. It annoys me greatly.</comment></comment>


Red Programming Language 0.6.1: Reactive Programming - <AUTHOR> http://www.red-lang.org/2016/06/061-reactive-programming.html <comment><AUTHOR> Quoting from the beginning of the article:

 _[We don 't mean] yet-another-FRP framework[, but rather an idea] close to spreadsheet's model (i.e. Excel formulas). That model has often been praised for its simplicity and efficiency. You can now use it directly in Red._

 _So, in practice, what is it? It is a way to link one or more object fields to other fields or global words, by specifying relationships in a block of code (can be a single expression or a complex multi-step computation). Each time a source field value changes, the target value is immediatly updated, you don 't have to call a function for that, it's pretty much define-and-forget._</comment>


Aussie ISV buys ads to wake up Google support - <AUTHOR> https://www.crn.com.au/news/aussie-isv-buys-ads-to-wake-up-google-support-529698 <comment><USER2> I helped my mother reformat her computer remotely. We successfully ported her mail client but managed to lose her gmail password - meaning we had enough access to send/receive emails but not create new sessions. The account was created some time in 2006. A week prior to the reformat she had changed jobs, and lost the mobile phone number associated with her account.

The second factor email was associated with my account, I could see reset codes come through which were relayed to her but would result in an 'oops, something went wrong'. My guess is a bug due to account age / whatever.

I figured we had enough evidence to obtain a password reset, so I googled for gmail support contact details. There are none.

I then tried repeatedly to contact Google via twitter, all my tweets were ignored - probably because I only have like 20 followers.

In the end, my mother ended up porting her old mobile number to a prepaid sim, as $previouscompany had disconnected the number entirely, and used that as the second factor to reset the account.

Pretty damn frustrating that Google doesn't have any unpaid inbound support _AT ALL_.

Next time I'll consider paying a twitter influencer to impersonate me (or my mother), or paying for adspace, or using a mail service that exposes at least some form of support.

<comment><USER3> > Pretty damn frustrating that Google doesn't have any unpaid inbound support > _AT ALL_.

Frustrating? Yes. Surprising? No.

Afaik, there isn't even any paid support for individual customers unless you have some sort of business account. I find this a bit unreasonable, but I wouldn't expect any free service that involves a paid employee from any service I don't pay for (with money, not privacy).

They can't be making many dollars per year per user. A single support call answered by a human would take years' worth of income from said user. I'm amazed at how many people do not realize this, and still rely on these "free" services even for their jobs.

To give an example: recently, a popular blogger lost their Instagram account and it was sold to a 3rd party (because they had lots of followers, I suppose). Blogging is their day job and Instagram is a major source of readers for them, so they depend on it for their living. The account was probably stolen by using a reused password from some password dump and they didn't have 2FA enabled.

In the end, the blogger got back their account because they were a part of a traditional media publishing organization which had a business account with Facebook, Inc and were able to escalate it that way. Had they not had this account, it would have been lost.

There are lots and lots of professions where social media presence is required to bring in the customers (e.g. woodworkers these days depend on Instagram!) or even monetization from their account directly.

If you depend on Google, Facebook, Youtube, etc to earn a living, you should consider a business account or at least do your best to secure the account (2FA, no password reuse, etc).

<comment><USER4> They way I look at it, Google treats support in the same way that Amazon treats APIs.

In that they know they're making a choice with consequences and pain. But they see the _strategic_ value of that choice (never running a support org) as outweighing the _tactical_ pain.

Additionally, I'd guess the internal opinion is "If users need support, then something is broken and we should just fix it."

Where I think this falls down, which Microsoft learned 30 years ago, is that:

(a) Unless you're asking, you're not going to surface visibility of broken things. Users will just find a way to deal, while being pissed off. And then some product team finds out there's been a major issue for the last 5 years.

(b) Unless you're actively soliciting feedback from your customers and users, you're at high risk of building the wrong thing. We see this with enterprise GCP frequently. "Oh, you need Y feature? We never thought about that, because {insert internal way that Google does things, but no one else does}."

<comment><USER5> If Google knows they're not legally compelled to provide support they just don't. That's why their support can scale to Play Store's 2 billion users but not Gmails.

If the EU ever gets around to forcing Google to support their users regardless of how they are enriching Google the moral of the story will be they saved billions by waiting until litigation. Just like taxes.

<comment><USER6> What support do you get for free apps in Play Store?

<comment><USER5> Phone and email - the apps might be free but they still had to purchase a Google-powered device to get free apps.

[https://support.google.com/googleplay/answer/7299936](https://support.google.com/googleplay/answer/7299936)

[https://support.google.com/googleplay/answer/7100415?hl=en](https://support.google.com/googleplay/answer/7100415?hl=en)

</comment></comment></comment></comment></comment></comment><comment><USER7> Back when there were telegrams, I once sent a telegram to Kentucky Fried Chicken corporate HQ to complain about a franchisee that was leaving unsold food under the heat lamps for so long it tasted awful. KFC happened to be one of the few nearby eateries open late. Cost about $20 to send a telegram, which was delivered by a Western Union messenger.

I was contacted by KFC corporate HQ and given lots of coupons. Then I was contacted by regional HQ and given more coupons. Then by the franchisee. More coupons and an apology. The food quality improved markedly. For a while.

<comment><USER8> > The food quality improved markedly. For a while.

Until you ran out of coupons?

<comment><USER9> Free food always tastes better, right?

<comment><USER10> Not necessarily. Not always.

</comment></comment></comment></comment><comment><USER11> Wow!! My company made HackerNews! Yeah, what an arseache it's been - and just checked and nothing has been actioned still despite the negative coverage. Google truly don't give a shit I'm afraid.

<comment><USER12> Great work! Out of interest why does an Aussie company charge in GBP?

<comment><USER11> We're a GDPR solution smooshed in with the questionnaire builder mate. Primarily aimed at the UK market, but with the California GDPR equivalent kicking off Jan 1st..

</comment></comment></comment><comment><USER13> I decided to escalate support with a major multi billion dollar tech company in a unique way... I took a one-way plane ticket to the city of their HQ, went to the front desk, then when I was rebuffed, i escalated my issues to a major news outlet. .. I also considered Facebook live right in front of their headquarters on public property, but fortunately didn't need to... I was very polite about everything... Never demanding or angry- always expressing gratitude for the incredible opportunity I had with this company! Amazingly, my unorthodox escalation procedure worked-- I wasn't sure if it would.

My point in writing this is to say- great job thinking outside the box! Even if you can't fly to Google HQ, continue to think outside the box. Some ideas include Hire someone at taskrabbit or Craigslist, or a FB jobs page, to go to their front desk, or if unsuccessful, to hold a sign on public property in front of Google's HQ, you can get a banner or sign professionally made (online process are pretty reasonably priced). You could Skype with your stand-in. It would be really fun to get a Skype video call on a big iPad... or try something else.

Everybody thought I was crazy. I was. Crazy people get noticed, and often get results. Whatever the outcome, being able to tell an awesome story is always fun! Good luck, mate!

<comment><USER14> I had a PM who's support strategy was to complain directly to the company's twitter handle. Apparently the people who run the social media accounts sit higher in the org chart than support staff because it almost always got us a faster response.

<comment><USER15> Also because companies are absolutely terrified of something negative going viral. It's why they instantly ask you to DM them to take all discussion out of public view. It's amazing what a simple tweet can get you when all else fails (unless it's frontier com., then they straight up block you).

<comment><USER16> Didn't work at all with Air NZ for me.

They had promotion on flights on their aussie website, but you can't spend airpoints on aussie site. Same flight on NZ website was nearly 2x.

Didn't work with Wizzair when they changed my flight time, notified I don't need to do anything and then charged 30€ for check in.

Didn't work with Air India - they don't even have Twitter (just wanted to change my flight date and you can just imagine how bad their call center is).

<comment><USER17> I've never had any success either, presumably because I have no followers on Twitter...

<comment><USER18> Probably the first legitimate use case for those "buy a follower" services I've heard of. $20 worth of followers and you'll suddenly get priority support by their social media team.

If only those services weren't seeded with compromised accounts, I wouldn't even feel bad about it.

</comment></comment></comment></comment></comment></comment><comment><USER19> I dismantled a business a couple of years ago. I let the domain lapse, dismantled everything. Forgot to cancel Google Apps. I noticed the charge still coming out of my bank account a while later, and tried to get it canceled. Couldn't log in, wasn't given the option to use the backup account, couldn't receive an email. Contacted google support. A few emails later they accept that I'm the person who is paying the bill, but refuse to cancel the account. Their last support message is "you'll have to dispute the charge with your bank".

On to bank support, who don't have a category for "service is being provided but refusing to cancel" _sigh_

Needless to say, never using a Google service again.

<comment><USER20> >Needless to say, never using a Google service again.

The only Google services I bother with are search, maps, youtube (in a non- logged-in viewing-only capacity, not a posting-my-own-videos capacity) and the android play store (paying for apps via gift cards). I don't trust google not to cancel new services on a metaphorical moment's notice, and I don't have any faith in reaching a human being if I have a billing problem. So I make sure not to tie my life in any way to my Google account.

It feels strange to say, as an old school Linux fanboy who vividly remembers the Halloween document release, but I tend to point "I want to move my business to the cloud" friends/acquaintances to Office 365 instead. Say what one will about Microsoft's scummy behaviour over the years, but no-one can claim they aren't into Office 365 for the long haul. And while it's not exactly easy to get a human being at Microsoft to fix a problem, it's certainly easier than Google.

<comment><USER21> I'm a Gsuite, maps and YouTube user. I want to move away from Gsuite and maps but don't think there are good alternatives.

CityMapper comes close but isn't there.

FastMail support is worse than Google and has fewer features.

<comment><USER20> >FastMail support is worse than Google and has fewer features.

Actually I use Fastmail, and am a big fan. I've never had an issue reaching support. Of course I've rarely had to, the service is pretty reliable.

As for features, I could flip that around on Gmail. Does Google _rigidly_ adhere to imap/carddav/caldav standards so that standards-compliant clients have no problems whatsoever in connecting, or are there still cheerful little "quirks" when trying to use non-official clients with Gmail?

<comment><USER21> I am weeks into trying to resolve a carddav issue with fastmail. Email support from them is lousy at best.

</comment></comment></comment></comment></comment><comment><USER22> Gotta post on Hacker News if you want some Google support!

<comment><USER23> Maybe OP is Google Support and he's found this is the best 'internal' escalation point for the forms he's seen come in and not been actioned. ;-)

<comment><USER24> Or OP is a Google shareholder and wants you to buy ads to solve all of your Googly problems.

<comment><USER25> It's not a great idea, but it's also not the worst idea - an adwords like bid system for google to respond to your support ticket.

</comment></comment></comment></comment><comment><USER26> I feel lucky to personally know Google employees. The times when I've had an issue and gone via the public channels there has been radio silence. Directly report it via a google employee and it generally gets dealt with. It should not be this way.

<comment><USER11> Mate, if you could possibly help me with this, is give a decent chunk to a charity of your choice.

</comment></comment><comment><USER27> As far as I know, Google Tag Manger is a tool to inject scripts into websites via an interface. So you add the Tag Manager script to your page and then you can tell Tag Manager via Google's interface to load additional scripts.

Why does anybody need Google's solution here so badly? It sounds pretty easy to develop such a thing.

<comment><USER28> I'm also curious what it does or why it is so vital. I've never needed to unblock it in NoScript, and as best I can tell nothing suffers. Does it do something useful server side instead?

<comment><USER29> Really? In my experience, blocking GTM almost always breaks some core functionality of the website I'm browsing.

<comment><USER28> Yes, completely serious. I've enabled it once or twice to see if a site was acting wonky because it was blocked, but it was never the culprit.

</comment></comment></comment></comment><comment><USER11> __UPDATE __

THING FIXED!

Media release and some of you here helped bigly yuge with the getting of Google to sort out.

Thanks to you all.

 _Bows_

</comment><comment><USER7> If you want to put stuff on your own sites, what do you need Google Tag Manager for? That's a thing for injecting semi-hostile code into other sites.

<comment><USER30> Because "your own site" might mean "email your freelance dev and wait 3 days", "open a ticket with IT and wait a week" or "remind oneself how that js deploy is meant to work even though working in js isn't my day job".

Not everyone is allowed, wants or is comfortable with direct access to their website code.

</comment></comment><comment><USER31> Google stinks at customer service. Compare this to Slack, which answers everyone of their customer's /feedback's.</comment>


Samsung Preparing a Bid for Nokia? - <AUTHOR> http://www.bgr.com/2011/06/08/samsung-preparing-a-bid-for-nokia/

<comment><USER2> I'm confused as to why Samsung would want Nokia. Right now Samsung is making better phones than Nokia. Samsung has a whole supply chain, kickarse manufacturing abilities, and a corporate culture that would be difficult to integrate with Nokia's. What does Nokia have that Samsung would want, and that Samsung can't acquire for less than $28 billion?

Now, Microsoft buying Nokia I could understand, since it would give Microsoft a much-needed boost in the mobile phone wars. Not necessarily $28 billion's worth, though, that's more than half Microsoft's dragon-guarded treasure pile.

<comment><USER3> [http://www.idc.com/about/viewpressrelease.jsp?containerId=pr...](http://www.idc.com/about/viewpressrelease.jsp?containerId=prUS22689111)

Nokia shipped 100 million 'smart' phones in 2010. Samsung shipped 23 million. That's a big difference. If Samsung bought Nokia it would own over a third of the global smart phone market. Notice also that even though Nokia isn't growing as quickly as its competitors, it is still growing.

And, looking at the entire mobile phone market. Nokia sold 453 million phones while Samsung sold 280 million phones. Combined that would be over half the entire mobile phone market.

[http://www.idc.com/about/viewpressrelease.jsp?containerId=pr...](http://www.idc.com/about/viewpressrelease.jsp?containerId=prUS22679411)

But you are right in one respect. Samsung has been extremely cautious about mergers after several failed mergers in the 1990's. So it would really need to have a good reason go down that path again.

<comment><USER4> and NOkia stated that business will decline by 35% in 2011 alone

</comment></comment></comment><comment><USER3> Samsung could be a good buyer for Nokia. It could switch over the supply of Nokia's internal components to Samsung thereby creating synergy. Samsung could swap out Symbian with Bada on lower end phones and (depending on the Microsoft contract) Android on the high end.

In exchange Samsung gets Nokia's patents, Nokia's mapping assets, and access to an enormous global supply chain.

<comment><USER5> >Samsung could be a good buyer for Nokia. It could switch over the supply of Nokia's internal components to Samsung thereby creating synergy. Samsung could swap out Symbian with Bada on lower end phones and (depending on the Microsoft contract) Android on the high end.

I don't think Samsung would stop the Win7 phone production, or convert existing phones to Android from Win7. They already have a few Win7 phone models that reviewed pretty well. This would remove a potential competitor for those phones, as well as put them in a better position to deal with MS about the OS itself with Nokia's technology and supply chain.

<comment><USER3> I don't think Samsung would stop making Win7 Nokia phones. That would be throwing away money. But depending on the exclusivity clauses in the Microsoft deal Samsung might start making Android flavored Nokia phones as well. Samsung is strongly aligned with Google and just hedging its bets with Microsoft.

</comment></comment></comment><comment><USER6> Could someone please add the question mark back to the end of that title? It's a rumor, not a fact.

<comment><AUTHOR> Good point, fixed.

</comment></comment><comment><USER7> A Korean conglomerate buying a Finnish multinational? We are truly living in cyberpunk times. Move over, Weyland-Yutani!

</comment><comment><USER8> Does Samsung really have 28 billion in cash?

<comment><USER9> Don't forget that every time an apple mobile device is sold, they get money (the A4 processor is part Samsung technology). Many other phones use samsung technology and phone is just one thing Samsung do. They're the biggest company in South Korea.

Last but not least:

AMOUNTS IN BILLIONS WON| DOLLARS| EUROS

Net Sales* 220,120.4| 172.5| 124.1

Total Assets 343,811.6| 294.5| 205.3

Total Liabilities 212,512.9| 182.0| 126.9

Total Stockholder's Equity 131,298.6| 112.5| 78.4

Net Income* 17,663.8| 13.8| 10.0

source: [http://www.samsung.com/us/aboutsamsung/corporateprofile/ourp...](http://www.samsung.com/us/aboutsamsung/corporateprofile/ourperformance/samsungprofile.html)</comment></comment>


Ask HN:  A game to show users every iPhone app in a quick and interesting way? - <AUTHOR>

The idea is to present every iPhone app in a quick and interesting way so that users have a good idea of what's in the app store.
How can one capture the user's attention so that he/she would spend the hours required to go through all the apps?
Perhaps one can use a game that rewards the user for remembering presented apps. <comment><USER2> Present the top few apps (representative of the content of the store, I assume), and then give them the option of taking a quiz about their interests which will give them a more specific list which they might be interested in?

Not that good if the goal is to get them to go through the entire store, but workable if you just want to give them an idea of the contents and increase the chance of them buying other apps.</comment>


Stanford students create and market $25 hospital incubator for 3rd world - <AUTHOR> http://www.mercurynews.com/ci_14977914?source=most_emailed&nclick_check=1

<comment><USER2> Why is it only for the 3rd world? Wouldn't something like this be useful for all hospitals, all over? I can think of this being used so that mothers with pre-mature babies can keep the baby at their home instead of paying huge hospital fees, esp. in US.</comment>


WeWork in Talks with SoftBank to Double Valuation to as Much as $40B - <AUTHOR> https://www.wsj.com/articles/wework-in-talks-with-softbank-to-double-valuation-to-as-much-as-40-billion-1528923090 <comment><USER2> This is an old article. You probably meant to post this one: [https://www.wsj.com/articles/softbank-discusses-taking- major...](https://www.wsj.com/articles/softbank-discusses-taking-majority- stake-in-wework-1539127641?mod=hp_lead_pos1)</comment>


Ask HN: HN for Non-Fiction? - <AUTHOR> <comment><USER2> Don't understand. HN is non-fiction or at least tries to be.</comment>


Xiaomi gets a detailed reality check as its smartphone sales slump - <AUTHOR> http://fortune.com/xiaomi-business-china/ <comment><USER2> One concern of my own in even ever considering a Xiaomi product would be concerns over built-in spyware. That's not to say it isn't also possible with U.S. suppliers, it's just that with such tight control and interests from the Chinese government, it would definitely be a concern.</comment>


ET302 Used the Cut-Out Switches to Stop MCAS - <AUTHOR> https://leehamnews.com/2019/04/03/et302-used-the-cut-out-switches-to-stop-mcas/ <comment><USER2> This was quite a revealing bit of the puzzle when it was announced. In short (lay persons interpretation): due to a separate issue they had with the airspeed disagree indicator warning they followed the course of action for that which was to speed up the plane to prevent potential stall. You're flying, you don't know for certain the speed, so go a bit faster.

But this meant when they had the AoA/MCAS issue they cut off the MCAS and were going too fast to be able to manually trim the aircraft due to the fact MCAS had driven the stabilizer to full deflection. At that speed and that amount of deflection and pulling back with full elevator to try keep the nose up the forces were too great to manually trim.

The solution to that is to ease up on the elevator allow the nose to go down and manually trim then nose back up. But they were too close to the ground still to do that safely. So they needed the electric trim enabled, but that means having the faulty MCAS enabled which they needed off.

Suggested work arounds were to set flaps to 1 while leaving the drab trim cutoff disabled which would've disabled the MCAS and let you still electrically trim. But even if you thought of this you can't extend flaps at 400kt.

If all this is true then this accident is definitely not as cut and dry as everyone thought initially and the solution of "just cut the Stab Trim cutout switches and trim manually" isn't a solution in certain failure scenarios, namely this one.

</comment><comment><USER3> MentourPilot is a great channel... I subbed before the Max debacle. [https://mentourpilot.com](https://mentourpilot.com)

It makes sense that even with two pilots trying to manually spin the trim wheels from a full nose down configuration would be nearly impossible due to aerodynamic loading. IIRC relatively unloaded manual trim wheel movement is difficult even with both pilots extending the trim wheel folding handles and spinning them with maximum effort. I would like to know if commercial simulators accurately simulate manual trim wheel difficulty under high aerodynamic loading such as full nose down trim and high speed.

I think the electric trim cutout switches should be repurposed as "automation trim cutout switches" so that pilots can continue to use the yoke trim switches under high aerodynamic forces where manual trim reversion isn't possible and electric power is still available... and pilots could still revert to trim wheels during electric power loss conditions. You wouldn't disable the brake booster in a car because cruise control went haywire.

<comment><USER2> > think the electric trim cutout switches should be repurposed as "automation > trim cutout switches" so that pilots can continue to use the yoke trim

Those trim cutout switches were actually first put in place long ago to cutout the electric trim on the yokes for situations when they get stuck or otherwise runaway.

So really what's needed now is a different set of MCAS disable switches.

</comment></comment><comment><USER4> This shouldn't be marked as dupe.

Despite the similar title to the WSJ article, this contains heaps of new original information based on actual simulator testing that hints why the pilots might have re-enabled the cut-out switches.

<comment><AUTHOR> Exactly. This is the original source of an attempt of one real 737 pilot to reproduce the conditions similar to those that happened during the last crashes, using the existing (non-MAX) Boeing 373 flight simulator.

The company he works for requested the takedown of the video, but the video shows a lot that the public shoold know, and the conclusions are still there.

Moderators maybe please take a new look here.

</comment></comment><comment><USER5> Aren't all these scenarios tested in simulators and in the actual aircraft? If it's not possible to recover the aircraft why was this not know and why was this plane still flying after the first crash?

<comment><USER6> Planes are complicated, and you can't test for all n! different things that can go wrong. I think the case that:

a) an MCAS sensor is giving incorrect data AND

b) the data is leading MCAS to set the trim to the max AND

c) the plane is going so fast that the force of the air over the elevator is too great to manually override AND

d) the plane is too low to temporarily drop altitude to reduce the force on the elevator to allow a manual override

I don't think this is an obvious set of things to foresee happening, especially D.

It's the same way with software. There's just too many things to think of, and errors that slip through the test cases are inevitable. I've had what I've considered to be pretty thorough test cases and had a bug that was "obvious".

I'm not excusing Boeing, but it isn't gross incompetence either.</comment></comment>


Elon Musk has just received verbal approval for a NYC-Philadelphia-DC hyperloop - <AUTHOR> https://twitter.com/elonmusk/status/888053175155949572 <comment><USER2> Does "verbal approval" mean... _anything_ , in the context of local construction regulation?

Best of luck to Musk, but there must be a misunderstanding going on here, or he is being somewhat misleading in use of the term "approval".

<comment><AUTHOR> I have to assume there's a mountain of regulation for established / already- in-the-legislation transportation that would prevent this. If anything, an unproven (safety-wise) hyperloop would have an orders of magnitude harder time on top of that.

(I'm not based in the States, so I don't know, but it seems implausible that this wouldn't be the case).

</comment></comment><comment><USER3> The PR world of building momentum is probably a bigger win. This is the third time I've seen this so far today, for example. The single tweet being rebroadcast out a bunch, despite just being verbal confirmation, might build some inertia that could help later when dealing with real confirmation in contracts</comment>


Startup Crowdfunding is Here - <AUTHOR> http://www.startribune.com/local/yourvoices/143585176.html

<comment><USER2> I asked this question a few days ago but did not get a response. Does anyone know of a company that is working to deliver a platform for the new crowdfunding laws? I have not seen anything that says Kickstart will pivot into it, but I assume that they will, but I would like to know if their are companies working on delivering a platform for it now that it looks to be a reality.</comment>


Becoming a Real Company - <AUTHOR> http://hardba.co/becomingacorp <comment><USER2> It sounds like you're a startup in some sort of financial industry.

Why do you even _have_ company snapchat and instagram accounts?

They can surely be nothing but distractions from your goal of actually doing financial stuff.

<comment><USER3> They're building an audience for a mass-market investment educational product.

Instagram and snapchat makes perfect sense here.

</comment></comment><comment><USER4> "I believe that management processes are a tax on organizational obesity."

Fantastic metaphor.

<comment><USER5> it's a tax on organizational size

and well spent taxes aren't a bad thing, in fact, they're a great thing

<comment><USER6> Exactly. Essentially, it's an investment into the future of the company and will increase the chances of maintaining your culture and productivity.

</comment></comment></comment><comment><USER7> Nice post and congratulations on the progress, my only suggestion on the growth metrics is to only include ones that actually directly, or will soon, affect turnover/profitability.

Facebook likes, Snapchat followers etc are not that useful for you guys right now I wouldn't think. Newsletter subscribers are valuable to a point, if you don't know the conversion rate to paying in some manner (hopefully via some kind of automation campaign) then that is also just a vanity metric.

I'm enjoying the series of posts to keep it up

</comment><comment><USER8> Is this per minute? "Revenues: $150 (total: $1400, growth: 12%)"

That way I could understand the title.

<comment><USER9> No, the million is the goal. They're at $150 now.

Got you to click, though.

<comment><USER8> Yeah, I hope my click will add to their success and growth :) I also don't get how can they have 6 people working on this full time with no investment and marginal revenue.

<comment><USER10> > company was officially incorporated on August 28

It's a new company.

<comment><USER8> But they still need the 3000$ / month / person pocket money to burn.

</comment></comment></comment></comment></comment><comment><USER11> My 2 cents: \- I don't like the logo, it looks like you just picked a font on google fonts \- The whole brand identity seems completely disconnected from 'hardbacon'. It's a strong name, why have it then? \- I don't get it, are you a content site for financial advice? With comparators? What's the business model, referrals?

Don't mean to be a dick, just trying to offer my sincere view. Good luck!

</comment><comment><USER12> I think this is useful. You have researched brokers and robo-advisors serving Canadians and presented it as a comparison. Some suggestions that I have:

1\. It would be useful to include info on what APIs are offered for automated electronic trading. Similarly, what real-time data, tools, and research is offered by each broker?

2\. Info about options and futures trading would be useful as well

3\. You cover robo-advisor and brokers ... consider adding fee-based and commission-based investment advisors / private wealth managers.

4\. Consider adding comparisons of bank savings products, like GICS, notes, mutual funds, etc.

5\. Consider adding life insurance company wealth management products, like seg funds, annuities, etc.

6\. The "compass" is kind of gimmicky ... I think it puts credibility at risk, and I think that it adds no value to your apparent mission of connecting people with brokers/robo-advisors/[other?]

7\. Don't try to educate people on picking individual stocks (P/E ratios, etc). Promoting stock picking and trading is something a broker might do to increase trading volume commissions, but you don't have the same incentive to do this. There are also already a ton of resources on this topic, including the entire equity research industry. You can't compete here and you don't need to. Listing some useful books and websites would be valuable, but your original content on this topic is lacking and taking away from the real value in your site (the comparison tables between brokers, etc)

8\. What you should do is educate people on financial literacy. What is a broker? ETF? Mutual fund? Robo-advisor? How and why should I pick a provider from your lists? There is a need for this and it fits more naturally with your site's core service. I have seen wealthy family members (with non-financial backgrounds) talking to an advisor at their bank and coming back completely confused and bewildered about basic things, like what is a mutual fund, how do I choose, what is safe, etc. These are intelligent people (eg doctors) but they have not had time or knowledge to deeply understand this stuff. And the advice they get from their bank is never balanced (the advisors at banks are barely qualified to advise on investing and just push their higher fee mutual funds). If you add life insurance agents pushing wealth management products and talking up tax efficiency then it gets complex enough for even sophisticated investors to be confused. The marketplace is very confusing and it is far from transparent, and is being disrupted. If your can properly captivate a young audience and become a "digital" distribution channel then you have a lot of leverage.

8\. Consider a name change. You are alienating people who don't eat or like bacon.

9\. Clearly state what your site does at the top, in one clear sentence. I visited it on mobile and it took me a long time to understand what you are offering. You burried the lede by putting the robo-advisor list at the bottom (and all then compass/stock picker fluff at the top) ... and I didn't even realize you had a broker comparison list until I found I can click a button to switch from "robo-advisor mode" to "broker mode" ... look up a UI design concept called "no modes"</comment>