G Suite Doesn't Let You Contact Support Until Logged In. Locked Out = Stuck - <AUTHOR> I know my password for google suite admin (paid), but they have locked me out due to a suspicious login.
Google have locked me out with the following message:
"We detected an unusual sign-in attempt. To make sure that someone else isn't trying to access your account, your organization needs you to sign in using your corporate mobile device (the phone or tablet you normally use to access your corporate account).
If you don't have your corporate mobile device with you right now, try again later when you have your corporate mobile device with you. If you continue to have problems signing in, contact your administrator. Learn more
Go back & use your corporate mobile device"
I am unable to get back in:
* Google support doesn't work if you are logged out
* I have no primary mobile or corporate device to complete the above step on.
What does Google expect customers to do here? <comment><USER3> >What does Google expect customers to do here?

[https://support.google.com/a/contact/admin_no_access](https://support.google.com/a/contact/admin_no_access)

To the OP ( 'HelloThur ), this is the answer to your most immediate question. I found it here: [https://news.ycombinator.com/item?id=17120223](https://news.ycombinator.com/item?id=17120223)

> Greetings. This is Alex Diacre here from G Suite Support. This has been > flagged for my team and we're looking into it. If any G Suite customer has > trouble accessing their account they can always contact Google Cloud Support > here: > [https://support.google.com/a/contact/admin_no_access](https://support.google.com/a/contact/admin_no_access) > (this is a special form to use when you cannot access any admin account)

<comment><USER4> That's a url worth copying into a password manager...

<comment><USER5> Just to be clear, OP is factually incorrect. You can contact support using the above link if you are locked out.

Source: worked on the G Suite Support team for several years.

<comment><USER6> It seems this link should be mentioned in the email the OP got.

<comment><USER7> If you cant find the link, you lose admin privileges. It's a test of merit.

</comment></comment></comment></comment></comment><comment><USER8> I had this same issue with CloudFlare. Lost access to my email account. Had my CloudFlare username + password, but CloudFlare insisted that I verify with my email since I was trying to log in from a new IP (it wasn't a new IP, but maybe they time out after a few months?).

No way to make progress. Can't use support if you don't have an account. Tried making a separate account, so I could at least open tickets. Their ticketing system keeps closing my tickets before the issue is resolved, and it closes them as "resolved". The worst part is that I actually have both the correct username and password for the account, and I have admin access over every single domain associated with that account (via namecheap). Should be easy to prove that I'm the authentic owner of this account.

Happily using Route53 now. Still haven't figured out how to turn off the CloudFlare billing.

<comment><USER9> I had a similar experience. I like making distribution lists with the company name, so email@example.com. I suspect something in their system thinks these are test emails and I could never receive any email. I couldn't verify my email and I couldn't log in to contact support. I eventually emailed them, but they basically responded to login and get support, which was never going to happen since I wasn't receiving emails from them. Sad thing for Cloudflare, I was representing a large client that was exploring an enterprise contract but I could never get an account setup and verified to evaluate Cloudflare.

<comment><USER10> I do the same with a domain catchall, and I've received emails from Cloudflare just fine.

Then again, if there were emails I've not been getting from them, I would be none the wiser.

I wouldn't be surprised if many people do firstname.lastname@example.com, so excluding it outright would be really silly.

</comment></comment></comment><comment><USER11> Google isn't the only one.

Somebody must have used my domain to sign up for a Microsoft Teams something for some reason and NOBODY in my company can find out who or how. Microsoft is absolutely unhelpful in this regard, trying to activate our domain for Office Teams or whatever. Microsoft says it's for "security" reasons; but as CIO of a 50+ person org I should have some override on that in the event of erroneous signups.

I don't even need to access old content because none of us has used the service at all. Just delete the old domain. For all I know it was a troll signup.

I've since just forced my team to use Google Docs/Sheets because Microsoft is being so unhelpful that they won't even let us give them money, lol.

<comment><USER12> To be honest, the alternative is someone being able to delete your organization on Teams.

I kinda wish you could do like google analytics makes you do to validate your URL (add a DNS record)

<comment><USER13> You can, the whole point is verifying the domain in O365 by modifying the PTR record and CNAME so that the o365 panel will see it is _yours._

Support _should 've_ been able to remove it, I know I was able to do it on escalation cases when I was on Fast Track.

I know that the "ambassadors" are really next to worthless, and if you do not have premier or a TAM on your account, you are really SOL on O365/M365/Microsoft products, you need to email the ambassadors managers, continually, and then go up the ladder, if needbe, to the product manager of that support team and just keep doing it.

It _really_ sucks.

But the reason you couldn't add your domain is 99% most likely someone added and _verified_ it. There are tools on the backend (most easiest Viewpoint) and then billing (CMAT) that can verify if domain is added.

</comment></comment></comment><comment><USER14> Having been an administrator for a Google business account in the past (and not a small one either) I can state from experience that if your problem doesn't have something to do with advertising or search, you are a distant (incredibly distant) third on Google's priorities. And search is a pretty distant second from advertising. Google is majority an ad company, that's what motivates them and it shows in their lackluster customer service for anything that isn't advertising.

Rely on them at your peril. They have slick products as long as they work but good luck if something goes sideways.

<comment><USER15> As a counterpoint: I've found the GCP paid support to be excellent, but that's when spending thousands to millions of dollars a month.

(Although the $150/month option was also very good when I used it.)

<comment><USER3> Indeed, I've found GCP support to be excellent. And honestly, even Google One support over the phone has been pretty decent quality.

</comment></comment></comment><comment><USER16> Google auth UX is quite hostile. For example, if your group admin enables 2A requirement, you can't login if it your account doesn't already have 2A, and you can't set up 2A if you are not logged in, of course. So the workflow goes like this: enable 2A requirement. Wait for people to scream, disable 2A, let them log in and hopefully enable 2A. Enable again, let the next group of people whose sessions by now expired to discover they can't log in, disable. Etc. until hopefully everybody enables it. That seems to be the officially endorsed process: [https://support.google.com/a/thread/6090262](https://support.google.com/a/thread/6090262)

Sane approach would be to let people log in and immediately require them to set up 2A and then continue with their logged in lives, but I guess that was too hard.

<comment><USER17> If your org is small, you can run a report to see who hasn't enabled 2FA and then yell at them. They made it better for new users a while ago (you can now configure a grace perioid), but I don't know/remember if this helps for existing users. If you've got users you can't cutoff who don't setup 2fa, then you need to make an exception group. You can run automation to send nag emails if there's people in it, etc.

But then don't merge with another company with g suite, cause merging accounts isn't supported and you'll have a mess.

</comment></comment><comment><USER18> we're getting to the point where the only reasonable answer is to regulate this, as the tech giants have well demonstrated that their only concern is to do the bare minimum trust & safety work that's beneficial to their business. users are an afterthought at best.

if you provide identity services to more than 100k people or w/e, you need to have a defined dispute process, served by humans with the power to do shit, with legal recourse in the event that they fail to do so. the "run a flag up the pole on social media, hope you're important enough or friends with the right set of people if you want shit done" approach is terrible.

the inevitable "but that will be vulnerable to fraudsters" backlash is stupid --the existing systems are too; fraud prevention and such isn't something you can ever do perfectly, since it's inherently adversarial. the problem we have now is that EVERYONE is treated as if they're a mastermind professional fraud network from the outset, and this does seemingly little to prevent actual bad actors. Twitter's trust and safety team is an even more egregious example, where they very effectively and immediately suspended my attempt to create a single parody account, immediately suspended it again after unsuspending it, and said any future attempts to reach them would be blackholed because the first unsuspend request was still open (there's, of course, no way to see that ticket or respond to it--all you get are email notifications stating that the reply-to discards all inbound mail). this, of course, does seemingly nothing to deal with actual bot networks, since those are run by sophisticated actors who've figured out how to game the system.

something like Estonia's digital ID system is perhaps best, with, importantly, built-in protection against tracking: I should be able to generate an ID that a company can verify, but all they should be able to glean from that is that I have an ID and that I've authorized X other IDs for that company--it shouldn't be something that's traceable back to who I actually am or trace my actions across companies, which is very much not the case (and is something companies very obviously take advantage of for adtech purposes) for the de facto standard of using mobile phone numbers.

<comment><USER19> Would you be ok if this law allowed a company to charge for the support request? Like, $50 to have a human review your dispute?

<comment><USER20> Allowing companies to charge their customers $50 to resolve account access issues would only give companies an incentive to make 'mistakes' so they can earn $50 by spending a few minutes 'fixing' the error.

Customers shouldn't be billed to fix mistakes that aren't their fault. In a functioning market, money is supposed to flow away from faults, not towards them.

<comment><USER21> You miss the point entirely.

Currently because the volume of bogus support requests is so enourmously high, and the fraud attempts also very high - the cost to properly do something like handle account lockout requests properly (on the scale of billions of users) would be EXTREMELY high.

Google is actually pretty clear for consumer accounts, if you lock yourself out your content is lost and they suggest setting up a new account.

Cell phone companies do handle this, you can do things like sim swaps etc with a real person - but you are usually paying $50 - $100 per MONTH with them. And even there plenty of folks have complained of having 2FA codes stolen as a result of this convenience.

If they could charge $50 or $100 to provide paid support (a situation that is actually very COMMON at the enterprise level) for at least some people this will be worth doing. Then the business case is there to staff / resource etc the fix.

Currently, with youtube / gmail etc, the revenue per user is so low it will NEVER make economic sense to have humans dealing with an account.

But keep on banning paid support and you'll keep on getting no support.

<comment><USER22> > Currently, with youtube / gmail etc, the revenue per user is so low it will > NEVER make economic sense to have humans dealing with an account.

Google made over $6 billion in profit in one quarter this year. YouTube had revenue over $5 billion in one quarter. They announced a $25 billion stock buyback.

Google doesn't offer support because they choose not to.

<comment><USER23> I work in a similar space and it is significantly complex and expensive to do this.

Back of the napkin math - * Lets say on average customers contact Google support once a year for each product they use. That's 0.25 tickets per user per quarter. * Consider Google has ~10billion monthly product _user combinations (9 products have 1B+, most have significantly more)_ That is 2.5M tickets/support requests a quarter. ~28M tickets a day * If we consider an average ticket take ~3 mins to resolve, thats ~155k hours a day * If we take an employee being productive for 7 hours a day, that's 22k employees * If you take a 1:10 ratio, that is 2205,220 and 22 - 1st, 2nd and 3rd line managers. * Take the cost to be an average of 30k,60k,150k and 300k for each of those layers, thats ($661, $132M, $33M, $6.6M) which totals to ~$833M per quarter * The real world costs for this will probably be anywhere between 2X to 3X of this because all of these people come with other costs like infrastructure, tooling, space, etc. So we are looking at ~$1.7B to $2.5B.

One might be tempted to say that money can be saved vs my estimates but keep in mind the challenges of localization, time zones, compliance etc is also significant and will probably mean an even larger expense.

So yeah, it would be ~40% of the quarterly profit.

Sure this is an expense so tax etc can be changed but my argument would be that we are severely underestimating the complexity and challenge at each step.

So yes, I do think it will never make economic sense unless you are on the platform with sufficiently high spend. Just like every single other economic system we have out there.

<comment><USER24> Then maybe don't build your business on a model that makes it impossible to do the right thing for your users.

<comment><USER25> Maybe don't try to impose your preferences on other people; a lot of people would rather have a free service with no support than pay for support. It seems incredibly entitled to expect more from a service you're paying nothing for.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER26> _What does Google expect customers to do here?_

As much as I enjoy bashing Google, I have to admit that Google is far from the only offender in this. I've seen it a number of time.

Even Saint Digital Ocean has a similar problem. If you're not logged in, the only ticket you can submit is that you can't log in.

I ran into this recently because it turns out that that DO's help system UI is completely borked in Safari. Type in a topic and click one of the suggestions, and instead of taking you to that topic, if just closes the suggestion list.

The suggestions list has a bunch of carriage return icons, suggesting that you can keyboard through it, but that doesn't work, either. And the system doesn't work on a MacBook Air because it can't deal with anything but massive monitors.

At the bottom of the suggestion list is the suggestion to submit a trouble ticket. But that doesn't work, either.

But what do I expect for $5/month? The last actual Digital Ocean support ticket I put in (a couple of years ago, when the system worked) came back with a very polite reply to the effect of, "You get what you pay for."

</comment><comment><USER27> Similar issue if you cancel your GSuite account.

I cancelled my account and was still billed for it, but now there's no way to contact support since I don't have an active billing account.

<comment><USER28> I was debating whether to purchase extra storage for Google Apps email as I am getting close to the 15GB free limit. I decided that I would pay Fastmail instead. I would not want to make my life/business dependent on Google's whims.

<comment><USER29> I have heard horror stories about declined credit card payments for things like extra storage or premium YouTube causing people to be locked out of their accounts with no recourse. Due to this, I am afraid to pay Google in case things go wrong, so I use competing services instead.

<comment><USER30> This is why I refuse to use google for most services. Support is absolute garbage.

</comment></comment></comment></comment><comment><USER31> This is the part where you have to launch a campaign to shame Google on social media or know someone on the inside to get your situation resolved.

When you do get back in my advice is to enable multiple 2FA factors as that seems to streamline the account recovery case.

<comment><USER30> I've had the exact same issue with Amazon. I had prime. Suspected suspicious activity. It's been 6 months without resolution. I just created another account but I've been calling in every day since. There is no escalation, I keep getting told the same thing: We have no power, we just submit the form to the Account Specialists. You should be called back in 24 hours. I've not once received a call back. My old account is still being used for fake reviews, while amazon had completely locked out the account from being able to login on any device. I can't log in. Whomever is in my account seems to have complete control through some other method, which would explain how they were able to access my old account, even though I have 2FA and mobile authentication. There is a vulnerability they are not talking about.

<comment><USER32> I'm so fucking pissed about this. I signed up for AWS with a personal Amazon.com shopping account. Enabled 2FA, lost the token. I can care less about the AWS account but no longer can I change my password on the shopping account I've had for 10 years.

<comment><USER33> I bet that more accounts and data have been lost to 2FA than have ever been saved by 2FA.

<comment><USER34> Follow proper practice. Always register two keys.

</comment></comment></comment></comment></comment><comment><USER35> "Our technology is so sophisticated even we can't handle it. But that's your problem, isn't it?.. We don't care, we don't have to." [https://vimeo.com/355556831](https://vimeo.com/355556831)

<comment><USER36> Haven't clicked the link (yet), but I'm pretty sure it's Lily Tomlin on Laugh- In as The Telephone Operator: "Is this the party to whom I _am_ speaking? (Snort, snort.)"

<comment><USER35> Same character, but that one specifically is when she reprised it for SNL in the late 70s.

</comment></comment></comment><comment><USER37> A one time use recovery passwords you can generate(or are compelled to) in case you lose access or are locked out seems like a better option, I believe mega.nz & live.com do that, if it is available with google, it wasn't obvious to me.

I love Google's rational of locking people out.

I have pop3/imap access to an old secondary gmail account, but whenever I try to log in by the browser, it locks me out and asks me to confirm who I am by adding a phone number.

I never associated a phone number with the account and have no plans to do so. If somebody did get the password, they would be forced to add a phone number they are in control of if they wanted to take it over.

So what was the point of that? Other than compelling thieves to enable and setup 2FA on gmail accounts on old accounts without 2FA that they've gained access to, almost certainly ensuring the owner never gets it back if they ever decide to check their legacy account again.

<comment><USER38> But if _you_ add a phone number, that makes it harder for someone to take over your account.

<comment><USER39> The more information you add, the harder it is for _you_ to recover your account.

If you add your phone number, fine, as long as you still have access to it. But say you add a backup email. Now if you lose access to _either_ your phone number _or_ your backup email, you can never recover your account.

When I realized how this worked, I thought it was nuts. But it is.

</comment></comment></comment><comment><USER40> Someone created a G Suite trial for a domain I own. There was no option for me to contact Google to tell them I did not create the trial account and do not want it, since all contact options required me to be logged into the trial account I did not create :)

<comment><USER41> To create a trial domain at example.com, you first get a domain at example.com.test-google-a.com and then you have to go through domain verification[0] for the real domain. Either they still have your domain as "pending" in G Suite, or they have access to your DNS/web server.

0: [https://support.google.com/a/answer/60216?hl=en](https://support.google.com/a/answer/60216?hl=en)

<comment><USER40> They don't have access to my DNS/web server. That didn't stop Google from sending me 11 spam emails about G Suite.

I think the first step Google should take before DNS/web server verification is to verify the email address used for the setup.

</comment></comment></comment><comment> 52-6F-62 I've had similar issues with lost/forgotten passwords. I actually have a bricked Nexus device because of it. Any password reclamation attempts are supposed to send an email to my backup account for resolution but the email just never arrives. From my reading it sounds like a common problem as well. And yet I have a newer GSuite email through work and a personal Gmail account for about 14 years (since beta) and no issues otherwise.

Also at a loss.

</comment><comment><USER42> I had this exact situation just 2-3 weeks back and had to use my personal Gmail account to start a community support thread and then got a link, which reset my G Suite account activation/verification process. I got access back in about 5 days from the start of the process.

Update:

Here is my thread on Google Community Help if it helps you or anyone else - [https://support.google.com/a/thread/60347634?hl=en&dark=1](https://support.google.com/a/thread/60347634?hl=en&dark=1)

</comment><comment><USER43> Does [https://support.google.com/accounts/thread/5024607?hl=en](https://support.google.com/accounts/thread/5024607?hl=en) help you?

Reading that comment thread makes it look like (a) "primary mobile or corporate device" just means "the last device you signed in on", not like a special device, and (b) maybe it's a problem when you don't have two-factor authentication enabled?

</comment><comment><USER44> Have you tried account recovery? [https://accounts.google.com/signin/recovery](https://accounts.google.com/signin/recovery)

</comment><comment><USER45> the ability to ring up and speak to a person in case of difficulty is the only reason I'm paying Google for GSuite

with this revalation I won't be renewing

<comment><USER46> Google never said their phone support is for login issues and makes it clear you need to login for support, and the op (who is using a throway) said they didn't remember using a mobile number when signing up so it sounds like the problem is partly on them. If you've been a customer for almost a year and suddenly realized you don't have a number you can call for support, then there is no reason to be outraged since they never promised that in the first place before you signed up and you were too careless to look. They do have a help page regarding login issues:

[https://support.google.com/a/answer/6335621](https://support.google.com/a/answer/6335621)

</comment></comment><comment><USER47> _What does Google expect customers to do here?_

Learn to embrace the pain.

</comment><comment><USER48> Oh yes, this happened to me once. Google has the least useful support of any large company in my experience. This is why I often go with AWS (or, depending on the nature of the company, Microsoft) despite Google's tools usually being more powerful/cutting edge.

</comment><comment><USER49> On a similar topic: One of my friends got locked out of their Instagram account

He tried to fill in the form on his Android phone to get the decision reviewed, but when he hit submit it just showed an error.

He persevered, and after approximately half a year the form worked and he got access to his account again this summer!

It's a travesty that normal people have no way to get a fair treatment by the FAANGs when it comes to support. I hope some consumer ombudsman could put a stop to this

<comment><USER50> A friend had someone sign up for Instagram using her Gmail address by mistake. There's no way to unsubscribe and no way to contact Insta without logging in (and it was in another language). In the end she changed the password and took over the account; it was the only reasonable option.

</comment></comment><comment><USER51> Same with Paypal...if somebody used your credit card information to buy something via Paypal without creating a account - so credit card fraud - <USER2> is no way to contact their support without providing a valid Paypal account. If you don't have one, you first have to create one.

</comment><comment><USER52> Sigh - try contacting Facebook because they've let some bozo sign up using your email address ....

</comment><comment><USER53> I'm a Google One subscriber and so far I have only bad experience with Google's user support, so I'm not surprised that it isn't any better with G Suite. Bit sad though.

</comment><comment><USER54> I had the exact same problem, wow. I'm very happy to see this on hnews.

</comment><comment><USER55> Same thing with PayPal

</comment><comment><USER56> the admins should have a phone number also, when I was a admin on a corp G suite account there was a phone number also for support that we had.

</comment><comment><USER57> does the account have 2FA?

<comment><USER58> He said he set up 2FA and then lost the "corporate device" providing it.

This is why you always set up backup codes. The 2FA is doing its job here keeping the account safe from someone who doesn't have the token, which unfortunately is the account holder.

<comment><AUTHOR> Wow, didn't expect this post to blow up like this.

For reference, I have no 2FA, nor did I lose my corporate device. I've always accessed it through a web browser, never through a mobile, therefore when it asks me to verify with my corporate mobile device, I do not know what device it is referring to.

<comment><USER58> Which device did you use when Google first asked you to verify your phone number? Your personal cell phone maybe?

<comment><USER59> Assuming it was their phone number.

What options do they have now, if they abruptly stopped using that phone number for some reason 10 years ago and had no realistic way to know which 275 utilities were hitched to the number (or even if they did, couldn't contact support for reasons described in the article), for example:

\- because they couldn't afford to pay the bills for a while

\- or moved country

\- or changed contract and then found they couldn't port the number (happened to me) and lost the old number

\- or someone took their phone and they were unable in practice to recover the number or continue using it

\- or they were ill in hospital for long enough their phone contract expired and they could not have dealt with transfer issues at the time

</comment></comment></comment></comment></comment><comment><USER60> I'm not sure why everyone is up in arms in this thread. Even if you could contact Google support, they wouldn't be able to help you since it's up to your GSuite domain admin to verify your identity and reset your account/SSO/2FA.

In fact you were likely logged out in the first place due to policies set by your organization.</comment>


White Supremacists Built a Website to Doxx Interracial Couples - <AUTHOR> https://www.vice.com/en_us/article/n7ww4w/white-supremacists-built-a-website-to-doxx-interracial-couples-and-its-going-to-be-hard-to-take-down <comment><USER2> I don't think vice understands what accelerationist means in the context it was used.

<comment><USER3> > I don't think vice understands what accelerationist means in the context it > was used.

Can you clarify? The article only uses that term once, here:

> including in neo-Nazi Discord servers and accelerationist Telegram channels

It seems like accelerationism is a concept used some of the most extreme white supremacist circles:

[https://www.vox.com/the- highlight/2019/11/11/20882005/accele...](https://www.vox.com/the- highlight/2019/11/11/20882005/accelerationism-white-supremacy-christchurch):

> It's called "accelerationism," and it rests on the idea that Western > governments are irreparably corrupt. As a result, the best thing white > supremacists can do is accelerate their demise by sowing chaos and creating > political tension. Accelerationist ideas have been cited in mass shooters' > manifestos — explicitly, in the case of the New Zealand killer — and are > frequently referenced in white supremacist web forums and chat rooms.

<comment> blaser-waffle The definition provided at the end is basically correct.

The idea behind Marxism is that we're in an intermediate phase, before moving to Socialism, and then Communism. Guys like Stalin and Mao wanted to push that forward, quickly, and accelerate the transition to some sort of glorious workers paradise.

Accelerationism is a right-wing spin on that, where they decry the modern world as unstable and due to collapse -- hence it's popularity with the militia/prepper types. Just like with Communist Great Leap Forward, the Accelerationism is designed to, you know, accelerate that collapse, the rationale being that the sooner it collapses, the sooner it can be rebuilt. And if there is a rebuilding, it can be rebuilt the way you want it, with an emphasis on authoritarianism, and a lot of implied discrimination, libertarianism, Christian Dominion, etc.

Intellectually it's tied to the "Dark Enlightenment" pablum that's pushed by a handful of Alt-Right types, most notably Peter Thiel, but it's adherents are generally the alt-right 8chan-ner / militia types.

Accelerationism's focus on the collapse of the US Government and breakdown into smaller ethnic and social nations is VERY similar to Dugin's "Foundation of Geopolitics"[1], and it's likely that foreign propaganda has embraced Accelerationism as a way to destabilize the US Government.

[1] [https://en.wikipedia.org/wiki/Foundations_of_Geopolitics](https://en.wikipedia.org/wiki/Foundations_of_Geopolitics)

</comment></comment></comment><comment><USER4> A healthy skepticism is appropriate.

<comment><USER5> A healthy skepticism of what?

<comment><USER6> All three top-level comments here are attacking the reporting to drop chaff for the racists.

</comment></comment></comment><comment><USER7> Link or it didn't happen</comment>


Excellent Flexbox using Swift for iOS (https://github.com/lucdion/FlexLayout) - <AUTHOR> https://github.com/lucdion/FlexLayout <comment><AUTHOR> FlexLayout adds a nice Swift interface to the highly optimized facebook/yoga flexbox implementation. Concise, intuitive & chainable syntax.

Flexbox is an incredible improvement over UIStackView. It is simpler to use, much more versatile and amazingly performant.</comment>


80% front end vs. 20% back end - <AUTHOR> http://parse-hosting.oursky.com/blog/2016-03-30-startup-should-focus-on-front-end <comment><USER2> Not sure about the exact ratio, but to my experience - the frontend no matter web or mobile requires more attention span than the server.

</comment><comment><USER3> frontend is king</comment>


Pendulum Waves (2010) - <AUTHOR> https://sciencedemonstrations.fas.harvard.edu/presentations/pendulum-waves <comment><USER2> I recreated this in CSS/JS a few years ago, inspired by this video.

[https://codepen.io/madelinw/details/ocnCl](https://codepen.io/madelinw/details/ocnCl)

<comment><USER3> Same principle, though not a physical simulation: [http://wry.me/hacking/moire-eel.html](http://wry.me/hacking/moire-eel.html)

By moving the mouse you can amuse yourself with various Moiré effects.

</comment></comment><comment><USER4> Without analyzing it too much this seems to be a perfect visualization of the mathematics of music theory. The lengths of string become quite a direct metaphor for the wavelengths of notes on the music scale, and seeing them move together in progressively different "groups" of notes I imagine closely matches traditional chord structures in different keys.

Quite mesmerizing, and mathematically satisfying at the same time!

<comment><USER5> It's a closer analogy to the "beat frequencies" you get with constructive and destructive interference of waves of similar frequency. The envelope of the total amplitude of the pendulums oscillates with lower frequency than the amplitude of any individual pendulum.

I used Audacity to mix sine waves of the frequencies of the pendulums (51/60Hz, 52/60Hz, ..., 65/60Hz), multiplied by 440 to get them to audio frequency, and it sounds a lot like the UFO sound effect from the 1970s TV series "UFO".

<comment><USER6> I'm very curious how that sounds, would you mind posting it somwhere?

<comment><USER5> Posting on first Google result for "share short sound clip". I can put it somewhere else if you have a better suggestion.

[https://clyp.it/rfu2x1kb](https://clyp.it/rfu2x1kb)

</comment></comment></comment></comment><comment><USER7> If you enjoy demos like this and live in or visit San Francisco, check out the Exploratorium, which is full of amazing physical demos like this.

[https://www.exploratorium.edu/](https://www.exploratorium.edu/)

<comment><USER8> They have "adult swim" on Thursday nights. I.e. adults only, and alcohol for sale. Classic first date spot. But to really make the most of it you've got to go by yourself and spend a day there, taking the time to appreciate and think about each exhibit.

I have fond memories of field trips to the Exploratorium back when it was at the Palace of Fine Arts.

</comment></comment><comment><USER9> I've seen this demonstration at least a couple of times, once as an undergrad around 1971. I always remembered it and a few years later I was working with a minicomputer with limited I/O so I decided to blink the row of front panel lights just to show that the program was running. I blinked each on and off with a slightly different frequency and got a similar, interesting effect.

</comment><comment><USER10> Great to see this come up again! Here's a simulator I wrote for it a looooong (almost 8 years!) ago: [https://cs.stanford.edu/people/paulliu/webapps/pendulum.html](https://cs.stanford.edu/people/paulliu/webapps/pendulum.html)

</comment><comment><USER11> Interesting to see this come up again. Here's a small model for this system written in Haskell from a few years back:

[http://syntacticsalt.com/blog/2011-08-27-harmonic- motion.htm...](http://syntacticsalt.com/blog/2011-08-27-harmonic-motion.html)

</comment><comment><USER8> It seems like the pendulums fall into a few repeating patterns. E.g. for a second it looks like a snake, for another second it looks like a double helix, and so on. The whole set cycles through each pattern and then begins again. How many patterns are there?

</comment><comment><USER12> Now what happens when you couple the oscillators?

<comment><USER13> [https://www.youtube.com/watch?v=5v5eBf2KwF8](https://www.youtube.com/watch?v=5v5eBf2KwF8)

Something like this?

<comment><USER12> yes, but I am looking for coupling between oscillators of different fundamental frequencies.

</comment></comment></comment><comment><USER14> it looks like rotating helixes to my eye</comment>


Amazon boss Jeff Bezos adds $24bn to fortune - <AUTHOR> https://www.bbc.com/news/business-52289657 <comment><USER2> I wonder what the world would like under shelter-at-home without Amazon.</comment>


If... - <AUTHOR> http://silkandspinach.net/2011/04/29/if-2/

<comment><USER2> "And the second kind tests something that some other part of the system already knows. Let's ban the second kind…"

Can you give an example?

<comment><AUTHOR> Imagine a method with this outline:

File createFile(String name, boolean istemp) { if (istemp) // do temp stuff else // do regular file stuff }

That's an 'if' statement that only exists as a response to the boolean parameter. We can remove the 'if' by having two methods instead:

File createFile(String name) File createTempFile(String name)</comment></comment>


SmartOS and FreeBSD multi cloud management for everyone - <AUTHOR> https://blog.project-fifo.net/cloud-management-for-everyone/ <comment><AUTHOR> I'm happy to answer questions to FiFo.cloud if anyone is curious :)

<comment><USER2> The post says to hurry and sign up, yet I'm not sure where I'm to be signing up for access at.

Just looking to be put on the list so I can try it out once it's released to a larger audience.

<comment><AUTHOR> Hi sorry if the post didn't made that clean. You can sign up here: [https://try.fifo.cloud/](https://try.fifo.cloud/)

Or feel free to shoot dm on twitter (@project_fifo) w/ your e-mail and I will make sure you get an invite :)</comment></comment></comment>


I regret buying an Apple Watch (and I knew I would) - <AUTHOR> http://www.engadget.com/2015/05/13/apple-watch-buyers-remorse/

<comment> T-Ice The smartwatch is a huge bust, when will the tech companies quit shoving them down the consumers' throat. They have been around for a few years now and still haven't taken off. Apple was stupid to release one thinking theirs was somehow going to kick off the product and people were going to flock to buy one just because of the brand. There will be no Snapchat or Uber apps in the near future for smartwatches.

<comment><USER2> Uber already exists for Apple Watch; I love mine and actually saves me quite a bit of time each day just with notifications.</comment></comment>


Using GitHub issues as a CMS - <AUTHOR> https://github.com/AranScope/gityll <comment><USER2> How about issue comments as blog comments? :) pretty nifty!</comment>


Results from NetBeans IDE 6.9 Community Acceptance survey - <AUTHOR> http://qa.netbeans.org/processes/cat/69/ca_results.html

<comment><USER2> It's a pity they don't give the results by OS. I bet Mac users aren't impressed by the performance.</comment>


Show HN: Charitius, global charity search engine - <AUTHOR> http://www.charitius.org <comment><AUTHOR> Open source, open data search engine.

Code here: [https://github.com/juliuszelf/global-charity-search- engine/](https://github.com/juliuszelf/global-charity-search-engine/)

Some background info & core principles:

[https://medium.com/proof-of-concept/join-me-in-creating- an-o...](https://medium.com/proof-of-concept/join-me-in-creating-an-open- global-charity-search-engine-b411eb44819b)

Tech stack: Docker, Flask, Elastic Search (ES), ngnix. Also python scripts & Makefile for downloading and transforming source files to json to upload to ES.

Love to get feedback on how to improve.</comment>


Google warns of unauthorized TLS certificates trusted by almost all OSes - <AUTHOR> http://arstechnica.com/security/2015/03/google-warns-of-unauthorized-tls-certificates-trusted-by-almost-all-oses/ <comment><USER3> Just revoking the intermediates is not enough. This tells the main culprits that it's ok to issue intermediates to do whatever and then deny responsibility as it gets detected.

The only possible course of action is to hold the root responsible and to remove them from the trust store.

The CA system is fragile enough as it is and only the prospects of immediately going out of business can be any deterrent for CAs not to start doing shady stuff.

Yes. Revoking the root is annoying for customers of that root, but I'm sure other CAs will gladly offer a free or really cheap replacement program. And if the affected root is REALLY big, then just pre-announce the revocation for a year or two. Just like what Google is doing with the sha1 certs.

<comment><USER4> I have marked CNNIC root cert untrusted on all of systems I can control. It bothers me sometimes when some providers with "good" reputation uses them, like azure china. I had to manually add the server certificate to trusted list, just to manage my vms. Otherwise, I barely notice the issue.

It looks that even CNNIC certs themselves weren't widely deployed, correct me if I'm wrong, most of Chinese sites who wants to employ TLS doesn't do it right, for example, 12306 has its own root and some sites I use daily has a self-signed CA with random input in all of the fields.

<comment><USER5> If you think the company that has agreed to collaborate with a Chinese company to make a different version of Skype (Tom-Skype), for the _sole purpose_ of letting the Chinese government spy on Chinese citizens' communications in real-time, can be "trusted" to not have backdoored cloud services in China, then I have a bridge to sell you.

Microsoft has proven again and again that it's willing to make _any_ concessions to the Chinese government if there's the slightest chance of them making an extra percent market share in China. We saw that when Google was hacked by the Chinese government, too. Microsoft was more than happy to agree to all the censorship policies Google didn't, because it meant that _maybe possibly_ that would earn them some market share in China, after Google would be gone - it didn't anyway. Baidu took all that difference Google lost.

<comment><USER6> This isn't just about earning market share in China. Just about any organization that operates in China (or hopes to) has a vested interest in, e.g., having reliable email access there. If your company uses Google products for email, etc., then these days you'll have some real challenges making them work for folks over there. Microsoft can capture a lot of _American_ business that way. (Concrete fears about employees losing crucial access tend to outweigh philosophical arguments about government surveillance when folks sit down to make these decisions.)

</comment></comment></comment></comment><comment><USER7> [http://googleonlinesecurity.blogspot.com/2015/03/maintaining...](http://googleonlinesecurity.blogspot.com/2015/03/maintaining- digital-certificate-security.html)

is a better URL. (For potential future reference, the current URL is [http://arstechnica.com/security/2015/03/google-warns-of- unau...](http://arstechnica.com/security/2015/03/google-warns-of-unauthorized- tls-certificates-trusted-by-almost-all-oses/) )

<comment><USER8> I disagree, in this case the direct link is not a better URL. The Ars Technica article (as many issues as I have with them) correlates not only the Google alert, but also followup conversations on Twitter and from Mozilla. This kind of correlation (and analysis) is the very definition of adding value added.

It also clearly links to the Google blog, so it's hard to accuse them of trying to co-opt Google's content as their own.

</comment></comment><comment><USER9> The fact that it's CNNIC that has issued these dangerous certificates is not exactly relevant to the problem at hand; More than one root authority has made mistakes in delegation, and several have made the mistake of not checking the delegation bit and allowing third-parties to request intermediate certificates.

Still, it bears repeating that CNNIC, which is effectively a branch of the chinese government, has a root certificate trusted by default in all the major browsers. Unless you regularly visit chinese websites, you should remove CNNIC from your browser trust list.

<comment><USER10> I'm on FF 36.0 on Kubuntu 14.10 - I removed the certs for CNNIC and then to test went to the CNNIC website and rewrote the address as https. Website still shows the lock symbol and still shows the cert verified by the CNNIC root CA?!? Seems the removal is slightly glitchy somehow, third time worked.

2 things I notice:

1) there are a lot of default trusted suppliers, seems that this should perhaps be selected on install (trust all or trust local [geographic] or trust by selecting regions).

2) that unlike with cookies you don't get a record of how often a certificate (or CA) has been used - so I can't tell from looking at the certificate information FF holds whether I've ever used the dozen or so Turkish certs for example; this seems like useful information for users that's not being displayed. I only use Turkey as an example because I don't use Turkish websites [I barely know a handful of Turkish words] nor AFAIK any Turkish company's English language sites.

Why would I need to trust geographically and linguistically distant CA's by default? If I decide to do something with a .cn site that needs a https connection it seems that I should be able to get info like "these CA - <USER2> already trust - in turn 'trust' this CA which certifies the site you are accessing". That along with any warnings the browser wants to give on malware or phishing then would feed in to a decision to accept the cert and interact "securely" with the site in question. The sites I actual need secure transactions with are probably certified by less than a dozen CA; trusting hundreds by default then seems poor security practice [to this layman].

<comment><USER11> I'm not thinking very hard about it, but that second bullet sounds like a _really good_ idea.

<comment><USER7> Looks like Mozilla has this data in aggregate, if I'm understanding this web page right:

[http://telemetry.mozilla.org/#filter=nightly%2F39%2FCERT_VAL...](http://telemetry.mozilla.org/#filter=nightly%2F39%2FCERT_VALIDATION_SUCCESS_BY_CA%2Fsaved_session%2FFirefox&aggregates=multiselect- all!Submissions&evoOver=Builds&locked=true&sanitize=true&renderhistogram=Table)

Ignore the graph and match up the table below with this C array:

[https://dxr.mozilla.org/mozilla- central/source/security/mana...](https://dxr.mozilla.org/mozilla- central/source/security/manager/boot/src/RootHashes.inc)

If I'm understanding the meaning of "Bin Number" right, not all of the 0s are surprising. But some are. For instance, the AOL CA hasn't been used to sign any certs that have been seen. (I guess, in a sense, that's not really surprising...)

I'd be cool if someone better at front-end than I could present the data with useful labels, and also mark each CA by whether it's in the non-Mozilla roots.

<comment><USER12> You can look at the local telemetry for your current Firefox session, including this variable, by going to about:telemetry, which sort of gets you what pbhjpbhj was looking for, albeit in an inconvenient and limited fashion.

<comment><USER10> I have telemetry upload turned off which appears to then not gather the data (which is perfectly reasonable) rather than just not upload it.

</comment></comment></comment></comment></comment></comment><comment><USER13> FWIW, here's what I just did on my (Arch) Linux machine:

      $ for f in /etc/ssl/certs/*.pem; do sudo ln -sfn "$f" /etc/ca-certificates/trust-source/blacklist/; done
      $ sudo update-ca-trust

This will block all currently installed CAs (as well as double-block some, but that doesn't really matter). You then need to add them back in.

Restart your browser, and go to websites you access frequently (change them to [https://](https://) if necessary). Click the (broken) padlock and read off what CA they used; remove the corresponding .pem file from the blacklist directory. Some might be signed by intermediate certs and thus hard to find, but SSL Hopper has a great chain inspection tool at [https://www.sslshopper.com/ssl-checker.html](https://www.sslshopper.com/ssl- checker.html) you can use to identify the topmost CA cert you need to whitelist.

After you're done, run "sudo update-ca-trust" again, and restart your browser. All normal sites should work, and you've gotten rid of ~160 root certs.

If it's of interest to anyone, here are the ones I whitelisted to get all sites I bothered to try up an running:

      $ sudo rm DigiCert_* GeoTrust_* Go_Daddy_* GlobalSign_* VeriSign_* StartCom_Certification_Authority* Comodo_* AddTrust_* Thawte_* thawte_Primary_Root_CA* Baltimore_CyberTrust_Root.pem UTN_USERFirst_Hardware_Root_CA.pem Visa_eCommerce_Root.pem
      $ ls /etc/ssl/certs/*.pem | wc -l
      206
      $ ls /etc/ca-certificates/trust-source/blacklist/
      163

EDIT: Note that this is not a perfect solution; the CAs you've whitelisted could still go bad, and you'll need to blacklist any new CA certs that are added with subsequent ca-certificates updates. But it's a start.

<comment><USER14> Be careful, this has no effect if you're using firefox/iceweasel. They bring their own set of trusted CAs and ignore all changes on the OS trust store.

</comment></comment><comment><USER15> Action is really needed. A system that can be breached just by any CA company that is more interested in money than in security (also at least one big CAs has a bad history concerning security) is plainly broken. There should at least be a kind of overseer that has the ability to intervene when bad behavior is reported.

In the current situation, it is impossible to trust this "system of trust". It just sounds similar as I shall give the keys to my house to the thieves guild to prevent burglaries.

<comment><USER7> Certificate Transparency is a solution. It's not my favorite solution, but it's far and away my favorite solution that stands a chance of working.

[http://www.certificate-transparency.org/](http://www.certificate- transparency.org/)

This particular bad behavior, like entirely too many other breaches, was (probably) noticed because Google's own browser saw illegitimate but valid Google certificates, and alerted Google through its own channels. CT extends that to any other site that wants to participate.

CT also requires that CAs disclose every certificate that's signed, including those signed by intermediates that they give to third parties. This doesn't make legitimate use of intermediates much more onerous, but it makes MITMing- proxy use extremely logistically complicated, even if you felt like telling the whole world you were MITMing certificates.

<comment><USER16> > _Certificate Transparency is a solution_

CT would not have prevented these attacks.

Google would be exactly where they are right now: knowing who issued cert, and that's it.

Short form: [https://github.com/okTurtles/dnschain/blob/master/docs/Compa...](https://github.com/okTurtles/dnschain/blob/master/docs/Comparison.md)

Long form: [https://blog.okturtles.com/2014/09/the-trouble-with- certific...](https://blog.okturtles.com/2014/09/the-trouble-with-certificate- transparency/)

(EDIT: How about an honest discussion instead of a downvote? If you disagree, you are welcome to explain why.)

<comment><USER7> Given the operational difficulty of implementing a transparently-MITMing proxy in a Certificate Transparency regime, I'm not sure you can say with certainty that it wouldn't have prevented this attack. Every time you want to MITM a new site, you need to contact some number of auditors before you can complete the connection. That sounds difficult to implement reliably and quickly enough for a MITM to work.

(Not to mention that most off-the-shelf MITM proxies will intentionally not implement this, since the use case for legitimate MITM proxying involves using site-specific CAs, not globally-valid CAs, so you'd have to deploy custom code to go talk to the auditors. And I somehow have doubts that a robust, black-hat MITM proxy solution will emerge, given that it probably will have only a handful of users at any given time.)

In any case, it is certainly not a perfect solution. But it is _a_ solution.

I've read that okTurtles blog post before. Insofar as it points out that CT has limitations, it's generally right. But the okTurtles scheme is much worse: if a certificate gets compromised, the only recourse is to _pick a new website name_. I think it's likely that there is _no_ perfect solution here. CT makes no claims for perfection, but it's a pretty good imperfect solution, and I think we need that more than we need a nonexistent perfect solution.

BTW: "Resist commenting about being downvoted. It never does any good, and it makes boring reading."

<comment><USER16> > _Given the operational difficulty of implementing a transparently-MITMing > proxy in a Certificate Transparency regime, I 'm not sure you can say with > certainty that it wouldn't have prevented this attack. Every time you want > to MITM a new site, you need to contact some number of auditors before you > can complete the connection._

1\. Certs don't need to include SCTs, so, end of story.

2\. Even if that was a requirement, they can be faked just like the certificate.

> _In any case, it is certainly not a perfect solution. But it is a solution._

It doesn't prevent MITM attacks (even Google acknowledges that), so it's not a solution (if preventing attacks is what you want).

> _But the okTurtles scheme is much worse: if a certificate gets compromised, > the only recourse is to pick a new website name._

Certificates are not associated with the key to modify the blockchain entry. So if a certificate gets compromised, you can immediately fix it by updating the blockchain entry.

> _BTW: "Resist commenting about being downvoted. It never does any good, and > it makes boring reading."_

If people downvote me for no good reason, I'll point it out to them. Doesn't matter to me if it bores them. If that's a problem maybe they shouldn't downvote in the first place? :P

<comment><USER17> _2\. Even if that was a requirement, they can be faked just like the certificate._

Huh?

<comment><USER16> > _Huh?_

Read the post, it's all there: [https://blog.okturtles.com/2014/09/the- trouble-with-certific...](https://blog.okturtles.com/2014/09/the-trouble-with- certificate-transparency/)

<comment><USER17> Looks like a complex attack, and "not all CAs will necessarily have their own log." and same for the converse too.

<comment><USER16> Legitimate SCTs can be used in attacks just as well (this will probably be the common case), as explained here:

[https://news.ycombinator.com/item?id=9254713](https://news.ycombinator.com/item?id=9254713)

<comment><USER17> Yes, CT would only allow detection. Revocation would be a different problem.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER18> It is interesting that when the CNNIC root certificate was added to Firefox, this is exactly what many people had warned against: [https://bugzilla.mozilla.org/show_bug.cgi?id=476766](https://bugzilla.mozilla.org/show_bug.cgi?id=476766)

<comment><USER19> IMHO, had Firefox dared remove CNNIC root cert, Mozilla would already been ousted with their business in China, like Google.

</comment></comment><comment><USER20> Why can the CN registrar sign .com certs?

Why aren't national authorities limited to their country's TLD? I'd imagine they'd want this, and the public would want this.

Its so obvious, what am I missing?

<comment><USER21> Any CA can generate a cert for any domain. This is one of the problems with the current CA system.

</comment></comment><comment><USER22> The CA system is fundamentally broken. Centralised authorities are _bad_.

</comment><comment><USER23> Central certificate authorities were all web users put their trust against money compensation to the CA are a broken security model! Especially in the new internet security era were we have government hackers with almost unlimited budgets. Governments will hack into CAs and issue fake certificates to popular domains that they want to Man in the middle attack and to that we have no protection. I think the solution is a voting mechanism or digital ID. So that the engineer working at Google can sign the certificate with a Corporate Google ID.

Central CAs is almost as broken security as credit cards with the card number readable in cleartext on the front of the card.

</comment><comment><USER24> If they implemented and enabled DANE in Chromium then we could detect and render harmless this miss-issuance for our domains via PKIX-TA Certificate Authority Constraints instead of playing Whac-A-Mole

</comment><comment><USER25> Has anyone gone throught the list of root certificates that are trusted in the browsers/OSes and done some homework on them? Would be interesting to see what's behind those authorities and also which certificates they have issued.

I see that in the OS X keychain I have 213 "system roots" that are trusted, I wonder how many of them I really need...

</comment><comment><USER26> I've always had the suspicion that my pc had some sketchy certs installed.. what do ya expect from buying a pc with an OS installed from an electronics retailer..right?

<comment><USER27> I'm pretty sure it's a default install in Windows, so the retailer doesn't really make a difference.

<comment><USER28> The retailer doesn't. The vendor (who chooses what to pre-install) does.

</comment></comment></comment><comment><USER29> It's a good point for Firefox to embed is own certificates.

I wonder if there is such unauthorized certs in Firefox manager.

</comment><comment><USER21> So what do we do to fix the broken CA system? Particularly in a case where a bogus certificate is issued by an intermediate CA that rolls up to a root CA that is included in all the major browsers.

It seems to me that we have several building blocks available and it may be a combination we need:

1\. CERTIFICATE PINNING (HPKP) - example: [http://tools.ietf.org/html/draft- ietf-websec-key-pinning-21](http://tools.ietf.org/html/draft-ietf-websec-key- pinning-21) \- if a browser had previously pinned the certs of affected sites then it would have known that it was going to bogus sites and could have displayed a warning or prevented the user from going to those sites.

The challenge with pinning is that somehow you have to learn what to pin before you visit a site, either by having the pinset or certs pre-loaded into the app/browser or simply by doing Trust On First Use (TOFU). Additionally, if the first use is to the site controlled by an attacker, the cert that gets pinned in the browser could in fact be the _attacker 's_ cert, which could make recovery difficult.

Which brings us to...

2\. DANE/DNSSEC - [http://www.internetsociety.org/deploy360/resources/dane/](http://www.internetsociety.org/deploy360/resources/dane/) \- with DANE (RFC 6698) you put a fingerprint (or an entire cert) into a TLSA record in DNS and then sign that with DNSSEC. A browser or app that supported DANE could deal with the TOFU issue by doing a DANE check to verify the cert that it is receiving from the web server. This would then effectively bootstrap the cert pinning process by providing a way to test the validity of the cert.

Because the DANE TLSA records are entered by the owner/operator of the domain and then through DS records are tied into a validated chain-of-trust up to the root of DNS, it would be difficult for an attacker to subvert this with his/her malicious TLSA records.

But we have a third layer to help...

3\. CERTIFICATE TRANSPARENCY (CT) - [http://www.certificate- transparency.org/](http://www.certificate-transparency.org/) \- CT provides a way to log all the issued certs and have browsers/apps check those logs through an auditor. When the browser gets the TLS cert, it also gets a signed cert timestamp (SCT) and can use that through an auditor component to check if the cert is valid. The challenge is that right now only some CAs log issuance of certs and only some browsers/apps check via an auditor. (I also don't understand myself exactly how real-time CT is, but that may just be that I need to understand the SCT mechanism better.)

To me these three different components can work together to provide a higher degree of trust: cert pinning to help with the speed of connecting to frequently-visited sites; DANE to help with the first use/key learning issue[1]; and CT to provide another means of checking the cert validity.

Comments?

[1] And yes, DANE could be used to store entire TLS certs separately, but right now I'm looking at how these pieces could be used together to give the maximum efficiency and security.

</comment><comment><USER30> Hello, I would like to help tutors and students by sharing my experience with [http://preply.com/en/chinese-by-skype](http://preply.com/en/chinese-by-skype) I am currently learning Chinese with native speakers over there and the quality presented is excellent and satisfying

</comment><comment><USER4> The day has come.

</comment><comment><USER31> Goodin can't help but say borderline moronic things every once in a while:

 _Defenders of current system for acquiring and and revoking TLS certificates have recent chafed in response to statements from this author that it 's hopelessly broken. Besides remembering that almost all of these critics have a strong financial interest in the way the system works now_

"chafed" because of this:

[https://twitter.com/ivanristic/status/578536108662861824](https://twitter.com/ivanristic/status/578536108662861824)

So Ristic working for ssllabs automatically disqualifies him from asking the perfectly valid question "What is a better approach, in your opinion?"..

You still like your Goodin, tptacek? ;)</comment>


YouTube Super Chat - <AUTHOR> http://youtube.googleblog.com/2017/01/can-we-chat-hello-super-chat.html <comment><USER2> I love how YouTube is one of the few content platforms that's concentrated on making it possible for content creators to get paid.

Based off of the stupid things people do on Twitch, I don't know how well this specific thing will work, but I can see YouTube outliving a lot of other content platforms just because of this.

</comment><comment><USER3> Not clear what happens if two people bid different amounts at the same time, or if 1000 people bid $5+ at the same time (does it just completely fill up the chat?)

</comment><comment><USER4> Nowhere does it say anything about the split.</comment>


Ask HN: How to freelance as an electronics engineer? - throwaway-123 I am curious as to how one can make profit using electronics skills acquired, from any location globally. <comment><AUTHOR> 1\. Use adwords:

electrical engineering service

electronic designer

electronic engineering service

electronics designer

Total 423.17 5,806.83 $78.39 7.3% $0.19 1.52

2\. check something like leadpages or similar to build a landing page.(use your own domain) use multiple page input forms.

might look at drift for chat on the pages.

<comment><USER2> Can you expand what those numbers mean? I assume they are metrics for the adwords but I have very little knowledge in what you are speaking on.

</comment></comment><comment><USER3> Probably you could find some projects on website like Upwork or Freelancer. They usually have some jobs related to electrical engineering.

But if it's hardware related, I believe it's hard to work remotely. Is designing micro-controller also considered electronic skill?

</comment><comment><USER4> Build/repair custom guitar stomp boxes

</comment><comment><USER5> Sell courses, tutoring, training on Arduino and Rasberry Pi.</comment>


The State of the Bestiary Is Stable - <AUTHOR> https://hazlitt.net/feature/state-bestiary-stable <comment><USER2> I still remember the absurdly heavy impact it made when it came out. People were sinking thousands of pounds into it and it as sucking money out of the rest of the hobby games industry. It was surreal to watch. Some other companies came out with their own collectible games which did well for a while, but when the bottom fell out of the market a few of them were left with huge inventories they couldn't sell and were wiped out or financially crippled.

Meanwhile the publishers, Wizards of the Coast were so flush with money they bought the industry 5000lb Gorilla TSR, then were bought by Hasbro. Magic isn't even a roleplaying game, but it's effects on the Pencil n paper RPG scene are felt to this day.

It's interesting that Garfield was a mathematician, as is the other real rock star card and board game designer Reiner Knizia. Game design is a complex problem and clearly a good grip on the mathematical, statistical and geometric aspects can't hurt. I think I'll have to pick up Richard's book.

</comment><comment><USER3> I bought a couple 2019 core sets and some boosters a month ago, first time I've owned Magic in twenty years. It's weird how it manages to sit in the back of the mind, just waiting for the curiosity to return.

<comment><USER4> I haven't played in a few years but I always have the itch to buy a pack when I see them at the store.</comment></comment>


T-shirt maker sinks rival with dubious trademark of 150-year-old nautical icon - <AUTHOR> https://arstechnica.com/tech-policy/2018/05/t-shirt-maker-sinks-rival-with-dubious-trademark-of-150-year-old-nautical-icon/ <comment><USER2> Bloody Americans. That's ridiculous.</comment>


Show HN: GAM Cluster, Massively Distributed Actors for GO - <AUTHOR> https://github.com/AsynkronIT/gam/tree/dev/cluster <comment><USER2> I noticed that you work on Akka.NET, and now this (Go actors). They look similar on the surface: supervision, state machines, etc. as other actor libraries... But, are there any key differentiating features?

Also, what do you think of the recent .NET Core perf. tuning and how will it impact Akka.NET?</comment>


Debunking the Stanford Prison Experiment [pdf] - <AUTHOR> https://psyarxiv.com/mjhnp/ <comment><USER2> Can someone explain to me what researchers considers "scientific validity" in psychology?

I feel like human behavior will change as culture evolves. For example how people react to a plane hijacking drastically shifted after 9/11\. In a similar way the Stanford Prison Experiment probably permanently changed a part of human culture so that it will no longer be replicable (regardless of whether the original setup and results were valid or not).

How do you conduct science when whatever important truth about human behavior you find invalidates the same findings once that knowledge enters popular culture?

<comment><USER3> I think this is exacerbated by a dual blind-spot in both our thinking and languages regarding the difference between "how something was the last time we checked" and "how something intrinsically/durably/permanently is and will be no matter how many times we check". It probably isn't something we've needed in large quantities for long.

Your question focuses on psychology (and I agree it's important here), but this probably happens to greater and lesser degrees when studying _any_ complex adaptive system.

Say you go study the carbon-uptake potential of a few species of tree, model how planting more trees could impact the climate, and click the publish button.

Your research may already be out of date. Your ability to completely control variables in a complex system has limits. Most of the environmental measurements that went into your model are moving targets. Even if your model is predictive at publication, there's a good chance there are unmodeled dependent variables lurking.

What if your research captures the zeitgeist? What if you inspire the planting of a hundred-billion trees? Do your measurements consider lone trees? Does the density and surface area forested (and eventually the weather-shifts a large forest triggers) impact how it grows and functions as a carbon sink? What if your research inspires someone to plant a massive monoculture that ultimately incubates and spreads a parasite that ultimately destroys the species?

<comment><USER3> To unpack a smidge, I think the first N steps all involve developing the perception and language to spot, tag, and catalog instances of this problem.

There's a fundamental shortfall in the quality of our thinking relative to the task (and the ultimate answer may just be that we're too time-bound to think this way). It's in the study designs, papers, abstracts, and unavoidable in the popular press.

</comment></comment></comment><comment><USER4> Related from last year:

[https://news.ycombinator.com/item?id=17796953](https://news.ycombinator.com/item?id=17796953)

[https://news.ycombinator.com/item?id=17387601](https://news.ycombinator.com/item?id=17387601)

[https://news.ycombinator.com/item?id=17287319](https://news.ycombinator.com/item?id=17287319)

</comment><comment><USER5> Published version: [https://www.gwern.net/docs/psychology/2019-letexier.pdf](https://www.gwern.net/docs/psychology/2019-letexier.pdf)</comment>


Chat startup Chatterous (YC W08) throws gauntlet down against proprietary closed chat widgets - <AUTHOR> http://venturebeat.com/2009/04/03/chat-startup-chatterous-gets-widgets-more-users/

<comment><USER2> Excellent article...can't wait to take a crack at that new API</comment>


Microsoft victory in overseas email seizure case is upheld - <AUTHOR> https://www.google.com/amp/mobile.reuters.com/article/amp/idUSKBN1581YQ <comment><USER2> Mods, could you please redirect this to the non-AMP page? [http://www.reuters.com/article/us-microsoft-usa-warrant- idUS...](http://www.reuters.com/article/us-microsoft-usa-warrant- idUSKBN1581YQ)</comment>


NIST's new password rules – summary - <AUTHOR> https://nakedsecurity.sophos.com/2016/08/18/nists-new-password-rules-what-you-need-to-know/ <comment><AUTHOR> The primary source: [https://pages.nist.gov/800-63-3/sp800-63-3.html](https://pages.nist.gov/800-63-3/sp800-63-3.html)

</comment><comment><USER2> I've been telling people to use correct-horse-battery-staples for years. Glad to see I'm not the only professional thinking this.</comment>


Why 2010 Will Be the Year of the Tablet - <AUTHOR> http://www.wired.com/gadgetlab/2009/08/dell-intel-tablet/

<comment><USER2> I'm a big fan of the idea of a larger-screen ipod touch. However, even I acknowledge the _likeliest_ outcome in 2010 is:

1\. Apple doesn't release a tablet. 2\. The Crunchpad goes over like the n800. Capable, but ignored by almost everyone. 3\. The Dell/Intel collaboration produces no actual product. (like their much-rumored phone and then their more recently-rumored non-phone.) 4\. A few vendors put out Windows 7 tablets that continue to be stylus-centric and fail to expand the limited windows tablet market.

If anything, Wired putting out this piece tempts me to bet on a disappointing 2010 for tablets. Their prognostication track-record is just _awful_.

</comment><comment><USER3> Is it just me or does anyone else here find zero desire to own a tablet.

<comment><USER4> It's not just you. I think tablets are a over-hyped idea. I think we'll see things like mobile phones take their place. I do, however, see natural input (such as writing and drawing) making their way on to notebook computers.

</comment></comment><comment><USER5> Could somebody remind me what problem it is that tablets are supposed to be solving for mainstream computer users? Sure, I've owned tablets in the past (models made by Motion, mostly), but I've always liked them more as technological curiosities rather than practical tools. Will non-niche computer users really want a tablet just to enable media distribution? Where is the burning need?

</comment><comment><USER6> How many "X will be the year of Y" have actually turned out to be true?

<comment><USER7> It was scary doing research on technologies for my thesis, and finding articles about each from years back.

"2000 will be the year of Bluetooth"

"1996 will be the year of speech recognition"

"1998 will be the year of gesture recognition"

(not actual years from articles, just approximates from memory)</comment></comment>


FileSend – Simple open source client side encrypted file sharing service - <AUTHOR> https://filesend.standardnotes.org/ <comment><USER2> And how does this compare to "Magic Wormhole"?

<comment><USER3> Magic wormhole is command line, made with Python. This is a web application, made with Ruby on Rails. If you visit the URI you will notice further differences.</comment></comment>


An Unconscious Patient with a DNR Tattoo – NEJM - <AUTHOR> http://www.nejm.org/doi/full/10.1056/NEJMc1713344 <comment><USER2> Submitted many times, to very little discussion. Multiple sources, you may care to look at the stories from them all:

[https://news.ycombinator.com/item?id=15833907](https://news.ycombinator.com/item?id=15833907) (4 comments)

[https://news.ycombinator.com/item?id=15832229](https://news.ycombinator.com/item?id=15832229)

[https://news.ycombinator.com/item?id=15831290](https://news.ycombinator.com/item?id=15831290)

[https://news.ycombinator.com/item?id=15829715](https://news.ycombinator.com/item?id=15829715) (1 comment)

[https://news.ycombinator.com/item?id=15829334](https://news.ycombinator.com/item?id=15829334)

[https://news.ycombinator.com/item?id=15828221](https://news.ycombinator.com/item?id=15828221) (2 comments)

[https://news.ycombinator.com/item?id=15823925](https://news.ycombinator.com/item?id=15823925)

[https://news.ycombinator.com/item?id=15823925](https://news.ycombinator.com/item?id=15823925)

[https://news.ycombinator.com/item?id=15821482](https://news.ycombinator.com/item?id=15821482) (1 comment - a spoiler)

[https://news.ycombinator.com/item?id=15820538](https://news.ycombinator.com/item?id=15820538) (1 comment)

[https://news.ycombinator.com/item?id=15819652](https://news.ycombinator.com/item?id=15819652) (2 comments)

[https://news.ycombinator.com/item?id=15819127](https://news.ycombinator.com/item?id=15819127) (1 comment)

[https://news.ycombinator.com/item?id=15818693](https://news.ycombinator.com/item?id=15818693)</comment>


The Struggling Artist at 86 - <AUTHOR> https://www.nytimes.com/2018/01/05/nyregion/the-struggling-artist-at-86.html <comment><USER2> Compare him to Picasso. Picasso never said "I had to pay the rent." He never considered earning money with anything other than painting. When he had no money he lived in friends' apartments. He faced and accepted poverty and hunger. Picasso did not compromise. Same with Van Gogh. Paintings on their own have no value. Buyers pay for the life story of the painters. The more heroic is your life the more expensive your paintings. Painter's job is to market himself in order to create a life mythology. This guy just painted. He did not create a myth around his life.

<comment><USER3> The idea that there is some One True Path to becoming an Artist (as if either path or role were a consequence of universal natural law) is myth-making at its most obtuse.

Even a cursory glance at art history will show the heroic myth is anything but universal. There are tortured artists yet others who are at the peak of mental health. There are poor artists, rich ones, uncompromising artists, artists who'll sell their soul for a drink or a fuck, artists who beat their partners, those who die young, or live to a ripe old age; organised artists, yet others who can barely find their studio.

A shorthand: there's no such thing as 'an artist' (let alone a 'real artist').

<comment><USER4> There is a huge difference between "all great artists did X" and "there is nothing particularly in common between all great artists". My intuition is telling me that the truth is definitely in the middle, and if there was some way to perform a "clustering" algorithm on artist's lives/work/legacy/commercial success we would see some clear patterns emerge around certain "archetypes" or "personas" of artists, and this guy doesn't seem to fit into one.

<comment><USER5> It is natural for one's intuition to be in the middle of one's perception of two extremes. :)

</comment></comment></comment></comment><comment><USER6> Wish there was a better proxy for the value of an artist than what their works sell for. For example, how many people did this guy influence, how did his work change art or how people understand the world? Neither was really discussed in the article

<comment><USER7> His day job was "working as a freelance graphic designer creating logos, packaging and advertising for brands like Pond's cold cream and Bufferin." So he may have anonymously influenced a ton of people to buy one brand of painkiller or another.

He also lived in Cleveland from about 1952-1961, which means there's a not insignificant chance he may have done work for American Greetings. Which means that maybe his art was on some number of cards that began or ended a relationship. That's an influence, I think? Probably an anonymous one, though.

It sounds like pretty much everything he's drawn or painted for himself is still in his apartment. So most of it hasn't had any chance to influence anyone or their understanding of the world. This may change now that he has people in the NYC gallery scene becoming interested in his work as a new artist to promote as worth investing in. Or it may not; the few pieces of his work shown in the article didn't strike me as saying anything that hasn't already been said a thousand times by the "New York School" of 50s/60s abstract expressionists that he exhibited next to back then. YMMV, abstract expressionism ain't my thing in general.

</comment></comment><comment><USER8> Reads more like a cautionary tale of what happens when you don't save for retirement than a story of a struggling artist

<comment><USER9> He's 86. Fifty years ago in 1958, when he was a young 26, prudent retirement planning was getting a good stable job with a pension. Forth years ago in 1968, when he was 36, prudent retirement planning was holding a stable job with a pension. 1978, he was 46 and prudence was still a pension. Even thirty years ago in 1988, it was the same for someone at 56. Now twenty years ago, when he was 66, new employees were typically being put in 401k plans rather than pensions, but in 1998 he was 66 and retirement age.

The world changed in ways that were not consistent with conventional retirement wisdom. Or to put it another way, people looked at the piles of money sitting in pensions and figured out a way to get their hands on it because that was their full time job. For what it's worth, there are people who spend all day everyday thinking about your retirement savings becoming their money because skating to where the conventional retirement wisdom for retirement is going is still a job people have.

For what it's worth, a lot of people who had retirement savings saw that money shrink by 40-60% in 2008-2009. There's no coming back from that even with ten years of 7% net growth, you're still behind inflation without drawing any of the capital and profits...and you're not going to get ten years of 7% net growth without extraordinary good luck.

<comment><USER10> > and you're not going to get ten years of 7% net growth without extraordinary > good luck.

Typically, I would agree, however in the cited time period I would not. From the middle of 2009 to now the DJI is up 180%. Significantly more than the 7%.

From Peak 2007, that money is up 90% since 2007.

By simply holding and not selling broad index funds, you would have been fine.

<comment><USER9> Unlike real portfolios, the Dow Jones Industrial Average gets to replace losers with winners. Dropped by the DJI since 2008 are:

\+ Alitra, Honeywell for BOA and Chevron: Remember Honeywell?

\+ AIG for Kraft Foods: AIG was worth close to $0 and Kraft was worth something and so the DJI went up because averaging in something is better than averaging in nothing.

\+ Citigroup, GM for Cisco and Travelers: GM was at about $10 and getting bailed out by the government. Consumer spending was down for Citi. The internet was exploding and Travelers had cash reserves to invest in the down market.

\+ Kraft for United Health Group. More money in fixing the problems that come from eating Cheez Whiz than selling it.

\+ Alcoa, BOA, HP for Goldman Sachs, Nike, Visa. Remember HP?

\+ ATT for Apple: Replacing the ~$50 ATT with the ~$500 Apple made the average go up. If you can swap out shares in your portfolio similarly, my advice is to do so.

The conventional advice is to play the market because the DJI is up. It doesn't explain how the DJI works and that you can't replicate its performance. And if you are retired, you have to live off the money and the size of your pile is shrinking not growing. The conventional advice comes from an industry that has no problem using your life savings for its own purposes.

<comment><USER10> I am not claiming the Dow is a ideal index I used it for its name brand, however Here is a link to a comparison to .DJI and VTI (Vanguard Total Stock Market)

[https://finance.google.com/finance?chdnp=1&chdd=1&chds=1&chd...](https://finance.google.com/finance?chdnp=1&chdd=1&chds=1&chdv=1&chvs=maximized&chdeh=0&chfdeh=0&chdet=1515099600000&chddm=1146743&chls=IntervalBasedLine&cmpto=INDEXDJX:.DJI&cmptdms=0&q=NYSEARCA:VTI&ntsp=1&ei=Rn9TWtmbCYvijAHEtZ3wBg)

You will notice a negligible difference, all of my points stand.

<comment><USER9> Here's the 10year [https://personal.vanguard.com/us/funds/snapshot?FundIntExt=I...](https://personal.vanguard.com/us/funds/snapshot?FundIntExt=INT&FundId=0085&ps_disable_redirect=true#tab=1)

If a person had bought into it in 2007, they would have done reasonably well...a little worse than 7% per year compounded. All that a person needed was an oracle to pick a winner. On the other hand, the ten year from 1999 to 2009 would not have looked so good and it's not providing DJI like increases in value because the DJI is Public Relations not finance (that's why it doesn't indicate when to make money as a bear).

Keep in mind that in terms of retirement, pensions looked good and in 1992 when the Vangard fund became available the artist was already sixty-two years old. There's no guarantee that today's Vanguard Fund will look as attractive in twenty, thirty or forty years when the people following conventional retirement advice have to cash in their chips. The fund performed _better_ than average.

Finally, people lost their jobs in the downturn and often had to dip into retirement savings to keep themselves afloat. Even with a time machine, it isn't possible for many people to have timed the market perfectly by investing heavily at the 2009 trough. That's the smoke and hand waving that the conventional financial advice uses to dismiss actual individual circumstances...well that and the idea that poverty reflects a lack of virtue.

</comment></comment></comment></comment></comment></comment><comment><USER11> > "Harry's never been a salesman," said Mary Bertschmann, his wife of more > than 50 years. "He didn't get his art out there for them to see."

Like pretty much everything in life, it all comes back to marketing. In order for people to want a specific artist's art they have to know the artist exists and they have to be familiar with his work. The more people that know, the more people will want the art, and the more valuable it will be.

For example, a Rothko is worth millions, but if I paint a large fuzzy colored rectangle it's worth practically nothing. People know about Rothko, what he was doing, and why. His art has a well-known, proven track record of being a good investment and buyers already know this.

Even in art, it doesn't matter how good the product is if nobody knows about it.

<comment><USER12> God, Rothkos... nobody has ever been able to explain why I should care about him or his fuzzy rectangles. And I was engaged to an artist that loved him...

<comment><USER13> If you have not seen a Rothko in person, you may want to postpone judgment a bit. I've known a few people who have independently told me that they didn't get Rothko until they went to a museum with his work.

<comment><USER14> Rothko is the visual art's embodiment of the emperor's new clothes. I've seen Rothkos up close and personal. They're fuzzy rectangles painted by a guy who couldn't draw. They're interesting cultural artifacts, but as an art school graduate, I hate when the smart set elevates mediocre artwork to make the unenlightened feel dumb.

Pollock's paintings at least have a sense of dynamism and there are interesting interactions in the paint. DeKooning has a sense of dynamism, but so did most classical artists with a bunch of other benefits to boot. Frankenthaler/Kline/Twombly all had one move they repeated for decades. Rauschenberg and Johns predicted a lot of modern graphic design, but you'll find more interesting visuals in an issue of Lucky Peach. Diebenkorn made an attempt to add the rudiments of representation.

Modern art is endlessly interesting. There are personal dramas, changes in cultural norms, and financial stories that are much more compelling than anything on the canvas. AbEx stuff is fine, but you'll find equally compelling designs on bedding at Target.

<comment><USER15> I was told that Rothko's Colour Field paintings were great many times and I didn't believe it because I didn't see it with my own eyes. It wasn't until after I had came to appreciate the work of hundreds of other artists that I one day stumbled across a Rothko and found it to breathtaking.

If you can get that kind of feeling looking at the bedding designs at Target, that's great, you've saved yourself a lot of trouble. I had to go on a decades long odyssey to learn how to appreciate any painting as much as I appreciate the work of Rothko.

</comment></comment></comment></comment></comment><comment><USER16> No wonder he's still struggling, his art isn't good.

<comment><USER17> Please don't post unsubstantive comments here.

<comment><USER18> Would you have said the same if his comment was "It's a wonder he's still struggling, his art is very good."

<comment><USER17> Not necessarily. Empty positive comments aren't as bad: [https://news.ycombinator.com/newswelcome.html](https://news.ycombinator.com/newswelcome.html).

It would be different if we got to a point where empty positive comments were the main threat to quality on HN, but we're far from that.</comment></comment></comment></comment>


Safe Systems Programming in Rust: The Promise and the Challenge [pdf] - <AUTHOR> https://robbertkrebbers.nl/research/articles/safe_programming_rust.pdf <comment><USER2> This kind of papers always lose value to me when the authors don't bother to do spend a couple of hours researching previous attempts in the field.</comment>


Chainer Chemistry: A Library for Deep Learning in Biology and Chemistry - <AUTHOR> https://preferredresearch.jp/2017/12/18/chainer-chemistry-beta-release/ <comment><USER2> Really cool stuff here, a lot along the same lines of what we have been trying to do with DeepChem and MoleculeNet.

[https://deepchem.io/](https://deepchem.io/)

[https://github.com/deepchem/deepchem](https://github.com/deepchem/deepchem)

[http://moleculenet.ai/](http://moleculenet.ai/)

We seem to be a little further along and stable than this repo. We are also based on Tensorflow instead of raw cuda which means users can play around with the networks more easily.

<comment><USER3> This is based on Chainer, not raw cuda, meaning its also very flexible for the user

</comment></comment><comment><USER4> Excellent. I'd been wanting to implement something like this but these guys beat me to the punch.

Most existing research on NNs in chemistry uses the SMILES string representation and feeds it into a recurrent neural network. The problem with SMILES in my opinion, is that SMILES is not unique, and there are a gazillion ways to represent the same molecule. Thus, the RNN is probably overfitting to the quirks of the SMILES serialization algorithm used by the US Patent Office and/or ChemDraw and/or whatever program was used to generate the library of molecules.

Convolutional graph networks are the obviously correct way to handle molecules.

<comment><USER5> they use canonical SMILES. Problem: there's more than one way to make canonical SMILES :(

</comment></comment><comment><USER6> This seems like the development of an artificial chemical intuition[0][1] except since its a computer it can intuit concrete numbers much more comfortably than humans can. I do wonder how its accuracy compares to just running the DFT calculations.

[0]wavefunction.fieldofscience.com/2016/09/what-is-chemical-intuition.html

[1][https://news.ycombinator.com/item?id=12624036](https://news.ycombinator.com/item?id=12624036)

<comment><USER2> There is a lot of research on attempting to approximate DFT level energy calculations with simple Neural Networks.

[https://arxiv.org/abs/1610.08935](https://arxiv.org/abs/1610.08935) [https://github.com/deepchem/deepchem/blob/master/deepchem/mo...](https://github.com/deepchem/deepchem/blob/master/deepchem/models/tensorgraph/models/symmetry_function_regression.py#L113)

[http://aip.scitation.org/doi/pdf/10.1063/1.4986081](http://aip.scitation.org/doi/pdf/10.1063/1.4986081)

It is a pretty straight-forward application of ML to the space that is starting to have solid results in practice.

</comment></comment><comment><USER7> Links of Chainer Chemistry

\- blog: [https://preferredresearch.jp/2017/12/18/chainer-chemistry- be...](https://preferredresearch.jp/2017/12/18/chainer-chemistry-beta- release/)

\- github: [https://github.com/pfnet-research/chainer- chemistry](https://github.com/pfnet-research/chainer-chemistry)

\- document: [http://chainer- chemistry.readthedocs.io/en/latest/index.html](http://chainer- chemistry.readthedocs.io/en/latest/index.html)</comment>


Ask HN: Experience with "white label" licensing? - <AUTHOR>

HN crew:
We have two potential partnership opportunities pending, both of which could involve an element of "white label" licensing, where we would license our product to a partner and have them sell it under their own brand name.   This is not something I've ever been in a position to negotiate before, and could use some help with understanding all the various parameters of such a deal and the implications.
If anyone here has been involved in deals of this nature before, and would be kind enough to share some of what you consider the "high points" to focus on, it would be greatly appreciated.  Or if someone is open to having an offline discussion by phone or email, that would be rad as well. <comment><AUTHOR> Working on answering my own question here, in the hopes that this may help someone else down the road. Here's one article that argues against startups going down the "white label" path:

[http://www.startupcfo.ca/2012/06/why-i-hate-white- labeling-f...](http://www.startupcfo.ca/2012/06/why-i-hate-white-labeling-for- startups/)

And another that takes a dim view of pure "white labeling" but suggests co- branding as a valid option:

[http://davidcummings.org/2011/08/11/white-labeled- software-s...](http://davidcummings.org/2011/08/11/white-labeled-software- strategies-for-startups/)</comment>


HN API Feature Request: Provide 'Items' Upvoted by 'Users' - <AUTHOR> https://github.com/HackerNews/API <comment><AUTHOR> I want the list of all upvoted items of my account. Upvote for me is like a way of bookmarking that item and I would like to save it for later.</comment>