The Internet of Criminal Things - <AUTHOR> http://lwn.net/Articles/658198/ <comment><USER5> I'm not so sure that governments are too concerned with the 11 million cheating cars so long as they have a nice easy target to blame, fine, and play politics with. I have a feeling they'd much rather have one company and 11 million violations than 10,000 backyard mechanics helping themselves to 15 extra horsepower after reading an article on Hackaday.

Politically, DRM is still a feature not a bug.

<comment><USER6> I see nothing whatsoever incompatible with hardware refusing to run anything other than a small list of signed binaries, and publishing the source code and makefiles (etc) to create said binaries.

Hackers turning their / your car into a socially offensive mechanism should be treated similarly to putting firing pins back in decommissioned handguns.

<comment><USER7> > _hardware refusing to run anything other than a small list of signed > binaries_

Other than that the owner should have complete control over the thing they own. I'd rather suffer the occasional hick "rolling coal" than be restricted in what I can read and write.

> _turning ... your car into a socially offensive mechanism should be > [illegal]_

Sure, but police the violation - not the mere ability to violate.

<comment><USER6> Police the violation - I agree. Should have been clearer perhaps.

i think we need to discuss why you should be able to write to your car. Or rather, there will become a OSL layer style to the car. Drive train, brakes, steering. These are things I question why you should be able to do more than verify the binary. If you want to, turn up the fuel mix or something (showing my clear understanding of cars), well, apply for a UEFI key and sign your own binary. If the GPS on the car shows you on a public highway with a unlicensed binary drive train, frankly they can pull out the tyre bursting chains.

I don't think there should be some untouchable chip at the bottom of the stack able to stop the car if the "right" people send the code. Too dangerous. But I also don't want half coded ideas driving next to me at 100kph.

Does this mean there won't be a Debian binary for Ford, undoing all the crap they throw in. No it should exist, but should also get on the highway approval eventually.

Yes, you should be free to modify your car, to the bare metal. No you should not be free to drive your modified car on the road next to the rest of us.

All our cars pass yearly tests assuring us they meet minimum engineering standards - why not the software in the car.

And no, not so stringent on the rest of the OSL layers - you can swap binaries on the CD player

<comment><USER7> > _Yes, you should be free to modify your car, to the bare metal. No you > should not be free to drive your modified car on the road next to the rest > of us._

This type of cryptofascism is quite odd to me. You are not tolerant of modifications, so why bother pretending to be? Invoking some ambiguous authoritative "us" is ridiculous in light of actual reality.

People are driving all sorts of modified cars, on the road, _right now_. People modifying things necessarily know about them in depth and are likely to do better maintenance and care than someone who expects a car to "just work" if they bring it to the stealership on the service schedule (and otherwise have no idea what a weird sound means or even how to react in the event their Toyota "suddenly accelerates").

> _All our cars pass yearly tests assuring us they meet minimum engineering > standards_

Lol. Vehicle inspections (I'm familiar with MA) cover the bare minimum of safety/signaling, plus emissions. You can technically be rejected for some types of aftermarket parts that don't meet FMVSS from when the car was manufactured, but only some shops check a couple specific things (say, headlight dispersion).

If your comment had any basis in reality, we wouldn't nearly have as many idiots driving around with "HID retrofits" that blind oncoming drivers. Do you realize that in the US, most auto parts actually aren't tested or certified by the government, but merely "self certified" by the manufacturer as conforming?

Sorry if I'm bursting your bubble here.

> _These are things I question why you should be able to do more than verify > the binary_

You can currently take apart apart and modify any of these mechanical systems, yet people have a strong incentive to make sure they work before driving anywhere. Where exactly is this _a priori_ worry and FUD coming from just because those systems are becoming software? Open software aligns incentives properly - it enables inspection, maintenance, repair, and design fixes long after the manufacturer has lost interest - just like standardized wrenches and threads. Our computerized devices should not be black boxes that we can only worship or discard.

<comment><USER6> I am perfectly happy to have my arguments picked apart, and my expression of the arguments is frequently in need of improvement. Sometimes I even learn from my interlocutors.

But _cryptofascist_?! Honestly ?

I mean this is HN. You are supposed to play the ball, not the man, and certainly not call the ball a cryptofascist ball.

Do you do this to people in real life? Have you actually used the word "cryptofasist" to a living breathing police officer? Did it come with the word "Man!" as well.

Really, stop it.

I should probably comment on the rest of your points, but it's hard to get over the first point. :-)

Edit: so, actually trying to respond.

It seems you say that open source software will align incentives, in a similar manner to (openish) standards of wrenches and parts.

I am a big supporter (can't spell proponent) of OSS in place of black box solutions - it opens up an enormous range of positive solutions. However OSS does not produce or guarantee standards. And standards are the issue I see here.

The ability to freely inspect is vital to produce a market of reliable products. It however is not sufficient - open inspection, agreed tests and measurements, and enforcement, are just parts of that.

Fake spare motor parts (OK, spare parts not meeting standards and with no accountability) should be prevented from entering the market - they increase the risk of failure, and even if it is possible to inspect the goods to determine their suitability, why should we impose that cost on every market participant? We have standards and enforcement to avoid such a problem - <USER2> could be seen as nanny state keeping people safe, or it could be seen as encouraging markets.

The method of ensuring markets are not polluted to the point of market failure will vary - most people relying on licensing and enforcement. It usually works.

I am arguing that someone who wants to inspect and play and learn about their car software should be allowed to just as they should be allowed to strip and clean an engine.

But even the cursory annual inspections (MA I assume is similar to UK's MOT) are supposed to catch below standard modifications. Even when I was younger, engines were too complex to be learnt, Father to Son, without a Hayes manual.

These days I am sure it is possible for a motivated, intelligent person to become sufficiently skilled that they could modify a modern engine, but I doubt they could do that _and_ learn how to spot fake medication, determine if an aircraft jet engine was properly serviced and if their office block is using the correct steel joists.

The world is way to complex for us to trust God and test the rest. We have to trust that there are sufficient standards and enforcements in place that we can rely on goods and services - otherwise we see market failure.

And finally in my rambling, I do not see it sufficent that if someone has modified their car, their own self preservation instinct will prevent them driving it if it could kill us both. That's never going to fly.

We need standards, inspection, accountability to ensure we defeat market failure.

We want to move beyond markets that deal in goods or services that cannot be trivially inspected by each participant.

Ps The code of Haranumbai (?) is an interesting example of regulatory failure and where standards are needed. There is a part

<comment><USER7> In the context of discussing modifications and purporting to be open to the idea of end-user modification ("police the violation"), you wrote:

> _If the GPS on the car shows you on a public highway with a unlicensed > binary drive train, frankly they can pull out the tyre bursting chains_

To me, it's a bait and switch to lead off as if you're open to end-user modifications, only to draw a line ruling out doing so on a public road - <USER3> normal and _only_ use of 99% of consumer vehicles. And I don't think my characterization of your solution as "fascist" is overzealous either - it's based on fundamental reasoning that if someone breaks the rules they deserve immediate and severe punishment.

Also FWIW, I don't think I've ever encountered any police officer who was a _crypto_ fascist. Perhaps the ones in unmarked cars.

Now, looking at your profile I see that you are in the UK (although I should have perceived based on spelling and kph). And I know regulation works much differently in the EU, with deny-by-default whitelisting instead of only reacting to problems. Perhaps in that environment, an individual working on their car really is different from an "official" mechanic. Or maybe the more cohesive regulatory environment just has you believing that it's more foolproof than it actually is.

In the US, an individual and a mechanic are the same thing, both philosophically and practically. And while the US's ad-hoc regulatory environment causes its own problems, I wouldn't say that an epidemic of mechanically unsafe cars is one of them.

So the only difference I see between modifying software and modifying hardware is that software has developed an insidious culture of "seems to work; good enough", even while being much more complex. But I think the answer to that is to push for openness and proper engineering, rather than entrenching manufacturers' sloppy processes of cobbling together reams of C and then keeping cameras out of the sausage factory.

edit: I'll respond to the points in your substantial edit tomorrow, since it requires internalizing the two very different philosophies of top-down guarantees vs bottom-up flexibility. But I will say that in the US, the self- preservation instinct has indeed been enough for people to mostly self regulate (and when it fails, insurance). Perhaps not as much as the UK (no idea about the relative stats), but it is sustainable.

<comment><USER6> Good joke about the police.

I am going to have to digest a lot of this (I cannot see you have landed any significant mind-changers) but it is more and more clear that public policy is going to be informed and sometimes driven by a software literate culture - <USER4> the "works on my machine" approach you allude to is correctly more terrifying than "started up ok in my garage" approach to mechanical issues.

But I honestly think that what I understand of the libertarian / anarchy / whatever approach places waaaay to much emphasis on individual ability to determine the reliability / safety of goods available.

<comment><USER7> I agree with your characterization of not being able to inspect+understand every good, from things being too complex and reliant on the invisible (grade of metal etc). A lot of that kind of testing is destructive testing, which obviously an individual looking to buy one item is not going to do.

But all of this speaks to the needs for standards and guarantees in the _commercial_ marketplace, yet you're applying them to private after-market modification.

We can't prevent someone from ordering paper brake pads and internally- stressed-steel bolts direct from China, putting them on their own car, and then selling it. Or jury rigging repairs in any manner of ways. Which is why there is such a market for "immutable" new manufacturer-authentic cars.

Presently there's no way to know if one's ECU's software was modified by the previous owner, and even if it has some modifications that are necessary because other hardware has been changed - such that replacing the ECU with a "stock" one would actually make other things stop working.

Free software actually _solves_ this aftermarket-modification problem with regards to software, since a buyer would be able to re-flash the car to stock (and even require the seller do so before money/title changed hands).

And this fundamental problem of aftermarket inspection is also why state vehicle inspections don't certify the "entire car", but the bare modicum of external behavior (gross safety, signaling, and emissions). _These_ are the "standards" we're talking about with respect to individual modification, and currently one can modify most anything they like as long as it meets that external behavior. Preventing any aftermarket modification whatsoever is a much stricter regime, one that I don't see the necessity to change to.

> _But I honestly think that what I understand of the libertarian / anarchy / > whatever approach places waaaay to much emphasis on individual ability to > determine the reliability / safety_

Anybody driving a car, at any time, can choose to steer into others, drive drunk/high, speed, drive on the wrong side of the road, park on the highway, use dodgy aftermarket parts, ignore mechanical upkeep, tow unsafely, be distracted, or fall asleep.

And despite all of this, people's own sense of self-preservation and personal responsibility does actually work to keep traffic mostly flowing!

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> Okay you make the software open source, then the cheating will take place in hardware. At the heart of the emission testing problem lies a poorly designed emissions test. We need better test coverage.

<comment><USER9> That would at least be more expensive. Moving the cheating to harder and harder chunks of the entire system is a fine start.

You can't have perfect security. You _can_ have security that makes bad actors pay more for the privilege of being bad actors.

<comment><USER10> But this is just a band-aid fix. Personally, I would just put the user in control. Let the user decide whether they want to run their car in high mileage low emissions mode or high performance mode. Now automakers can "cheat" all they want and it makes everyone better off.

<comment><USER11> Better off in every way except for the whole choking in smog because you've essentially abolished emission regulations.

<comment><USER10> You're right it some respects, but wrong in others. The person who really cares about their car's performance is just going to buy a high emission car and constantly pollute. If you allow drivers to have different driving modes then those gas guzzlers might be enticed to buy a more environmentally friendly car and leave it in low emissions mode for their day-to-day driving and put it in performance mode when they want it.

Hell you could put a green odometer in it and give a tax break proportional to the percent of miles driven in green mode to encourage it's use.

Trying to force car enthusiasts to give up performance will just drive them to older cars which don't have crippling software or dangerous hacks to bypass the restrictions.

</comment></comment></comment></comment></comment><comment><USER12> I don't understand why people talk about open-source as means of guaranteeing software integrity.

For most software projects these days, it's impossible to verify that a binary blob came from a given set of source code.

It's possible to do, though. Bitcoin, tor and a large number of Debian packages build reproducibly:

[https://wiki.debian.org/ReproducibleBuilds/About](https://wiki.debian.org/ReproducibleBuilds/About)

[https://blog.torproject.org/blog/deterministic-builds- part-t...](https://blog.torproject.org/blog/deterministic-builds-part-two- technical-details)

<comment><USER6> Open source is the _only_ means to guarantee software integrity. What surprises me is the fear that not enough eyeballs will look. But for VW, the scrutinising eyeballs will be employed by GM, Toyota etc. The incentive to catch your competition in cheating and thus collapse their business is enormous.

We should encourage more of it. Maybe give the competitors a factory each.

<comment><USER13> Or they will collude, as they probably did with the emissions testing. There's no way GM and Toyota saw VW's numbers and just blindly believed they were plausible. They were probably scared of calling VW out because it would bring an industry-wide crackdown, which it is. Now things are going to be more expensive for all auto manufacturers.</comment></comment></comment>


Ask HN: What did you get on your 5 year work anniversary? - <AUTHOR> A friend told me he got a $50 cash voucher and was taken out to a group lunch with a company VP. Another friend got points to use on a company store, worth about $40. These work anniversary rewards seem quite meagre. Is this common? I'd think 5 yrs at a company warrants something more to make it special. What did you get on your 5yr work anniversary? <comment><USER2> Longest I've stayed anywhere is 4 years 10 months so I've missed but then again one colleague ended up getting $63 after tax so 'missing out' may not be the right words.

</comment><comment><USER3> Nothing.

Around 5 years you should start getting 3 weeks of vacation.

<comment><USER4> We get an extra week vacation after 9 years!

<comment><USER5> What an amazing company!

</comment></comment></comment><comment><USER6> Paid... same as for the 5 years before that.

</comment><comment><USER7> I don't remember... I think it was mentioned in an all-hands.

> and was taken out to a group lunch with a company VP

That would mean a lot to me, actually. 5 years isn't a "gold watch" anniversary. I hopped so many jobs early in my career that the "this is the longest job I've had" anniversary meant a lot to me.

</comment><comment><USER8> A simple but nice (no company branding) jacket I continue to use years later.

Just before I hit 5 years my company decided that granring a 3rd week of vacation to 5 year employees was too much. They didn't reverse the decision until I almost hit my 6th.

</comment><comment><USER9> I have passed 5 years 3 times. All three times with nothing. Of course I did not expect anything.

</comment><comment><USER10> Vested 401(k) benefits.

</comment><comment><USER11> I can't remember, but probably some cash of that magnitude.

</comment><comment><USER12> Nothing for my five, but I got a gold watch for my ten.

</comment><comment><USER13> 5 days extra annual leave per year.

</comment><comment><USER14> What would be reasonable?

</comment><comment><USER15> Additional vacation day :D</comment>


Interesting Site Issue with WP Engine - <AUTHOR> https://beanstalkim.com/learn/seo/major-seo-issue-with-wpengine/ <comment><AUTHOR> WPEngine, by default, has a setting on their platform called "redirect bots". Some of the other settings they have turned on by default. This is one that should generally be turned off.</comment>


Chinese Intelligence Officer Charged with Economic Espionage - <AUTHOR> https://www.justice.gov/opa/pr/chinese-intelligence-officer-charged-economic-espionage-involving-theft-trade-secrets-leading <comment><USER2> "He identified experts who worked for these companies and recruited them to travel to China, often initially under the guise of asking them to deliver a university presentation. Xu and others paid the experts' travel costs and provided stipends."

And that seems to be the end of the allegation. I'm wondering, "And then what?"

Were the experts bribed or blackmailed? It seems like quite a stretch to be charged with such a serious crime for convincing experts to give a lecture.

<comment><USER3> > And that seems to be the end of the allegation. I'm wondering, "And then > what?"

> Were the experts bribed or blackmailed? It seems like quite a stretch to be > charged with such a serious crime for convincing experts to give a lecture.

The actual indictment is more detailed: [https://www.justice.gov/opa/press- release/file/1099876/downl...](https://www.justice.gov/opa/press- release/file/1099876/download)

He's charged with _conspiracy_ , and page 5/6 of the indictment makes me suspect the government gained some access to the conspiracy's internal communications that revealed it as such. It's still a crime to conspire with others to commit a crime, even if the plans you form are never acted upon or carried out successfully.

Edit: Further down in the indictment on pages 10-12, it looks like the accused Chinese intelligence officer convinced an employee of the company to send parts of a confidential presentation and directory listings from his work computer. The employee was later asked to download the files to an external hard disk and carry them to Europe so the intelligence officer could inspect them. It sounds like the employee was cooperating with the government and they arrested the suspect when he was expecting to get the hard disk with the files.

<comment><USER2> If I were writing the press release I'd definitely include at least one sentence describing what the conspirators dastardly plan was!

From the PR it's not even clear that an expert was knowingly involved in the plot.

<comment><USER4> Given how legal filings work, unless they have good evidence that the expert wasn't deceived they should not say that.

Besides, the filing only says that this Chinese person _allegedly_ tried to convince the expert to commit a crime, hell it even seems likely that this expert is the one that called the FBI to intervene.

Frankly, I think they should not even publicly imply this person did anything until they have a conviction, and after that only of the things that the person was actually convicted of.

<comment><USER2> Reading the indictment, it sure sounds like the victim company employee was in on it. I wonder why "Employee 1" is not also charged. The press release makes it sound like the Chinese spy was soliciting company insiders to give talks where maybe they can learn something, whereas the indictment alleges that he was brazenly asking the insiders to send copies of confidential designs. And in this case it seems the insider did exactly that, and was hand over of a big dump of valuable data was imminent when US authorities decided to move in. It seems to be more than mere conspiracy, they were actually committing espionage.

It will be interesting to see how this plays out. I wonder if "Employee 1" is a Chinese national and was under some pressure, or if there was a big payout on offer that isn't mentioned. Otherwise I can't understand why anyone would betray their employer for a few grand of travel expenses.

<comment><USER4> Please note that the indictment is the opinion of one prosecutor, who got the story secondhand (or worse), and writes with the express purpose (and bias) to get a conviction.

You should read it like it is SCO's legal description of the damage inflicted by IBM's Linux on SCO. Because that's exactly what it is.

</comment></comment></comment></comment></comment></comment><comment><USER5> I wish Russian spies were caught stealing tech secrets instead of killing and cyberwar-ing - i mean it would be kind of an indicator that my old country looks forward instead of into the past.

<comment><USER6> russia doesn't need to steal tech secrets. they have a lot of tech, especially in aviation. what they lack is in mass producing due to various things that can't be fixed overnight.

<comment><USER5> Thanks. I guess I could hardly desire for a best illustration of my point. I suppose you're a Russian millennium, right? The generation which will be defining Russia for the next several decades. Rephrasing a well known saying - Russia doesn't look into the future and the future doesn't look into Russia.

</comment></comment></comment><comment><USER7> It's interesting that the behaviors began since 2013 and nobody recognized.</comment>


"PayPal has demanded that we monitor data traffic as well as customers' files" - <AUTHOR> https://seafile.de/en/important-infos-about-app-seafile-de-and-licensing-purchases-through-our-web-shops/ <comment><USER4> > PayPal has demanded that we monitor data traffic as well as all our > customers' files for illegal content. They have also asked us to provide > them with detailed statistics about the files types of our customers sync > and share on [https://app.seafile.de](https://app.seafile.de)

That's a pretty big WTF right there.

I know PayPal has a on overall pretty scummy reputation, but I still I cannot imagine PayPal doing this because they themselves think they'll benefit from this data.

To me this seems like a demand which comes "upstream" from above PayPal, from its payment providers (VISA, MasterCard, American Express, etc). Would I be overly paranoid to imagine these demands and claims are the result of lobbing by entities like RIAA and MPAA? They _do_ have a history for blocking payments to known pirate-friendly services after all.

And as such, they clearly have too much power, and there needs to be some anti-discriminatory financial regulation to stop business-hostile practices like this from being lobbied and put in place.

Because this is just madness.

<comment><USER5> Welcome to the world of financial regulations!

You may have not realised but banks and any financial institutions have been deputised by the regulators to be the financial police. They need to ensure that none of their client use financial services to commit crimes or launder the proceeds of a crime, under the penalty of heavy (up to multi billions) fines. Particularly in the US.

I am pretty sure this is what is forcing paypal to do this. And also why I wish good luck to startups who think they will disrupt this massively over regulated industry.

<comment><USER6> Crimes. Yes.

But payday loan companies and credit cards that charge 29% interest plus hundreds of dollars in feeds to "help people with poor credit" are fine.

Supporting US government entities in defense that kill tons of innocent people every day; that's fine too.

Self regulating? Man that works so well, especially in 2008. We're going to let you keep doing that too.

Weed stores in states where it's legal? Hi it's the DEA. We're confiscating these accounts for you. Here's a fine (at least until later this year, but still only for medicinal marijuana)

It's a cluster fuck of bullshit. Of course you can always use a different payment provider, but with PayPal being just so damn easy with very little competition, it's like saying if Amazon removed your eBook, just publish it somewhere else. The trouble is the distribution networks are so big that they become the only means of distribution. If you control 90% of the market and shut down a DropBox competitor, you're choosing which companies succeed.

<comment><USER7> Regulation has done a great job in several industries of concentrating the industries into a few major players, because it is incredibly difficult to comply for new/small companies. Banking and finance is one, telecom is another.

<comment><USER8> Telecoms got itself monopolised just fine _before_ regulations came along. AT&T sealed in the concept of _operating_ as a regulated monopoly. But that goes back to 1913.

There are industries which tend naturally toward monopolies, with transport, communications, broadcast, and software among them. There are also industries which tend naturally _away_ from monopolies, such as sandwich shops, cement providers, and laundromats.

(Not that there cannot be some concentration, or even national chains among these. But they're rarely dominant.)

<comment><USER9> Would you say that industries with heavy network effects tend towards monopolies, while those without tend to produce more competition?

<comment><USER8> That's a large part of it.

Transport, comms, banking, and information technology, tend toward monopolies.

Consulting is a mixed bag -- if you're relying on creativity, not so much, but if you're relying on marketing and business contacts, both of which are far more a network effect (with strong lock-in elements), yes. Contrast your typical small-gig design shop vs. the Big Declining n Accounting Firms, or IBM and Oracle (consulting / business services).

Retail can be local (small effects) or global: large grocery stores, WalMart, Amazon.

There are other effects as well. I've been curious about Maersk's adoption of ultra-large cargo ships, even as shipping volumes have been falling. While there's a financing-design-build lag, there's also the possiblity that _having and operating a large ship_ puts pressures on other operators -- if you're operating and loading, you're taking cargo which would go onto smaller vessels.

It's complicated.

Part of this also plays into concepts of what and how technological mechanisms actuall function: [https://ello.co/dredmorbius/post/klsjjjzzl9plqxz- ms8nww](https://ello.co/dredmorbius/post/klsjjjzzl9plqxz-ms8nww)

I'd include among "network effects" urban and even empirical structures.

</comment></comment></comment></comment></comment></comment></comment><comment><USER10> Another victim of Paypal here. I run Jumpshare, a file sharing and collaboration service for creative professionals. This is what Paypal sent us:

"May 8, 2016: When you signed up for your PayPal account, you agreed to our User Agreement and Acceptable Use Policy. Because some of your recent transactions violated this policy, we've had to permanently limit your account.

Please remove any references to PayPal from your website."

They never mentioned which transactions violated the policy, we have never had any complains from our customers. There was no prior warning. We called them and they asked us to email them. We sent multiple emails and nobody bothered to respond back. We lost 30% of our recurring monthly revenue right away!

We now use Stripe as our sole payment service provider. After this experience, we will probably never accept Paypal again.

<comment><USER11> Having read during the last few years about the endless horror stories businesses have endured with PayPal, I honestly don't understand why anyone would still use PayPal when there clearly _are_ alternatives (be that US companies like Stripe or EU companies like Paymill).

<comment><USER12> Because they're still anecdotal and for most people, PayPal works just fine. I find the stories horrifying, but I ran about 40,000 transactions through PayPal in the last 5-6 years and never had any problems.

I guess this is how it is for most people, at least, I can use PayPal as a buyer on most online businesses I deal with.

<comment><USER13> Sure, using PayPal as a buyer is great as long as you never get into a dispute with a seller. It took about 4 months for me to get PayPal to refund my money when a seller on eBay ripped me off.

PayPal support was so inept they claimed that I had not returned the merchandise despite giving them the DHL tracking number and shipping receipt multiple times and eventually they closed my case in favor of the merchant.

I had to keep calling and harassing them and finally threatening to have the charges reversed by my credit card company when they suddenly reversed their decision.

I will never use PayPal for anything if I can avoid it.

<comment><USER14> I used to accept PayPal as a payment method when I was doing freelancing, ran hundreds of thousands of dollars through my account over the many years of having it. One client refuted a payment SIX MONTHS later, and they granted it to him based on the fact that it was a digital service and there's no way to verify it was successfully transferred.

I immediately closed my bank account (PayPal wouldn't let me remove it while a refund was being made. Yes they were going to debit my bank account since I had no funds in my account, which I never kept).

Now they've put that amount in collections and honestly, as someone who cares about his credit, that one will stay the time until it's removed. I'm not paying them, or the thief.

<comment><USER13> You could get together all your documentation with respect to that transaction and dispute that negative credit item directly with the three credit bureaus.

<comment><USER15> Exactly right, up to now the dispute existed in PayPal's walled garden and played out under their rules. PayPal's dispute resolution process has some serious flaws - with many high-profile examples - and often drags out to just slightly longer than the time limit for chargebacks (funny that, huh?).

I would raise the stakes a bit more and send PayPal a hard copy of supporting documentation and tell them that you will be disputing any negative report. Send this by a recorded delivery method like registered mail or courier. This means you can go to court and prove that PayPal had clear evidence of fraud and failed to take appropriate action. It also proves that they had knowledge of these facts prior to making the negative report to the credit agencies, which puts them in a bad spot if this all ends up in court. In the USA, the Fair Debt Reporting Act covers this scenario but similar laws exist in other countries.

Keep good documentation and send everything by a trackable method and never let these companies get away with ignoring you when you have a legitimate issue. Just make sure you are sure you have proof that you are correct, otherwise keep better documentation next time.

</comment></comment></comment></comment></comment></comment></comment><comment><USER16> Given that we've all read similar situations happening all over the web, I'm surprised organizations aren't including "paypal drops us for arbitrary reasons" or "paypal freezes our funds with them for arbitrary reasons" in their risk assessments when choosing vendors. In almost every case, that risk should probably push decision makers away from Paypal.

It is also a little entertaining that their "brand risk" department is probably doing so much unintentional damage to the brand.

<comment><USER17> The reason PayPal continues to be provided with the opportunity to fuck people over is primarily due to their low financial/technical barriers to entry. A website can be configured to accept PayPal payments in less than half a day, and setting up a new PayPal account is a very straightforward process.

Compare this with setting up a merchant account to take payments (here in the UK), which takes weeks, involves finding a payment gateway, all sorts of paperwork and hoop jumping.

Fortunately companies like stripe.com have appeared here and will now eat in to PayPals user base. I can't wait for PayPal to go away.

<comment><USER18> > Fortunately companies like stripe.com

The sad truth is that Stripe is behaving exactly like PayPal. What's worse is that Stripe's fraud protection is non-existing. In other words, Stripe is actually worse than PayPal, as you risk the same account freeze, closing etc, but in addition, you will be swamped down with fraudulent purchases and chargebacks.

<comment><USER19> (Disclaimer: I work at Stripe) Stripe does have a fraud protection product, which is enabled by default for every user. It centers around a machine learning system, that uses static signals (e.g. card issuing country) and time-dependent, dynamic signals (e.g. "how many different devices have tried to use this card in the last N hours?") to analyze every charge that hits our systems. Transactions that are deemed almost certainly fraudulent are automatically declined (but can be reviewed in the dashboard or via the API.)

We're constantly working on product & performance improvements, but feel free to get in touch with me directly (firstname.lastname@example.com) to ask questions or share feedback on our models (and fraud product in general).

<comment><USER18> For posterity, yes you do have this "neural network" thing. It does not really work now AFAIK, but I do hope you will succeed as we definitely need a viable alternative to PayPal.

Though I'm sceptical to this approach. In machine learning 101 we learned that there always exist a statistical method that would beat a neural network. In this case, a system that gathers actual relevant data for statistical scoring. You know hard data, like an up to date list of stolen credit card numbers, a history of chargeback per credit card etc. PayPal has this and of 1000 transactions, we have 1-2 fraudulent chargebacks. Compared to Strip this is the difference between heaven and hell. PayPal sucks, but at least they have a working fraud protection system.

Nothing kills an online business faster than being swamped in fraud and chargebacks. I mean, good APIs are great and Stripe certainly has that, but a working fraud protecting system is what really matters to those of us who sell online.

</comment></comment></comment></comment></comment><comment><USER20> I'm once again astonished with how much control of our businesses is simply out of our hands.

When looking at practices these financial institutions use it makes me wonder what can't they do?

Everyone cites "regulations", but as far as I understand, they make the regulations. Directly or indirectly.

Take for example the known cases where PayPal freezes accounts holding people's money. If I take someone else's money and refuse to give it back to them, it's a crime in pretty much every nation. But when banks and financial institutions do that, they get away scot-free (with maybe some small rants from the internet) and keep doing this systematically profiting in almost all cases.

If we're not bound to middle men like Stripe and PayPal, we're bound to Visa and Mastercard. Is there any way out of this madness?

<comment><USER21> Essentially, it goes way further than what these financial institutions can do. It goes directly to what the U.S. fed can do - the clearing house for the USD. It can cut off any bank for misconduct/doing business with e.g. Cuba etc.

<comment><USER22> Also, the UN bank can threaten to kick out your central/federal bank too.

Also an interesting example of bank politics is that Khadaffi made several laws in Libya against UN bank rules, for example providing loans with infinite term and zero interest for newlyweds. During the civil war, one of the first things the rebels did was create a central bank in Misrata, pledge loyalty to UN and then redquest to be recognized as the true Libyan Government.

<comment><USER23> > _the UN bank can threaten to kick out your central /federal bank too_

This does not exist. Central banks interface with each other. The closest thing to what you're describing is the European Central Bank.

> _pledge loyalty to UN_

This is gibberish. One can be _recognised_ by the United Nations (UN). One can also, by accepting its Charter and paying one's fees, become a UN Member. But there is no pledging of fielty involved.

<comment><USER22> You never heard of World Bank, BIS, FSB, whatnot?

<comment><USER23> > _You never heard of World Bank, BIS, FSB_

None of these is referred to as "a UN Bank". Only the World Bank is a part of the United Nations system. It makes loans to developing countries. The only way being "kicked out" of the World Bank makes sense would be if it refused to lend to you (which it does often and usually with minimum consequence). Note that the World Bank System lends to many non-UN member entities, _e.g._ private businesses and non-profits. China got pissed off at the World Bank and IMF last year and effectively kicked itself out by starting a competitor in its "New Development Bank".

The Bank for International Settlements is a discussion forum whose recommendations are not binding. The United States, for instance, added its own touch to Basel III, Switzerland layered on a "Swiss finish" and China, India and many others simply ignored it. Being "kicked out" of the BIS would simply mean you don't get to go to its meetings. Many countries do fine without being BIS members. The Financial Stability Board is an even smaller group with even less tangible activity than the BIS. (It published a book report on rules it thought sovereign wealth funds should follow. Compliance is voluntary and one need not be a member to read or implement, or as more countries have done, ignore, the report's suggestions.)

The closest international financial systems one can be "kicked out" of with consequence are the electronic-dollar transmission system operated by the New York Federal Reserve [1] (you can still use printed dollars if America "kicks you out") and the Society for Worldwide Interbank Financial Telecommunication (SWIFT) [2]. SWIFT is not a club for only central banks–many private banks are SWIFT members, too, and many get "kicked out" for doing varieties of stupid things. They can still move their money around by asking other banks to do it for them.

The international financial Illuminati you think exists does not.

[1] [https://www.newyorkfed.org/aboutthefed/fedpoint/fed20](https://www.newyorkfed.org/aboutthefed/fedpoint/fed20)

[2] [https://www.swift.com](https://www.swift.com)

</comment></comment></comment></comment></comment></comment><comment><USER24> File sharing services are listed as requiring pre-approval, so Seafile should've sent them an email before accepting it as payment:

[https://www.paypal.com/us/webapps/mpp/ua/acceptableuse- full](https://www.paypal.com/us/webapps/mpp/ua/acceptableuse-full)

They're well within their rights to decline your business. If a bank told the government, "We have no absolutely no idea what our customers are doing with their money or who they're sending it to. Maybe they're sending it to terrorists or drug lords, maybe they're not; it's none of our business and we respect their privacy", they'd get shut down in a heartbeat.

I can understand if Paypal doesn't want to appear on the front page of the news for funding an underground child porn ring that signed up as one of your "enterprise clients".

<comment><USER25> > They're well within their rights to decline your business.

They are. Should we condone it?

> "Maybe they're sending it to terrorists or drug lords, maybe they're not; > it's none of our business and we respect their privacy"

Isn't this similar to the idea of banning web browsers, as they render HTML which, as we all know, can be used to write text (plaintext!) inciting terrorism? And it sometimes is. Are you using a browser _right now_?

Things we deem "evil" are planned using technology. Should we ban technology?

<comment><USER26> > Isn't this similar to the idea of banning web browsers, as they render HTML > which, as we all know, can be used to write text (plaintext!) > inciting terrorism? And it sometimes is. Are you using a browser right now?

Search engines and hosting services already monitor for illegal content.

Reasonable people can disagree over whether requiring a filesharing service to monitor for illegal content is excessively onerous, but the slippery-slope fallacy does noone any favours. You can make any policy sound absurd by taking it to a far enough extreme. Often we do need to weigh up costs and benefits and take a policy line somewhere in the middle.

<comment><USER27> > slippery-slope fallacy ... sound absurd by taking it to a far enough > extreme.

Assuming that you actually value logic, given your choice of words, how do you not see that the magnitude of the absurdity is directly related a faulty premise - a fallacy?

       Live and let live * [1..1000] = nice .. nice
       Kill at random    * [1..1000] = bad  .. horrific

So no, not every policy can be made to sound absurd.

<comment><USER26> "Live and let live" can absolutely be made to sound absurd by taking it to the extreme. Does the amount of taking-far-enough needed to make something sound absurd vary? Sure. But the post I replied to was doing a whole lot of taking- far-enough.

<comment><USER27> > ...needed to make something sound absurd vary? Sure.

That is your point, not mine. I'm saying that you're focusing on the wrong part of the equation. Imagine a machine with two variables that you have influence over, calibration error and runtime. You are suggesting short runtimes in order to minimize the impact of calibration error, I'm suggesting recalibration.

I'd love to hear an extreme for "Live and let live", but I'm guessing that whatever scenario you can imagine is based on a faulty premise like "How can we wreak revenge without a death penalty?!".

<comment><USER26> > That is your point, not mine. I'm saying that you're focusing on the wrong > part of the equation. Imagine a machine with two variables that you have > influence over, calibration error and runtime. You are suggesting short > runtimes in order to minimize the impact of calibration error, I'm > suggesting recalibration.

Please stop with the extended metaphors and just say what you're trying to say directly.

> I'd love to hear an extreme for "Live and let live", but I'm guessing that > whatever scenario you can imagine is based on a faulty premise like "How can > we wreak revenge without a death penalty?!".

Whatever. Are you interested in a constructive discussion or not? There are plenty of silly extremes for "live and let live" \- harming the environment in ways that don't kill anyone? Harming themselves in all the various ways that can happen? Harming their children?

<comment><USER27> > metaphors

I count two metaphors, used only because the direct explanation failed to get through to you.

> Whatever. Are you interested in a constructive discussion or not?

I think it is clear that won't happen, "Whatever" is a strong indicator of disinterest.

> There are plenty of silly extremes for "live and let live"

None of those examples make any sense, which can be explained in two way: you don't know that "live and let live" is an idiom related to coexistence and tolerance, or you think that "extreme" necessitates mutual exclusivity.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER28> Apparently the other filesharing companies spy on user data,that is why they are on Paypal.

<comment><USER29> I wonder. It is a bit worrying that DropBox accepts PayPal.

<comment><USER30> Dropbox is a US based company, is not bound by EU data protection law, the Charter of Fundamental Rights of the EU (basically the EU's Bill of Rights), and additionally the US Constitutional ban on warrentless searches does not apply to EU citizens in EU.

<comment><USER31> EU Dropbox customers are the customers of Dropbox Ireland Limited (a company registered in Ireland), not Dropbox, Inc., a company registered in Delaware, so actually all of the EU regulations apply to their EU customers.

Source: I'm a paying Dropbox customer living in the UK and my invoices are issued by Dropbox Ireland Limited.

<comment><USER32> But where is your data stored?

<comment><USER31> [https://www.dropbox.com/privacy](https://www.dropbox.com/privacy)

Where Around the world. To provide you with the Services, we may store, process and transmit information in the United States and locations around the world - including those outside your country. Information may also be stored locally on the devices you use to access the Services.

Safe Harbor. Dropbox complies with the EU-U.S. and Swiss-U.S. Safe Harbor ("Safe Harbor") frameworks and principles. We have certified our compliance, and you can view our certifications here. You can learn more about Safe Harbor by visiting [http://export.gov/safeharbor](http://export.gov/safeharbor). JAMS is the independent organization responsible for reviewing and resolving complaints about our Safe Harbor compliance. We ask that you first submit any such complaints directly to us via email@example.com. If you aren't satisfied with our response, please contact JAMS at [http://www.jamsinternational.com/rules- procedures/safeharbor...](http://www.jamsinternational.com/rules- procedures/safeharbor/file-safe-harbor-claim).

NOTE: When transferring data from the European Union, the European Economic Area, and Switzerland, Dropbox relies upon a variety of legal mechanisms, including contracts with our users. Dropbox doesn't rely upon Safe Harbor as a legal basis for data transfer but does adhere to the Safe Harbor Privacy Principles while specific guidance for the forthcoming EU-US Privacy Shield program is developed. For information about data transfers from Europe to the United States, please visit this page.

</comment></comment></comment></comment></comment></comment><comment><USER33> Compliance Officer in financial sector in Luxembourg here. The request you have received is related to anti money laundering regulations. As you guys seem to be based in Germany. So bear in mind that PayPal operates across the European Union as a Luxembourg-based bank. Anti-money laundering regulation is typically stricter in Lux than in the USA. The Lux regulator is the "CSSF", and you can find the detail of the regulation here: [http://www.cssf.lu/en/supervision/financial-crime/aml- ctf/la...](http://www.cssf.lu/en/supervision/financial-crime/aml-ctf/laws- regulations-and-other-texts/)

</comment><comment><USER34> So, suprise suprise, my 6 years old blogpost continues to be spot on [https://jeena.net/paypal](https://jeena.net/paypal) that is when I deleted my PayPal account. But it was not all dance on roses after that, suprisingly many only offer PayPal as a way to pay them, so I always have to try to contact them and to try to explain and to ask for another way to pay. Most of the time they won't/can't help me.

<comment><USER35> look into bitcoin.

<comment><USER36> Sending money in an envelope would be easier and more accepted.

<comment><USER35> Not if you are in Germany, with bitcoin.de it is a very simple process.

</comment></comment></comment></comment><comment><USER37> Had to use Paypal today to make a payment to a company who can't otherwise find a reasonable way to take credit cards online. I feel their pain, having been in that position. Paypal randomly saw that it was reasonable to demand I answer a phone in another country (though I haven't been based there for perhaps 15 years) if I wanted to log in to my account. I had to work around this by having them send a payment request, then paid about USD$1000. Wish they accepted Bitcoin, I was livid at the experience. Every time I deal with Paypal it's the same. Their PR crap a year or two back about "sorting things out" was obviously empty. Stripe isn't much better: after a reasonable start, last time I wanted to use them I couldn't because my address is in a different country to my card (ANYONE LISTENING?). These abuses are reaching a breaking point, nobody is going to deal with credit cards soon. Here in amusingly progressive mainland China, they are a minor mode of payment and shrinking: good riddance!

<comment><USER38> Am I misinterpreting something? It sounds like you're upset with PayPal because you tried to make a payment from a country other than the one on record (which trips every fraud detection out there) and that they tried to contact you for verification with the number they had on file which you haven't updated in 15 years. That sounds like reasonable behavior from their end.

<comment><USER37> ... except that I haven't changed my behavior and the 'reasonable' action they took was permanently locking me out of my account. Note that they presented this whole experience to me in a foreign language because obviously my GeoIP is the same as my location because privacy, China and VPNs don't exist. And of course, I had no choice but to leave that number on record because it matches my credit card address. Because of course, there is no such thing as a credit card with an address outside of the issuing country, or someone that lives at many addresses or an address where there is no reliable mail. It's basically a number of bad assumptions layered with bad customer service and algorithms. Every year my credit card company randomly stops my card because they think it's weird a transaction occurred in some country or other. I say "See how I just bought a plane ticket right before that? How is that strange?". Right on my card it says "World Mastercard". I have or have had accounts with this same bank in 5 countries. They know this. But we can't just blame the bank, it's the credit card system. Apparently in every corner of the world, idiots run these algorithms. Finally, note that for this wonderful experience I pay 5% of USD$1000 = USD$50. The US intelligence sponsored monopoly of card companies on payment has to end.

</comment></comment></comment><comment><USER39> Here's PayPal's page on what they require for file-sharing services:

>Merchants offering file-sharing programs or access to newsgroup services must monitor for and prevent access to illegal content.

[https://www.paypal.com/selfhelp/article/FAQ1116/?country.x=J...](https://www.paypal.com/selfhelp/article/FAQ1116/?country.x=JP&locale.x=en_US)

<comment><USER40> "Article is currently unavailable"

Searching for this entry with keywords like "file-sharing" did not turn up anything.

<comment><USER39> >Searching for this entry with keywords like "file-sharing" did not turn up anything.

Well that's really helpful of them.

I've updated the link, can you read it now?

Edit: FWIW, this was on the first page of Google for me - in Poland - <USER2> searching "paypal file-sharing"

<comment><USER40> Thanks, the link works now for me.

Apparently this depends on the country. Your link includes JP for Japan and the contact mail address for Japan (which ironically is spelled wrong).

I really cannot reach it from Germany without this ?country.x=JP.

</comment></comment></comment></comment><comment><USER41> Paypal only exists because the current infrastructure of payments in the US is a joke

Nobody needs paypal in Europe. Of course, they try to sell themselves as "the easiest way" (which is right to a point) but it's mostly unneeded

<comment><USER42> What are the alternatives in Europe that make Paypal not needed? Genuinely curious, not saying you're wrong by any means.

<comment><USER43> Germany: SEPA direct debit, sofortueberweisung.de, giropay, and if you're willing to put up with PCI compliance bullshit, credit cards. All three are vastly cheaper than PP, too.

<comment><USER44> I still find the idea behind sofortüberweisung shady. Maybe they're actually the nicest people in the world with the best security practices known to humanity, but I still won't hand them the login credentials to my online banking or my card's PIN.

<comment><USER45> They actually admitted (2011) that they scrape the last 30 days of transfers of your banking account. German Source: [http://www.golem.de/1105/83811.html](http://www.golem.de/1105/83811.html)

</comment></comment></comment></comment></comment><comment><USER46> Presumably with TTIP harmonizing laws between the US and EU, violating the privacy of users will stop being illegal in the EU at some point.

<comment><USER47> Hopefully the other way around in the US.

</comment></comment><comment><USER48> Improvement: PayPal at least asked first, IIRC that was not always the case.

Still I advise people not to depend solely on PayPal because of their tendency to freeze funds over nothing.

</comment><comment><USER49> I wonder if legal action can be taken against PayPal for demanding this kind of information. PayPal blackmailed them into breaking a law (they didn't break it but they suffered financial loss from not doing it).

If I told a customer who absolutely depends on my business to harass/attack somebody, I would certainly hold liable as well.

<comment><USER50> Or can PayPal take legal action against _them_ for violating ToS? Did they properly disclose they were a file sharing site (as required by PayPal) before signing up to take payments? If they can't meet PayPal's ToS, they shouldn't have signed up. [Paypal sucks, but this doesn't seem like a cause for legal remedy]

<comment><USER51> ToS do not trump the law in Europe, so no. If a company is offering services in Europe with terms that contradict local law, the terms are void.

</comment></comment></comment><comment><USER11> It's time to share & spread information about PayPal's competitors:

What has your experience or market research yielded (stripe.com and paymill.de probably being the most obvious ones)?

<comment><USER52> Paymill seems to have a somewhat uncertain future at this point: [http://ecommercenews.eu/german-payment-provider-paymill- file...](http://ecommercenews.eu/german-payment-provider-paymill-files- preliminary-insolvency/)

</comment></comment><comment><USER53> This is the reason I stopped using Paypal.

The want to position themselves as a financial services provider equivalent to traditional banks, except that they reserve the right arbitrarily - <USER3> without recourse - remove their services.

As a customer this means you can be cut out from your ability to use "currency". As a business this means you're beholden to arbitrary decisions that you can't really risk assess against - and if you've built your business on this service it could be devastating.

</comment><comment><USER54> I think I just found my new cloud provider. It's rare to see a company stand firm on their values like this.

</comment><comment><USER55> I was under the impression that European wire transfers were cheap (free), fast, and reliable. If that's true, why is something like PayPal even needed? Can't Seafile just have their clients transfer money to Seafile's account? Or are wire transfers not free for "retail" use like this?

<comment><USER56> One time SEPA transfers are already really simple, yes. Recurring ones, not so much. However SEPA Direct Debit [1] does look like an interesting new recurring system, with a compliance deadline of 31 October 2016. I will definitely be looking more into this, and probably will be trying it out in the wild.

[1] [http://www.europeanpaymentscouncil.eu/index.cfm/sepa- direct-...](http://www.europeanpaymentscouncil.eu/index.cfm/sepa-direct- debit/sepa-direct-debit-core-scheme-sdd-core/)

</comment></comment><comment><USER57> I have quite some personal experience with PayPal, and their policies seem quite random. If one person gets it into his or her head that something is not allowed, no voice of reason will change the decision. I wouldn't shed too much tears over it though, there are many better and cheaper alternative forms of payment.

<comment><USER58> Can you give some examples? I know in America there are lots of startups doing it, but what about the rest of the world? I looked into Skrill a few years ago which seems to be just as international as Paypal, but also with just as horrible terms and conditions.

<comment><USER59> In Germany (where seafile is located), there is for example Paymill [1] for accepting credit cards and SEPA direct debit. It is pretty expensive (2.95% + 28 cents per transaction) but it seems to have a good API and if it is more reliable than PayPal (which isn't exactly cheap either) it might be worth it.

[1] [https://www.paymill.com/](https://www.paymill.com/)

<comment><USER60> Quote overpriced and uncertain future (they recently filed for Chapter 11)

</comment></comment></comment></comment><comment><USER61> What is the most disappointing is PayPal's lack of Customer Service. Why would any vendor want to use their services when they are so badly treated? It also throws into question the data security of other vendors's cloud storage. Is everyone looking at my stuff?!?

</comment><comment><USER62> Shenanigans like this will only hasten the onset of a bitcoin economy.

<comment><USER63> Yes, because the bitcoin economy is totally free of shenanigans.. ;-)

<comment><USER64> "But our shenanigans are cheeky and fun!"

"Yeah, and his shenanigans are cruel and tragic."

"Which... makes them not really shenanigans at all."

</comment></comment></comment><comment><USER65> _Since complying with this demand would violate German / European data protection laws (and also be morally wrong in our opinion) we have declined to comply with this demand._

Is everyone in Germany going to have this issue?

</comment><comment><USER66> Has anyone made a site yet detailing all of these horror stories? Paypal's behavior is unacceptable and needs to change, yet years later things still seem just as bad for their customers.

<comment><USER17> Yep, there's loads:

[https://www.aboutpaypal.org/](https://www.aboutpaypal.org/) [http://www.paypalwarning.com/](http://www.paypalwarning.com/) [http://www.screw- paypal.com/horror_stories/horror_stories.ht...](http://www.screw- paypal.com/horror_stories/horror_stories.html)

Some of the content is NSFW

<comment><USER66> Thanks, just what I was looking for.

</comment></comment></comment><comment><USER67> To a corporate lawyer, every file sync and team collaboration solution looks no different from Megaupload.

<comment><USER68> To a user, too. That's why every file sharing service eventually gets taken over by the same people with the same problems.

</comment></comment><comment><USER69> Another great example of the so called "democratization".

<comment><USER69> Whoever down-voted the comment above doesn't probably know that "democratization of management and movements of money" is really one goal of this company. ( [http://fortune.com/2015/05/21/paypal-ceo-dan- schulman/](http://fortune.com/2015/05/21/paypal-ceo-dan-schulman/) )

Now it's seafile.de, a couple of months ago they started to block accounts used to pay VPN services. What's next?

I am not judging the company, because I am sure that they would like to have users to pay everything possible via their services. That's fine. I just find it incoherent to claim that they are democratizing the way to manage/move money around.

</comment></comment><comment><USER70> That's a pretty huge WTF request.

Can you sue Paypal for basically telling you "break the law or don't use us" (I think that's a pretty bad idea on ideological grounds but I wonder if it's technically possible)? Especially since Paypal has to be regulated within the EU in some way I'd say such a request should result in at least a cursory check if the EU license (iirc. they operate as a bank) of Paypal should be revoked/suspended/investigated.

</comment><comment><USER71> For those thinking this has something to do with "regulation", it does not. Paypal has done this sort of thing for years. In the past it has been the "cyberlockers" and VPN services, even Wikileaks. Someone is putting soft pressure on Paypal. Someone in government or, more likely, someone within the copyright-lobby is threatening them. That has been the pattern in the past.

</comment><comment><USER72> Paypal apparently has plans of coming up with a sequel to "The Lives of Others" [1]

[1] [https://en.wikipedia.org/wiki/The_Lives_of_Others](https://en.wikipedia.org/wiki/The_Lives_of_Others)

</comment><comment><USER73> "AML" this is all cover for CIA economic espionage as always the people asking the questions are the competitors. Who need know how, who and where your customers are marketing reasons to undercut your prices for selected customers! You see never hand over your member list when you don't know who the end users are. Think T-mobile and at&t then about the switch offers to selected user based on data usage.

</comment><comment><USER74> This means that it's easier than ever to spot companies that are monitoring YOUR data: just check whether they accept PayPal or not.

</comment><comment><USER75> AFAIK PayPal only do this if they have internal proof that laws are already being broken on the according websites. I don't know Seafile, but the same happened to other file hosters in the past which silently and willingly accepted that copyrighted material is exchanged by using their services.

</comment><comment><USER76> Last year I worked for a Dropbox-like service, and PayPal was continually giving us grief over using them as a payment service as well. I don't recall them asking us to monitor every user's traffic, though.

</comment><comment><USER77> I use PayPal often for online stores where my Discover card isnt accepted but I cant believe they are still around and have a huge market share. The platform is so broken.

<comment><USER78> For me it's the opposite, i never use Paypal because i keep reading evil stories about them - i don't want to support a company which behaves like this...

</comment></comment><comment><USER79> I've seen detractors lambaste Seafile as an untrustworthy Chinese company/app originally. Anyone know if there's any truth to this?

</comment><comment><USER80> Well, sorry paypal, but I've seen a host of new payment services crop up lately. Now is not the time to push your clients around.

</comment><comment><USER81> A little of topic but has anyone else noticed the paypal website being extremely slow?

<comment> the-dude Paypal has been (extremely) slow for years, at least 6 years.

</comment></comment><comment><USER82> Isn't this why we pay paypal fees in the first place?

</comment><comment><USER83> Anyone have a link to the notices PayPal sent Seafile?

</comment><comment><USER84> OP, are you from Zolder, Belgium???

</comment><comment><USER85> faith in humanity restored

</comment><comment><USER86> I don't think they need regulation. I think they need to carry on like they are for a few more years so I can watch them be eaten alive by crypto currencies and other fintech innovations.

<comment><USER87> I think the problem is that PayPal almost have a monopoly on e-commercial market, and because of the stickiness of users, it's hard to break the monopoly.

<comment><USER88> I do not believe they have a monoply any more. a few years ago they where much more prolifict, I paid for ALOT of things via paypal. in the last 5 years I have made 0 transactions on paypal.

With Amazon, Stripe, and others merchant solutions, as well as Apple and Google geting into the game soon for webpayments in addition to app paymets I do not believe the reliance on paypal as a quick way to process credit cards for business is as high as it was, further the reluctance for consumers to enter their credit card data never really materialized.

Currently I think a business that only has PayPal as a payment option is harming their business, while you might keep it around for those few users that still only want to use paypal if I see an option to use anything other than paypal I will take it.

<comment><USER89> > With Amazon, Stripe, and others merchant solutions, as well as Apple and > Google geting into the game soon for webpayments

Most merchant solutions you mention are only available in a handful of countries. Paypal way more widespread.

</comment></comment></comment></comment><comment><USER90> I stopped using file-sharing software long back. I use s3 now.</comment>


Tus.io: Open Protocol for Resumable File Uploads - <AUTHOR> http://tus.io/ <comment><USER3> It will need to monitor and induce at most 20-50ms bufferbloat when uploading, regardless of whether the traffic is high or low priority.

Try this demo for yourself:

1\. Run "ping google.com" from another computer on your LAN.

2\. Upload a 10-20MB file via Gmail or Dropbox from your computer.

3\. Watch the ping times on the other computer skyrocket from around 100ms to upwards of 5-10 seconds.

4\. Try a Google search from any other computer on your LAN while this is happening.

As an example, Apple's software update actually uses a variant of LEDBAT (the delay sensitive congestion avoidance algorithm from BitTorrent's protocol) when downloading software updates to avoid inducing bufferbloat in the downlink.

</comment><comment><USER4> When you think about it, it's pretty weird that we've had resumable, buffered streaming video modules for server-side stacks for years now, but nothing standardized for sending data in the other direction.

I guess getting things into the server stack can roll out slowly, with very limited and spotty adoption.

Browser support on the other hand...

Well, need I continue?

Suffice to say, that even without the open warfare between rival browser projects, and nightmare-mode security vulnerabilities in common browser plug- ins, it will only make a difference if hundreds of millions of users actually latch onto a new protocol, before it becomes something of a norm.

</comment><comment><USER5> If anyone is interested in prior art, take a look at Google Cloud Storage's resumable uploads: [https://cloud.google.com/storage/docs/json_api/v1/how- tos/up...](https://cloud.google.com/storage/docs/json_api/v1/how- tos/upload#resumable)

It's very domain specific and relies on GCP's JSON API so probably isn't suitable to apply broadly.

<comment><USER6> Hi, one of the authors here. Indeed, resumable uploads are not a thing we invented. Nevertheless, we think it's handy to have a document describing the approach and client and server implementations. Amazon, Dropbox and Google offer some in the way of describing how they do it, but nothing to address the problems that wider audience could encounter, and no platform for collaboration to make it better. tus was built under MIT and on GitHub and will continue to evolve through contributions from the community (although we consider that what we cemented into 1.0.0 ready for adoption)

</comment></comment><comment><USER7> Resumable file transfers in JS is really cool.

But why a totally new protocol? Why not use bittorrent, rsync, or even ftp? A lot of effort has gone into making those reliable in the face of network congestion. Trying to shove a lot of bits down a single TCP connection with no traffic shaping is just asking for bufferbloat to strike.

<comment><USER8> Because these protocols are unusable from the perspective of JS on a webpage in a browser. Yes, browsers do support FTP, but I don't believe there are any browsers that support FTP uploads (and even if there are any, I doubt it'd be possible to upload from JS).

HTTP also has the advantage of being allowed through virtually every firewall.

It seems that webapps are paving the way of the future, for better or worse.

</comment></comment><comment><USER9> The 100-Continue idea mentioned in the 3 year old top comment seems like a much better idea. The issues on the tus issue tracker seem to discard this prematurely.

<comment><USER6> Hi, one of the authors here. 100 Continue wasn't discarded that quickly and is part of the protocol. More info here: [https://github.com/tus/tus-resumable- upload-protocol/issues/...](https://github.com/tus/tus-resumable-upload- protocol/issues/9)

<comment><USER9> I saw that issue. As I read it, it discards using 100 continue to solve the original problem.

</comment></comment></comment><comment><USER10> Do you have to use the tus server written in go ([https://github.com/tus/tusd](https://github.com/tus/tusd))? Possible to use a node.js backend?

<comment><USER11> You could implement the protocol in node.js. Here's the standards document: [https://github.com/tus/tus-resumable-upload- protocol/blob/ma...](https://github.com/tus/tus-resumable-upload- protocol/blob/master/protocol.md)

edit: Looks like someone's already done that: [https://github.com/vayam/brewtus](https://github.com/vayam/brewtus) (found on [http://tus.io/implementations.html](http://tus.io/implementations.html), which also has links to Ruby, PHP and CoffeeScript server implementations, and Qt C++, PHP, Go, and Python clients)

</comment></comment><comment><USER12> As much as I'd like to see this using an existing standard, I'm very glad - <USER2> upload bandwidth is <1 megabit, and I get several disconnections a day (ADSL desync)

<comment><USER6> Hi, one of the authors here. I really hope the sites that you're using a lot will all implement tus :) I'm confident that could avoid some frustrations

</comment></comment><comment><USER13> Does this allow traffic shaping on the client? Or will this "stuff the pipe" once an upload starts?

<comment><USER6> Hi, one of the authors here. It would, but traffic shaping is not part of the protocol itself and by default tus will saturate available connections.

That said we're writing down some recommendations in a separate 'developer guide' document that offers best practices for implementing and deploying tus, traffic shaping could be part of it. Feel free to weigh in here [https://github.com/tus/tus-resumable-upload- protocol/pull/68](https://github.com/tus/tus-resumable-upload- protocol/pull/68)

<comment><USER13> I think traffic shaping is very desirable when using a websocket for a separate command-channel. The last thing you want is an upload blocking all communications over that command-channel.

Furthermore, browsers can open only a maximum number of connections at the same time (I believe the maximum on some browsers is even just 2). What if the application already uses one connection for a websocket? Will there be only 1 connection left for the upload? And what if the browser needs to download other resources in the background, such as images, fonts, etc.?

Just some concerns, good luck with the project :)

<comment><USER6> Some valid concerns indeed! You may run dedicated uploading infra which allows more connections (different subdomain/IPs), but it's something we want to be explicit about in our developer guidelines, I'll also see if we can make traffic shaping part of the js browser implementation, as this seems to need it most - thanks!

</comment></comment></comment></comment><comment><USER14> How long till you guys get a Java server library out?

Currently using AWS API for resumable uploads here.

<comment><USER6> Hi, one of the authors here. You are the first one to request it, I've documented that here [https://github.com/tus/tus-resumable-upload- protocol/issues/...](https://github.com/tus/tus-resumable-upload- protocol/issues/67).

None of the current core members have experience running Java servers in the real world so it's hard to see what would be involved. We're definitely open to discussing it in the issue if you like.

</comment></comment><comment><USER15> Why are they not prefixing their headers with "X-"?

<comment><USER16> I recall it became unnecessary at some point(?)

Might be relevant. [https://tools.ietf.org/html/rfc6648](https://tools.ietf.org/html/rfc6648)

<comment><USER6> Hi, one of the authors here. Correct, we added that to the protocol FAQ too: [https://github.com/tus/tus-resumable-upload- protocol/blob/ma...](https://github.com/tus/tus-resumable-upload- protocol/blob/master/protocol.md#why-are-you-not-using-the-x--prefix-for-your- headers)

The only exception is X-HTTP-Method-Override, as people have been standardizing on this, and the header is specifically meant to let people deploy tus in environments that don't support all of HTTP and are apparently hard to change.

</comment></comment></comment><comment><USER16> Out of curiosity why did you decide to use NSURLConnection instead of NSURLSession? I recall NSURLSession also had some code related to resume functionality for both uploads and downloads but my memory is a bit foggy right now.

<comment><USER17> Particularly since NSURLConnection is deprecated in the current SDK. NSURLSession has been available since IOS 7.

While NSURLSession does support resumable downloads, it isn't able to resume uploads.

The needNewBodyStream: delegate is the closest thing, and that is called when first uploading from an NSInoutStream or when a transmission error occurs for an idempotent request, or an auth challenge occurs when some of the stream has been sent. (Streams cannot be rewound.)

Background NSURLSessions can take a file reference to upload, and ideally will perform the upload "at a good time", hopefully while charging and connected to a stable network. (But it won't resume an upload, just retry if possible.)

Disclaimer: I'm "involved", but not speaking for any parties involved. Mostly because I don't get invited to those sorts of parties.</comment></comment>


Show HN: Find trails to run near you, anywhere in the US or UK - <AUTHOR> https://trailsto.run <comment><USER2> Congrats on shipping!

Checked for NYC, but says it has only data for US. Where actually is data available?

<comment><AUTHOR> I ran "New York, NY" with a 5 miles search and got some results -- what did you query specifically?

</comment></comment><comment><USER3> Says there is only data for the US when I tried to search in the UK

<comment><AUTHOR> Ah yeah, that's still the default error message. If you're searching in the UK you'll probably want to search a bit closer to where you expect trails to be, eg. Crowden, Glossop, UK

Let me know where you searched and found nothing and I'll look into it!</comment></comment>


To take an invention to market, MIT grad students push their academic work aside - <AUTHOR> http://chronicle.com/article/Start-Up-Slow-Down/148923/?cid=wc&utm_source=wc&utm_medium=en

<comment><USER2> Those work habits sound obscene.</comment>


Everyone but Apple joins new "buy once, play anywhere" group - <AUTHOR> http://arstechnica.com/news.ars/post/20080915-everyone-but-apple-joins-new-buy-once-play-anywhere-group.html <comment><USER2> I notice the article doesn't say that Apple was invited to the party but refused to show up.

Apple is already on record as saying they belong to the "buy once play anywhere forever" group: I can play un-DRM'D movies on my iPod Touch today, and if it were possible to buy un-DRM'd movies on iTMS, Apple would make an additional fortune from iPod and iPhone and AppleTV sales.

Judging by recent events with the record labels refusing to allow Apple to sell non-DRM content and studios like NBC dropping iTMS over a pricing spat (a move they reversed after discovering that nobody was buying their content elsewhere), I'm guessing that Apple is forcibly excluded from this group.

I may be wearing a foil hat, but my thought is that the entire point of this alliance is to come up with a DRM'd alternative to iTMS that consumers will actually use. If Apple were allowed in, they would still control the market and the pricing, which isn't what the studios want.

</comment><comment><USER3> Buy once. Play anywhere. Note what's missing: the word "forever". Hey MSFT, hey Sony --- the first track I bought on iTMS? _STILL PLAYS_.

</comment><comment><USER4> To combat piracy you have to deliver a better product. This is just delivering the same product.

</comment><comment><USER5> i miss the good old days when you could tape your favorite song from the radio(you still could, if you actually like radio songs). Modern technology solved some music recording and distribution problems, but it introduced all this bullshit. Was it wort it?

<comment><USER6> >> _Was it worth it?_

yes.</comment></comment>


Ask HN: What's a decent time tracking app for Web and iOS? - <AUTHOR> Looking to track time on various projects. Asking for a friend. <comment><USER2> Not sure about iOS but for macOS, RescueTime ([https://www.rescuetime.com](https://www.rescuetime.com)) does a decent job. It tracks all the websites I visit (unless I explicitly tell it not to).</comment>


Jorn Barger on AI: "Fractal Thicket" Indexing - <AUTHOR> http://www.robotwisdom.com/ai/thicketfaq.html

<comment><USER2> I agree with the basic point that a hierarchy is too sparse of a format to represent human knowledge. For a single category there are many different ways you might want to break it up. Like if I am trying to organize the category of Trees... if I am trying to build a fire I am going to mentally organize trees by "distance to me" and "burnability". Whereas if I am going to build a tire swing I am going to mentally organize trees by "is it in my backyard" and "does it have sturdy branches". But a scientific approach would be entirely different from either of these, and useless for either of my tasks.

But he seems to jump from "a regular hierarchy is too sparse" straight to "therefore we need a special super dense hierarchy". Maybe the hierarchy metaphor is the wrong one for this task.

Here's the logic that seems questionable to me:

 _But I hated the idea of having to search thru all ten zillion complex items, looking for matches to some pattern. I wanted an indexing scheme that allowed you to step right to exactly those right items. And what gradually came clear to me was that the general topology to allow this, has to place a self-similar sub-hierarchy under each node on the simple hierarchy, trees within trees within trees._

Why focus on the problem of "how to handle ten zillion items"? There are plenty of ways to get only a relevant subset of data out of a sea of irrelevant data. The real problem is what sort of AI data structure can help with some useful task, and this totally ignores the question of "what could you do with a fractal thicket".

</comment><comment><USER3> Yeah, I've read that post several times over the last few years- Well worth a read.

It's a pretty impenetrable line of thinking. He hasn't fully formed his ideas but there's definitely "something" there.

<comment><AUTHOR> This is the first time I've run across this guy. He's a pretty interesting character.

There isn't quite enough substance to what he described for me to make any conclusions on it, but it got me thinking.

I kinda wish he'd be willing to accept enough money to stop being homeless and start turning this idea into some working code.</comment></comment>


Minimal - <AUTHOR> http://www.b-list.org/weblog/2008/jun/15/minimal/ <comment><USER2> _the point at which there is nothing left to take away is the point at which there is nothing left, period._

I stopped reading after this punishingly fatuous little gem.

At that moment, I realized that the author did not want to understand functional minimalism (aka elegance) and instead preferred to argue semantics. A quick skim confirmed this.

<comment><USER3> You must not have skimmed very far, because two paragraphs later he says:

> _"I mention this not because it's any sort of earth-shattering revelation, > but simply because it's important to recognize that minimalism for > minimalism's sake is just dumb. Like any other design tool, it should be a > means to an end.

The thing that's useful about reaching the point of absolute minimalism, then, is not that it's the point at which you've achieved perfection, or even anything resembling your end goal. Rather, it's the point at which you realize which of the things you've removed were actually important, because their absence brings them into stark focus."_

... and then proceded to talk about ways he went about making content actionable rather than have administrative cruft all over the page.

</comment></comment><comment><USER4> You would think that someone who holds minimalism above all else would pay excruciating attention to the details. What's up with the horrible pacing of the text with enormous gaps everywhere? What's up with no hover state for links? What's up with the line lengths that are a little too long? Minimalism is a beautiful thing when done correctly, but it generally requires MORE work to make it beautiful. This, in my opinion, is lazy minimalism. And a bit preachy.

</comment><comment><USER5> I'm all for content, but it isn't all about content.

If design weren't important, we would all drive glorified golf carts and live in shipping containers.

</comment><comment><USER6> At 1900 words this is too long for a post about "minimal".

<comment><USER7> Tell that to the people running this performance: <http://en.wikipedia.org/wiki/As_Slow_As_Possible></comment></comment>


Highly trained, respected and free: why Finland's teachers are different - <AUTHOR> http://www.theguardian.com/education/2015/jun/17/highly-trained-respected-and-free-why-finlands-teachers-are-different

<comment><USER2> A friend with a BS in mathematics was studying for a California teaching credential. He told me once that it was the most wonderful experience when kids who were previously poor at math, get it because of his teaching.

But he dropped out of the program because there were two many rules. Now he's an engineer.</comment>


Geospatial Analysis - a comprehensive guide - <AUTHOR> http://www.spatialanalysisonline.com/output/ <comment><USER2> I was really looking forward to seeing the content of this comprehensive guide having just gone through a GIS 0-60 myself last year.

That guide is horrible! It _might_ contain some good content in there, but it is ridiculously wordy. It takes them about 3-4 paragraphs of dry useless fluff to get in anything useful.

There may be some gems in there, but I cannot imagine reading it cover-to- cover.

Too bad, since this subject lacks a good entry-level guide to give you a 30000-ft view of the domain.</comment>


Those People We Tried to Cancel? They're All Hanging Out Together - <AUTHOR> https://www.nytimes.com/2019/11/02/style/what-is-cancel-culture.html <comment><USER2> My favorite quote: "Woke progressives are a pretty miserable bunch," he said. "Try joking with that group."

Too true. And they don't have a clue.

<comment><USER3> I'm a leftist and all the leftists I hang out with have some grubby-ass humour that wouldn't fly anywhere 'civil'. We just don't make racist/transphobic/etc jokes. It's honestly not that hard and this idea of the oversensitive progressive is overplayed and not grounded in reality.

<comment><USER4> The phrase grubby-ass humor itself sounds like trying too hard to stay on the safe side of the line.

</comment></comment></comment><comment><USER5> Social exclusion is an overused form of punishment. It eliminates any chance of education or understanding on either side. Done often enough, and it polarizes everyone.

<comment><USER6> I think it's a vicious cycle. If you harshly punish people for saying certain things, you create taboos. That causes people to avoid discussing these taboo topics. Everyone knows that they're bad things, but there's none of the debate where you can practice fleshing out exactly what your objections to those ideas are.

Then when someone says those things, you have trouble articulating why they're bad, and then you fall back on the threat of social exclusion.

</comment></comment><comment><USER7> This isn't unexpected at all. This is exactly what critics of cancel culture said would happen

<comment><USER8> Question is if it's a bad thing or not. I mean, people with questionable morals or worldview have been hanging out for all of human history. We could complain that ostracizing people who became members of the Klan makes the Klan happen, but at least then they're over there being racist at Klan rallies and not in the middle of the public square.

<comment><USER9> The problem is when all of the progressives opponents start banding together, there might just be more of them than there are progressives and then, whoops, game over. There are a lot of centrists and liberals that the progressives have alienated.

(You know you have a problem when even Barack Obama is stepping up and criticizing "woke" people: [https://www.bbc.com/news/world-us- canada-50239261](https://www.bbc.com/news/world-us-canada-50239261))

<comment><USER10> Your "when even" isn't particularly accurate. Obama was always a relative centrist. It's just that many consider it radical to think that we should do simple things like provide most people with access to healthcare.

<comment><USER11> The "even" in "even Barack Obama" isn't about him being super far left, then "even" is about the fact a former president has to be the one telling people their tactics aren't working.

And then they go on to ignore his advice because he is insufficiently left. Which ironically proves how prescient his advice is.

</comment></comment></comment></comment></comment><comment><USER12> Gossip and all its moralizing and social consequences used to happen over the back yard fence.

Now it's major stories in the paper of record, such as this one.

Another unintended side effect of the internet.

</comment><comment><USER13> > Cancellation does present a question about power, and who has it.

Neither side has it. The people with money have it, as always. Follow the money, and you can predict who gets cancelled and who doesn't.

Though there is an argument to be made for companies vastly overestimating the short-term negative financial impact of "offending" the various tiny, non- conformist factions in society due to how loud they are, and underestimating the long-term loss of faith caused by acting in league with those small factions against the majority of the population due to the "silent" in "silent majority".

</comment><comment><USER14> [http://archive.is/Bcblr](http://archive.is/Bcblr)

</comment><comment><USER15> Why was this flagged? I found this an incredibly interesting view into this 'cancel culture' that I've heard referenced vaguely, but never described explicitly. With an added bonus of getting an up-to-date view on the "things you can't say" in 2019. I would love to see the smart folks of HN discuss it.

<comment><USER16> I didn't flag it, but have you seen the comments on this thread? I don't blame whoever did flag it.

There are many people in here not discussing this topic in good faith, and one person in particular who is flooding the comments with intentionally inflammatory and low-effort comments.

I wish HN could have an adult conversation on this topic too, but it's not going that way so far. Maybe someone can re-post this on a weekday so we don't ruin Saturday for one of our mods.

<comment><USER17> So anything a lobby doesn't want discussed requires nothing more than a few spam comments?

At a minimum HN should separate blocking comments from delisting posts..

<comment><USER16> Unfortunately, yes. This is not the first time I've seen this pattern play out here.

Any popular article where the main subject is gender typically goes the same way. If the mods are around, they can sometimes step in early enough to encourage good dialogue and nip the bad actors early on. But when that doesn't happen, these threads will usually be dominated early-on with bad content from ideologues, and end up even worse because those comments end up shaping the dialogue into a flame war.

So many HN readers just flag the whole post when it's obvious that the comments have strayed too far outside of the HN guidelines for discourse. I don't do that myself or condone it, but it's not uncommon.

Sometimes the article will end up being re-posted with greater mod oversight to prevent both agenda-flagging (when people really do flag on-topic articles to prevent others from seeing it) and to fix the problem caused by lousy comments where the good replies need to be de-coupled from low-effort parent comments. This thread clearly needs moderation for both of those issues, but it may not happen today.

</comment></comment></comment></comment><comment><USER2> Love that this article is flagged now, too. Maybe it's ironic - an article from NY Times (liberal bastion), "cancelled" for discussing cancellation in a neutral light?

</comment><comment><USER18> Really interesting!

<comment><USER19> Quillette being a white nationalist publication is either a joke, or the definition has been stretched so far out of shape that it is unrecognizable.

They will publish anything well-argued.

<comment><USER20> >Quillette being a white nationalist publication is either a joke, or the definition has been stretched so far out of shape that it is unrecognizable.

What are you talking about? Is grepthisab or the article saying Quillette is a white nationalist publication?

<comment><USER9> grepthisab edited all of their original comment out of their post.

</comment></comment></comment></comment><comment><USER8> This is why cancel culture isn't actually real.

[https://youtu.be/szybEhqUmVI](https://youtu.be/szybEhqUmVI)

<comment><USER21> I watched and it has me convinced to a certain extent. However, he mostly looks at well known comedians/actors on TV or in movies. There are other people on YouTube that have been taken off the platform or demonetized and that is another issue. To the extent that it ruins someone life, I'm sure most people can handle being taken down or having to change their career aspirations, but it led one individual to shoot up YouTube and take their own life. Looking at several of the better scenarios doesn't make the worst case scenario not real.</comment></comment>